Auditor Job Description

An auditor tests whether an organization's financial information, and the controls that produce it, can be relied on, then puts a conclusion in writing for the people who depend on it. In finance, that reader might be a bank's audit committee, the shareholders of a listed asset manager, an insurance regulator, or the board of a credit union. The work runs on two tracks. External auditors work for an independent public accounting firm and issue an opinion on a client's financial statements. Internal auditors are employees of the company, and they report on controls, risk and compliance to management and the audit committee.

A financial statement audit follows a calendar. Planning starts well before the balance sheet date: the team studies the business, sets materiality, and maps the accounts where a misstatement could hide. At a bank, that means the allowance for credit losses, loan servicing and interest income. At a broker-dealer or fund manager, it means the valuation of thinly traded securities, custody of client assets and the math behind management fees. At an insurer, it means loss reserves and the actuarial assumptions feeding them. Interim fieldwork tests controls: walking through how a wire transfer gets approved, reperforming a reconciliation, and checking that system access matches each person's job. After year-end comes substantive work, including confirmations with counterparties, recalculations, analytical procedures that compare expected and recorded balances, and detail testing of journal entries.

Every procedure leaves a workpaper. A senior, then a manager, then the engagement partner reads that file and decides whether the evidence supports the conclusion. Staff auditors spend much of their week building the file; seniors run fieldwork and coach the staff; managers take the hard conversations with the client's controller or CFO when an issue surfaces.

Electronic evidence now has its own language in the standards. The PCAOB adopted amendments to AS 1105, Audit Evidence, covering technology-assisted analysis, and they apply to audits of financial statements for fiscal years beginning on or after December 15, 2025. One new paragraph, under the heading "Evaluating the Reliability of External Information Provided by the Company in Electronic Form," requires auditors to evaluate the reliability of external electronic information that arrives through the company. A September 2025 PCAOB policy statement added that, depending on the auditor's risk assessment and the results of certain procedures, an auditor may not need to perform the separate testing specified in part (b) of that paragraph. In a finance audit, that covers things like a custodian's position file, a pricing vendor's feed or a counterparty statement the client downloads and forwards.

Inside a financial company, internal audit works from a risk-based plan approved by the audit committee. One quarter the team might review anti-money-laundering transaction monitoring; the next, model risk governance, or a cloud vendor's access to customer data. The head of the function, the chief audit executive, usually reports to the audit committee so the team can criticize the managers whose processes it reviews. Findings go out in a standard format: the condition found, the criteria it was measured against, the cause, the effect, and a management action plan with an owner and a due date. Auditors then return to test whether the fix actually works.

Education. BLS lists a bachelor's degree as the typical entry-level education for accountants and auditors. An accounting major is the standard route into a public accounting audit practice, because it covers the coursework a state board counts toward CPA eligibility. Graduates in finance, economics or information systems also enter internal audit and IT audit groups, where the audit plan at a bank covers technology controls alongside financial ones.

Licensing. A CPA license is issued by each state's board of accountancy, and the education and experience rules belong to that board. Check your own board's current requirements before planning extra coursework or a graduate program. Internal auditors can build a full career without a CPA, and several of the credentials below are built for that path.

Credentials worth knowing:

• Certified Public Accountant (CPA), licensed by state boards of accountancy
• Certified Internal Auditor (CIA), awarded by The Institute of Internal Auditors
• Certified Information Systems Auditor (CISA), awarded by ISACA, for IT general controls and systems work
• Certified Fraud Examiner (CFE), awarded by the Association of Certified Fraud Examiners

Standards to know. Internal auditors work under the IIA's Global Internal Audit Standards, which became effective on January 9, 2025, after organizations had a year to begin implementing them. External auditors of public companies work under PCAOB standards, and a working knowledge of the ones covering audit evidence, risk assessment and internal control reporting matters from the first engagement.

Experience. As a rough guide, the step from staff to senior auditor at a firm takes two to three years, and manager comes a few years after that. For a lateral move into a bank or insurer's internal audit group, two to five years of public accounting or regulatory experience is a reasonable base. Time spent on financial services clients helps in those interviews, because it shows you already know what a loan file or a trade blotter looks like.

Technical skills:

• Sampling design, materiality and risk assessment
• Excel at an analyst level, plus SQL, Alteryx or Python for pulling and filtering full ledger extracts
• ERP and core systems: SAP or Oracle on the corporate side; Fiserv, FIS or Jack Henry core banking platforms at banks
• Regulatory reporting basics, such as bank call reports or broker-dealer net capital computations
• Audit platforms such as AuditBoard, Workiva or TeamMate for workpapers and issue tracking

Working style. The job rewards skepticism delivered politely. A good auditor asks for the support behind a number without implying the client is lying, and writes a finding so plainly that the business owner cannot misread it. It also takes stamina: deadlines are fixed by filing dates and board meetings, and the file has to be complete before anyone signs.

BLS does not report auditors separately from accountants, so federal figures describe the combined occupation. Accountants and auditors held 1,449,500 jobs in the May 2025 wage survey. BLS projects employment of the occupation to grow 5 percent from 2025 to 2035, which it rates as faster than the average for all occupations, with about 115,300 openings a year on average over the decade.

Pay inside finance

The May 2025 OEWS industry tables show what the occupation earns in parts of finance and in accounting firms. In securities, commodity contracts and other financial investments, the median was $105,160. In credit intermediation, the banking and lending sector, it was $85,200. In accounting, tax preparation, bookkeeping and payroll services, where public accounting firms sit, the median was $81,490. These rows cover accountants and auditors together, and BLS does not split out auditors at any of them.

Rule changes landing at audit firms

For people on public company engagements, the standard to watch is QC 1000, A Firm's System of Quality Control. It was set to take effect on December 15, 2025, but the PCAOB delayed it for one year, until December 15, 2026, after hearing that some firms had encountered implementation challenges. In an order dated November 2, 2026, the SEC approved PCAOB amendments to the standard, which take effect on December 15, 2026, the same date as the rest of QC 1000. Among other changes, they let firms select the date as of which they annually evaluate their quality control system, rather than requiring an evaluation as of September 30. For staff and seniors, a firm's QC system is what defines the consultation, review and monitoring steps their engagement files go through.

Internal audit's topical requirements

The IIA has added topical requirements, which all internal audit functions must apply in conformance with the Global Internal Audit Standards when providing assurance on the topic. The Cybersecurity Topical Requirement became effective February 5, 2026, and the IIA describes it as a minimum baseline for assessing cybersecurity. The Third-Party Topical Requirement took effect September 15, 2026. The Organizational Behavior Topical Requirement carries a December 15, 2026 effective date, and the Organizational Resilience Topical Requirement carries an April 30, 2027 effective date. For an internal auditor at a bank or insurer, those requirements set out the work expected when giving assurance on third parties, cybersecurity and organizational behavior.

Where the role leads

On the firm side, the ladder runs from staff to senior, manager, senior manager and partner, with specialist tracks in IT audit, valuation and regulatory advisory. People who leave a firm move into financial reporting, technical accounting, controllership, internal audit or risk roles at the kind of companies they audited. Inside a financial company, the internal audit path leads toward audit manager, audit director and chief audit executive, or across into compliance, operational risk and model risk management. The skills that carry across every one of those moves are the same: reading a control, testing it, and explaining in writing what happens if it fails.

Dear Hiring Manager,

I am applying for the Internal Auditor position on your bank's audit team. For the past three years I have worked as an external auditor at a regional accounting firm, where my client list centered on community banks, a trust company and a small broker-dealer. I am ready to move to the internal side and work on one institution's risks year round rather than seeing them for a few weeks at a time.

On my bank engagements I tested controls over loan origination, wire transfers and the allowance for credit losses. Last season I led fieldwork on a commercial loan review for the first time: I scoped the sample, coached two first-year associates through file testing, and wrote the summary memo the partner used with the audit committee. When our team found that a client's reconciliation of its correspondent bank account had stopped being reviewed after a staffing change, I documented the gap, walked the controller through the root cause, and checked the corrected process during year-end work.

I also built our team's first query to pull the full general ledger from a client's core system and filter it for manual entries posted after hours. It turned a week of scanning printouts into an afternoon of follow-up on the entries that actually looked odd, and the method is now part of our firm's bank audit template.

I passed the final section of the CPA Exam this spring and am working toward the CISA, because the controls I find most interesting sit in a bank's systems and its vendor relationships. I write findings that a business line manager can act on without a second meeting, and I am comfortable telling a senior executive that a control does not work.

I would welcome the chance to discuss how my bank audit background could support your plan for next year.

Sincerely, Jordan Ellis