Internal Audit Senior Manager to Director: What the CAE Is Actually Deciding

Somewhere around Senior Manager, the Chief Audit Executive stops reading your workpapers.

Not because they don't matter. Because by then, clean workpapers are the baseline. You scope well, you test properly, your findings hold up. That's why you're a Senior Manager. The CAE's question about you has changed, and in most audit functions nobody tells you it changed.

The new question is simple: can I put this person in front of the audit committee, hand them part of the plan, and trust them when a business head wants a finding downgraded? Here's how the internal audit ladder actually works at that step, what the Director decision is based on, and how to build the evidence from the seat you're in.

How The Internal Audit Ladder Actually Runs

The early rungs are unusually clear. Staff or associate auditors learn the methodology. Seniors run fieldwork. Managers own an audit from planning to report. Senior Managers run a portfolio of audits and the people doing them. Titles vary: at many US banks the same seats are called AVP, VP and SVP, and a "Director" at one firm is a "Senior Manager" at another. Match on scope, not title.

Up to Senior Manager, promotion tracks technical skill fairly closely. Above it, the job changes shape. Directors (and in bigger functions, Managing Directors or a Deputy CAE) spend less time reviewing audits and more time deciding what gets audited, defending what the function concludes, and representing it to the people it reports to. That's where good auditors stall, and it looks a lot like where people stall on any risk and compliance career ladder: the skill that got you here stops being the one that's scored.

Audit is also paid and promoted differently from the business. The third line's pay is deliberately kept independent of the areas it audits, and the board has a say in the CAE's own pay and appointment. We covered how the three lines pay and promote differently in more detail. For the Director step, the important part is that the decision sits with the CAE, and the CAE answers to the audit committee.

Why The Bar Moved Toward The Board

The IIA's Global Internal Audit Standards were issued in January 2024 and took effect on 9 January 2025. They put governance of the function front and centre, with a full domain on the relationship between internal audit and the board. A few of the standards describe the Director job almost exactly:

Standard 7.1 (Organizational Independence): the CAE must confirm the function's independence to the board at least once a year, and the function must be free to decide what to audit and what to report.

Standard 9.4 (Internal Audit Plan): the plan is built from an assessment of the organisation's risks and is discussed with the board.

Standard 14.3 (Evaluation of Findings): auditors evaluate the significance of each finding, working with management on root causes and effects.

US bank supervisors say the same thing their own way. The Fed's SR 13-1 (2013) and the OCC's heightened standards (2014) both expect internal audit to report functionally to the audit committee. So the CAE's most exposed work is the board-facing work: the plan, the ratings and the committee paper. A Director is the person the CAE can hand a share of that to.

The Three Decisions A Director Owns

1. The plan: what doesn't get audited this year. Every audit plan is a trade-off. Finite hours mean some real risk goes another cycle without coverage. Senior Managers usually get handed a plan. Directors help build it, and have to defend why one area made the cut and another didn't.

2. The rating: what happens when a business head pushes back. A lower rating means less scrutiny, lower remediation cost and a better-looking report upstairs, so ratings get argued. The CAE needs to know that you'll engage the argument honestly, move the rating if the evidence really changes the picture, and hold it with clear reasons if it doesn't.

3. The room: how you speak to the audit committee. Committee members are non-executives with limited time. They need the significance of a finding in plain language, without alarming them over nothing or burying something that matters. That's a different skill from writing a workpaper, and it's the one most Senior Managers have practised least.

The Rating Fight Is The Real Interview

Whether it's an internal promotion or an external Director interview, the most telling question is some version of: "Tell me about a finding management fought." Here's an illustration of how answers differ.

Weak: "Management disagreed with our high rating, but we explained our position and the rating stayed high."

Strong: "The business argued the access finding should be moderate because no misuse had been found. I re-tested a sample to check that, and there was no misuse, but a terminated user still had access to approve payments. I kept it high, explained in writing that the rating reflected exposure, not a loss event, and took it to the CAE before the closing meeting so there were no surprises. Management accepted it and moved the remediation date forward."

The strong version shows the three things the CAE is really checking: you engaged the argument, you tested rather than asserted, and you managed the escalation so the relationship survived. That's effective challenge, the skill that separates a Manager from a Director, and in audit it's built into every contested finding. Most auditors just don't tell it that way.

Have one example where you moved a rating too. A candidate who has never changed a rating after pushback reads as rigid, not independent.

Audit Committee Exposure When You Haven't Presented

Many strong Senior Managers have never stood in front of the audit committee. That isn't disqualifying, but you need evidence of the underlying skill. The closest equivalents:

You wrote the paper someone else presented. Say so. Drafting the committee summary of a significant finding is committee work.

You presented a contested finding to senior executives. A closing meeting with a business head who disagreed is a harder room than many committee sessions.

You briefed the CAE ahead of a committee meeting. If the CAE used your framing, that's exactly the trust the Director seat needs.

Building The Evidence From A Senior Manager Seat

Ask to be part of the annual risk assessment and plan. Even as a contributor. Arguing for an area's inclusion, with reasons, is the most direct evidence of the plan decision, and it's rare among Senior Managers.

Take the contested engagement. The clean, low-friction audits are easier to deliver and produce weaker Director evidence. Volunteer for the one with a political finding in it.

Own a new or emerging area. When a function has to audit something it hasn't covered before, whoever builds that coverage learns the plan, the methodology and the committee conversation at once. Operational resilience is a current example: with regulators now testing it, audit teams are working out how to review programs that barely existed a few years ago. If that's your area, it helps to understand how operational resilience differs from business continuity, because that distinction is exactly what the audit has to test.

Ask the CAE plainly. "What would you need to see from me to have a Director conversation?" CAEs usually have a clear view and very few Senior Managers ask directly.

Framing It On Paper And In The Room

The common mistake is leading with volume: number of audits led, frameworks covered, team size. That tells the reader you're a competent Senior Manager, which they already assumed. Lead instead with the judgment moments above: the rating you held or moved, the plan decision you influenced, the committee paper you wrote. That's what the hiring panel sees when your resume lands: a remit list reads as Senior Manager, an outcome reads as Director.

In the interview, don't walk through your engagements in order. Pick one or two moments of judgment and let the rest act as background. Panels probe the specifics, so choose examples you can defend in detail, which is a big part of what an interview panel is actually scoring.

Internal candidates tend to under-prepare, assuming the CAE already knows their record. The CAE still wants to hear you explain your reasoning. External candidates have no track record in the room, so their examples need to be specific enough to check.

Know What The Seat Actually Is Before You Push

A Director in internal audit does less auditing. More of the week goes on the plan, the committee, the business relationships and developing the next set of Senior Managers. People who want the title mainly to keep doing hands-on audit work at a higher grade sometimes find the seat less satisfying than they expected.

That's also why some strong auditors take a different route: across to a second line Director seat in ERM, operational risk or compliance, where their testing background is valued. That move has its own reframing traps, covered in the audit-to-compliance pivot playbook. Neither route is better. Choose the one whose actual work you want.

Clean workpapers get you to Senior Manager. A finding you held under pressure, with the relationship intact, gets you to Director.

Questions People Actually Ask

How do you get promoted from internal audit senior manager to director?

By showing you can do part of the CAE's board-facing work: help set the risk-based audit plan, hold or revise finding ratings under executive pushback with clear reasoning, and communicate significance to the audit committee. Technical skill is assumed at this level.

Does the CIA certification matter for an audit director role?

It's widely held and often listed in job specs, so it can matter at the screening stage. But at Director level it doesn't substitute for evidence of judgment on the plan, the ratings and the committee.

What if I've never presented to the audit committee?

It isn't disqualifying. Writing committee material, presenting contested findings to senior executives, or briefing the CAE ahead of a committee meeting all show the same skill.

Is it a weakness to say I lowered a finding rating after pushback?

Not if the evidence justified it and you can explain why. Panels are wary of candidates who have never moved a rating, because it suggests they don't engage with management's argument.

Should an internal auditor move to the second line to reach Director faster?

Sometimes. Second line Director seats in ERM, operational risk or compliance value audit experience. Whether it's faster depends on the seat, and the work is different, so decide on the job you want, not just the title.