Auditor Job Description Template

In plain language: States the official job title, the department or business unit the auditor belongs to, and the employment classification (full-time, part-time, exempt, or non-exempt).

Common mistake: Using a generic title like 'Auditor' when the role is specifically internal or IT audit — mismatched titles attract unqualified applicants and complicate compensation benchmarking.

In plain language: Defines the overarching objective of the position — what the auditor is accountable for achieving — and the boundaries of their audit authority within the organization.

Common mistake: Defining scope so broadly that the auditor is expected to cover all risk areas single-handedly — this creates unrealistic workloads and blurs accountability with other control functions.

In plain language: Lists the specific tasks the auditor is expected to perform on a recurring basis, including audit planning, fieldwork, reporting, and follow-up on findings.

Common mistake: Listing duties without indicating frequency or output — 'conducts audits' tells a candidate nothing about volume, depth, or deliverable format expected.

In plain language: Sets the minimum education, professional certification, and years of experience required for the role to be performed at the expected standard.

Common mistake: Requiring certifications that are not yet standard for the seniority level — demanding a CIA for a junior associate discourages qualified candidates and signals the description was not tailored to the actual role.

In plain language: Establishes the requirement that the auditor maintain objectivity and disclose any actual or potential conflicts of interest that could compromise audit integrity.

Common mistake: Omitting the independence clause entirely in internal audit job descriptions, leaving no documented standard against which conflicts of interest can be evaluated or enforced.

In plain language: Requires the auditor to protect all sensitive financial, operational, and personnel information accessed during audits and to comply with the organization's data security policies.

Common mistake: Using a generic confidentiality clause not tailored to audit-specific data — auditors routinely access compensation data, board materials, and M&A information that require heightened protection beyond standard employee NDAs.

In plain language: Defines who the auditor reports to administratively and functionally, including escalation paths for significant findings or fraud suspicions.

Common mistake: Establishing only one reporting line — to the CFO — with no direct path to the Audit Committee. This structure compromises independence when financial management is itself subject to audit.

In plain language: Sets measurable expectations for audit cycle time, finding closure rates, report quality, and adherence to professional auditing standards.

Common mistake: Excluding performance metrics from the job description entirely — without documented KPIs, annual reviews become subjective and disciplinary actions tied to performance are harder to defend.

In plain language: States the compensation band, overtime classification, and a reference to the organization's benefits program without locking in specific plan details.

Common mistake: Stating an exact salary rather than a band — a single salary figure removes negotiating flexibility and creates pay equity risk if the same figure appears in job postings across different geographies.

In plain language: Affirms the employer's equal opportunity hiring commitment and, where applicable, clarifies that the employment relationship is at-will and that the job description does not constitute a contract of employment.

Common mistake: Omitting the 'not a contract' disclaimer — in several jurisdictions, a signed and sufficiently specific job description has been treated by courts as an implied employment contract, particularly when it includes a compensation figure.

An auditor job description is a formal document that defines the title, reporting structure, duties, qualifications, independence requirements, and performance standards for an audit role within an organization. It serves as the foundation for recruiting, onboarding, and evaluating the auditor, and — when signed — creates a documented record of the agreed scope of the role. It is typically attached to or referenced by the employment contract.

An internal auditor job description defines a permanent employee role within the organization's finance, risk, or compliance function — reporting to management and the Audit Committee. An external auditor engagement letter or job description defines the scope of work for an independent third-party firm conducting a periodic statutory or regulatory audit. Internal auditors focus on ongoing risk assurance; external auditors focus on issuing an independent opinion on the financial statements.

For most organizations, a well-structured template is sufficient for standard internal audit roles. Legal review is recommended when the role involves SOX compliance responsibilities, the organization is publicly traded or preparing for an IPO, the auditor will have access to board-level or M&A information, or the description will be used in a jurisdiction with specific employment law requirements around job classifications and written terms.

Auditor independence is the foundation of audit credibility. An auditor who reports only to the executive they are auditing cannot objectively evaluate that executive's decisions or financial reporting. Job descriptions for internal auditors at publicly traded companies in the US must reflect functional reporting to the Audit Committee to comply with SOX Section 301 and NYSE/NASDAQ listing standards. Documenting independence requirements also gives the organization a contractual basis to act on conflicts of interest when they arise.

The right certification depends on the audit domain. For financial statement and public company audit, CPA is the standard. For internal audit practice and governance, CIA (Certified Internal Auditor) is the benchmark credential. For IT and systems audit, CISA (Certified Information Systems Auditor) is most relevant. For fraud investigation, CFE (Certified Fraud Examiner) applies. Most job descriptions should require one and list others as preferred, rather than mandating all certifications for a single role.

In the US, several states — including California, Colorado, New York, and Washington — now require salary ranges in job postings. Even where not legally required, including a band attracts better-qualified candidates and reduces time spent on candidates whose expectations are misaligned. Use a range rather than a single figure to preserve negotiating flexibility and reduce pay equity risk across geographies.

A job description is generally not intended to function as an employment contract, and a well-drafted description will include a disclaimer stating this explicitly. However, courts in some jurisdictions have found that a detailed, signed job description with compensation details can create an implied contract. Always pair the job description with a standalone employment agreement covering IP, confidentiality, non-compete, and termination to avoid this ambiguity.

Review the job description annually or whenever the auditor's scope, reporting structure, or key responsibilities change materially. Regulatory changes — such as new SOX guidance, updated IIA Standards, or revised PCAOB inspection requirements — may also require updates to the independence, qualifications, or performance standards sections. An outdated job description complicates performance management and can create legal exposure if the documented duties no longer reflect what the employee is actually expected to do.

For internal audit roles, the IIA International Standards for the Professional Practice of Internal Auditing provide the authoritative framework — including requirements for an audit charter, independence, objectivity, and proficiency. For external audit roles at US public companies, PCAOB auditing standards and SEC independence rules apply. In the UK, the FRC's Ethical Standard and Auditing Practices Board guidance govern auditor conduct and independence requirements.