Internal Auditor

The Internal Auditor owns whole process areas within an audit rather than individual test steps. You scope the area against the risk assessment, agree the approach with the in-charge, run the walkthroughs and testing, and write the finding — including the root cause and the recommendation that management will be held to. The judgement shift from the entry seat is real: deciding what is worth testing matters more than testing thoroughly.

This is also the level at which writing becomes a professional skill. A finding must be factually unarguable, proportionate in its rating, and specific enough that remediation can be verified later. Findings that overstate exposure damage the function's credibility as much as findings that understate it.

In Singapore, most people reach this seat either by promotion from an in-house entry role or by moving in from external audit after two to three years. Banks and insurers add a regulatory layer — MAS expectations around the internal audit function shape both scope and documentation standards — while listed groups emphasise regional coverage and Audit Committee reporting.

Where this sits: the second rung of the Internal Audit & Risk pathway, between Internal Audit Executive and Senior Internal Auditor. The equivalent practice-side seat is Senior Audit Associate, and the common finance-side alternative is Senior Finance Executive.

• Scope and deliver assigned process areas within an audit, from planning through to draft finding.
• Design test procedures proportionate to the assessed risk rather than repeating last year's programme.
• Run population-level analytics where data allows, and justify sampling where it does not.
• Draft findings with root cause, quantified exposure, rating rationale and a practical recommendation.
• Agree facts and remediation dates directly with process owners, and escalate disputes with evidence.
• Review the working papers of junior team members for completeness and reperformability.
• Track remediation and validate closure with independent evidence, not management assertion.
• Contribute to the annual risk assessment and to the design of the rolling audit plan.

• A degree in accountancy, business, finance or information systems.
• Two to four years of internal or external audit experience, or equivalent controls experience in finance operations.
• Demonstrable ownership of a process area end to end, including the written finding.
• CIA, CA (Singapore) or ACCA in progress or completed; CISA where the function includes IT audit.
• Comfort with analytics tooling — Power BI, ACL, IDEA or SQL — is increasingly expected rather than optional.
• Availability for regional travel across Southeast Asia during fieldwork cycles.

• Bring your hardest finding. Explain the exposure, how you proved it, and how management responded when challenged.
• Justify a scope decision. Say what you chose not to test and why — risk-based judgement is what is being assessed.
• Show analytics, not tools. Describe an exception you found in full population data that sampling would have missed.
• Handle a disagreement honestly. Interviewers look for evidence-led escalation rather than either capitulation or conflict.
• Ask how findings are tracked. A function with real closure validation is one where the work has consequence.