This guide is for auditors applying to roles in public accounting, internal audit, banking and insurance, or government, from first-year associates to audit directors. You'll learn which keywords to use, how to write a summary and bullets that prove scope and results, and how to tailor your resume to each side of the profession.
Keyword match
Auditor, Internal Audit
6/8must-have skills
Found on your resume
Missing
TAYLOR BRENNAN, CPA
Columbus, OH · (614) 555-0142 · email@example.com · LinkedIn
Summary
Big 4 assurance alum, now three-plus years inside a public company's internal audit team. Runs SOX 404 programs from scoping to sign-off and swaps judgmental samples for analytics.
1Skills
SOX 404 · ICFR · COSO 2013 · ITGCs · Risk Assessment · Walkthroughs · Root Cause Analysis · AuditBoard · Alteryx · SQL
2Experience
Senior Internal Auditor Calder & Wynn Industrial, Inc. · Mar 2023 – Present
The summary says which side of audit you come from and what you do better than other candidates, the first thing a hiring manager sorts on.
Summary examplesFrameworks first, tools last, in the terms postings use, so the ATS and a skimming reader both find them.
Keywords and skillsExternal auditor reliance lowers the audit fee, so controllers and audit committees track it. It reads as business value, not just "testing."
Bullet pointsDollars actually recovered show analytics that paid off, not a tool you once opened.
The licensing state shows an active license rather than "CPA eligible" and settles the question before the interview.
Certifications"Audit experience" means different things to a Big 4 partner, a chief audit executive and a state auditor. Name the framework: PCAOB or AICPA auditing standards for external audit, the IIA's Global Internal Audit Standards (effective January 9, 2025) for internal audit, or GAGAS (the Yellow Book) for government work.
Show you can do more than tick and tie: walkthroughs, tests of design versus operating effectiveness, deficiency evaluation (deficiency, significant deficiency, material weakness) and root cause.
A first-year associate didn't "audit a $3B company." State the areas, cycles or controls that were yours, staff you reviewed and whether you were in charge.
Postings often ask for SQL, Alteryx or ACL/IDEA. The best evidence is a sample you replaced with full-population testing and what it found.
Remediation rates, audit committee reporting and regulator outcomes show management fixes what you find.
Soft skills
Don't list "attention to detail." Show it: a finding management accepted, fewer review notes, a clean regulator exam.
Audit associate with one busy season at a regional CPA firm, supporting financial statement audits for 7 manufacturing and nonprofit clients ($14M–$160M revenue). Tested cash, receivables and fixed assets in CaseWare and drafted lead sheets for senior review. Passed AUD and FAR; REG scheduled for spring.
Why it works: Client count, size range and test areas, plus exact exam progress instead of "CPA candidate."
Internal auditor with 4 years of experience, 2 of them at a Big 4 firm, executing SOX and operational audits for a $2.3B specialty retailer. Owns payroll and treasury cycles and wrote the department's ITGC testing guide now used for 14 in-scope applications. CIA; CISA exam passed, experience verification pending.
Why it works: Company size, cycles owned and one contribution that outlasted a single audit.
Internal audit director who grew a co-sourced function from 3 to 11 auditors at a $6.8B regional bank holding company. Owns the risk-based audit plan and reports quarterly to the audit committee. Led the function through its first external quality assessment under the Global Internal Audit Standards and two OCC exam cycles with no audit-related MRAs. CPA, CIA.
Why it works: Function-building, board reporting and regulator outcomes are what directors are hired on.
WeakPerformed audit testing for clients.
StrongTested revenue cutoff and receivables for 6 audit clients ($9M–$140M revenue), sending 214 confirmations and clearing 97% of exceptions before senior review.
What changed: Areas, volume and a quality measure your senior would recognize.
WeakHelped with the Single Audit.
StrongTested eligibility and allowable costs for 3 major federal programs under Uniform Guidance, sampling 60 transactions each and writing 2 findings included in the county's Schedule of Findings and Questioned Costs.
What changed: Framework, sample and an output that reached the final report.
WeakResponsible for SOX compliance.
StrongTested design and operating effectiveness of 112 key controls across procure-to-pay and financial close, identifying 9 deficiencies and confirming remediation of all 9 before year-end rollforward.
What changed: "Responsible for" became a control count, findings and a closed loop.
WeakUsed data analytics in audits.
StrongReplaced a 40-item T&E sample with full-population Alteryx testing of 38,946 expense lines, flagging 63 policy exceptions and $47,615 in recoverable spend.
What changed: What the analytics replaced and what they found.
WeakTested IT controls.
StrongTested access, change management and operations ITGCs for 9 in-scope SAP and Workday applications, uncovering 31 active accounts for terminated users and validating removal within 41 days.
What changed: ITGC domains, systems and a concrete risk that got fixed.
WeakWrote audit reports and followed up on issues.
StrongRebuilt the department's issue template around condition, criteria, cause and effect, cutting average management response time from 19 to 8 business days.
What changed: A process improvement with a before-and-after measure.
WeakManaged the audit plan.
StrongBuilt the annual risk-based plan across a 146-entity audit universe for a $4.1B bank, delivering 96% of planned audits within budget and presenting results to the audit committee each quarter.
What changed: Plan size, delivery rate and board exposure.
WeakSupervised staff and consultants.
StrongManaged 7 auditors plus a SOX co-source provider; rescoped the co-source contract to cut annual spend by $118K while keeping coverage of every key control.
What changed: Team size plus savings that kept full coverage.
Most roles expect a bachelor's in accounting or a related field; IT audit roles also accept information systems or computer science. For external audit, the CPA is the credential that matters, and any accountant who files reports with the SEC must be a licensed CPA. State boards of accountancy issue licenses, and the exam has three Core sections (AUD, FAR, REG) plus one Discipline section (BAR, ISC or TCP). Alongside the 150-credit-hour route, many states have adopted or are phasing in a bachelor's-plus-two-years-of-experience path, with different effective dates, so check your state board.
Put active licenses after your name (Taylor Brennan, CPA, CIA) and in a Certifications section: near the top under 3 years of experience, below Experience after that.
Listing one in progress
Be specific: CPA candidate: AUD and FAR passed; REG scheduled March 2027. For the CIA or CISA, say exam passed, experience verification pending if that's your status. Don't put an unlicensed credential after your name.
"Performed audits" could mean Big 4, internal or government.
FixName the type and standards (integrated audit, SOX, operational, GAGAS) in your summary and first bullets.
"Participated in planning, fieldwork and reporting" fits every audit.
FixGive scope (controls, accounts, programs) and outcomes (deficiencies, recoveries, remediation).
"Audited a $5B public company" from a staff associate invites tough interview questions.
FixPair client size with your areas: "on a $5B issuer audit, owned inventory and fixed assets."
Naming clients alongside specific findings can breach confidentiality obligations.
FixDescribe clients by industry and size, and findings by type.
"CPA (in progress)" after your name, or a bare "CPA eligible," reads as an overstatement, and state accountancy laws bar unlicensed people from using the CPA title.
FixUse the in-progress format above.
One page until roughly 5 to 7 years of experience. Managers and directors can use two, as long as page two isn't old staff-level bullets.
Generally, no. Describe them by industry and revenue range ("12 manufacturing clients, $20M–$400M revenue"). Hiring managers care about the complexity you handled.
Reframe by process, not client: "tested revenue and inventory controls on 4 integrated audits" maps directly to SOX work. Moving from public accounting into internal audit is common, so hiring managers know how to read external experience.
No. Postings commonly list the CIA, CPA or CISA as preferred, not required, especially below manager level. If you've started it, show your progress.
Give it a dated line in Experience so the timeline has no hole: "Career break, Jan–Sep 2025: passed AUD, FAR, REG and BAR." If you stepped away to rest, "Planned career break" is enough on paper. In the interview, spend one sentence on why you left and the rest on why you're ready now: exams passed, CPE kept current, or contract audit work.
Paste a job ad and get a fit score, the keywords you're missing and the one thing to fix first.
Start for free