How to get hired
Section 138 of the Companies Act makes every listed company, and unlisted companies above the size limits in rule 13 of the Companies (Accounts) Rules, appoint an internal auditor. The auditor can be an outside CA firm or the company's own employee. Add RBI's risk-based internal audit framework for deposit-taking NBFCs and larger non-deposit NBFCs, and Sarbanes-Oxley testing for US-listed groups, and you get four quite different employers. Pick the one that matches what you have.
SOX testing in global capability centres
US-listed companies must report on their internal control over financial reporting under SOX section 404, and much of the testing is done from Bengaluru, Hyderabad, Gurugram and Pune. These teams hire CAs, CA Inters, ACCAs and graduates with two or three years of audit as "SOX Analyst", "Senior Associate – Internal Audit" or "Internal Controls Analyst". The interview is practical: walk through a procure-to-pay control, explain test of design versus test of operating effectiveness, pick a sample size, and say what counts as a deficiency. Expect US-hours overlap in testing season.
Bank and NBFC branch audit
Banks run concurrent and branch audits, and NBFCs (gold loan, vehicle finance, MSME lenders, housing finance) keep large in-house audit teams. Titles look like "Branch Internal Auditor", "IA Regional Audit" or "Auditor – Branch Audit". You check loan files against credit policy, cash and gold security, KYC, and branch expenses, travelling across a region. Graduates and M.Coms get in here without a CA, and it is one of the few internal audit routes that takes freshers. Ask about travel allowance, the number of branches per month, and whether you are on company rolls or a staffing payroll.
Big 4 and mid-tier risk advisory
Firms that do outsourced internal audit hire newly qualified CAs as Assistant Manager or Consultant in their risk advisory practices. You audit several clients a year, which teaches you more industries faster than any single company would. ICAI campus placement and referrals are the usual doors.
In-house at Indian companies
Large Indian groups, hospitals and manufacturers hire "Assistant Manager – Internal Audit" or "Deputy Manager – Internal Audit", usually CAs or CMAs with two to four years of experience. Plant visits, stock counts and contract reviews are routine. CMAs with costing experience do well here because many findings are about consumption, scrap and pricing.
Certifications employers name
The IIA's Certified Internal Auditor (CIA) is the credential that shows up most in job posts, in three parts, all multiple choice, revised in 2025 around the Global Internal Audit Standards. Check eligibility and current fees on the IIA site before you register. CISA from ISACA matters if you want to audit IT general controls and system access. Neither replaces a CA for senior Indian roles, but either helps a graduate or MBA get past screening.
Moving up
The path is Associate, Senior Associate, Assistant Manager, Manager, Senior Manager, then Head of Internal Audit, who reports to the audit committee. A common mid-career move is sideways into risk, compliance or business finance, since internal auditors know how the company actually works. See risk management and compliance.
What the work is like
An internal audit year is a plan of reviews: purchases this quarter, payroll next, a plant or a region after that. Each review is a few weeks of walkthroughs, sampling and interviews with process owners, then a report with observations and agreed actions, then follow-up months later to check they were done.
The people side is harder than the numbers. Process owners rarely enjoy being audited, and a good internal auditor learns to write findings that are firm but fair. Hours are steadier than in statutory audit, except in SOX teams near the US year-end and in branch audit roles where travel eats evenings.