An internal auditor is a professional who works inside an organization to assess and help improve governance, risk management, and control, then delivers findings and recommendations to management and the board or audit committee. Internal auditors provide assurance and, when asked, advice, without taking on management's responsibilities.
This article focuses on the internal auditor profession, from meaning, duties, and skills to certification and estimated salary. For the internal audit function and its types, read the article below.
See also:
What Is an Internal Auditor?
General definition
Auditors in internal audit are professionals who work inside an organization to evaluate and improve the effectiveness of risk management, internal control, and governance processes. This function is objective and independent within the context of the organization (even though its status is that of an employee), providing assurance and advice to management and the board.
Regulations also define internal audit. POJK 56/POJK.04/2015 Article 1 point 1 describes it as an independent and objective assurance and consulting activity, intended to increase value and improve the company's operations through a systematic approach, by evaluating and improving the effectiveness of risk management, control, and governance processes.
Purpose of internal audit function
- Assess whether processes and controls are designed and operating adequately.
- Identify risk areas and provide mitigation recommendations.
- Support transparency and compliance with internal regulations and policies.
- Drive operational efficiency and process improvement.
Scope of work of an internal auditor
The scope may include financial audit, operasional, kepatuhan, audit TI (IT audit), audit fraud, as well as business process assessment and project-specific review.
For issuers and public companies, POJK 56/POJK.04/2015 Article 7 letter c lists finance, accounting, operations, human resources, marketing, information technology, and other activities. Issuers or public companies must have an internal audit unit (Article 3), and banks must have an internal audit function under POJK 1/POJK.03/2019. The internal audit function can be partly carried out by third parties as long as independence and objectivity are maintained.
What Is the Role of an Internal Auditor?
1. Assurance and consulting
Internal auditors provide assurance, namely an objective assessment of the adequacy and effectiveness of controls, as well as advice or consulting services in the form of process improvement suggestions when asked. Decisions and responsibility for implementation remain with management.
2. Role in risk management and internal control
Internal auditors evaluate risk management and controls, then give recommendations. Implementing controls and following up on findings is management's responsibility.
3. Role in governance
Supporting the organization's transparency and accountability through clear reporting to management, the board, and the audit committee.
As an advisor, internal auditors provide advisory services, for example recommendations on the design of policies and processes or facilitation of risk discussions, without taking on management's responsibilities.
What Is the Function of an Internal Auditor?
1. Assurance function
Objectively assessing whether control processes are designed and operating adequately, then delivering conclusions that increase the confidence of management and the board.
2. Consulting function
Giving process improvement recommendations, helping implement best practices, and supporting transformation projects with a risk and control perspective. Decisions and implementation remain with management.
3. Monitoring and reporting functions
Monitor the implementation of recommendations, prepare reports on audit results, and report risk trends to management.
What Are the Duties and Responsibilities of an Internal Auditor?
1. Stages of audit work
- Audit planning: determine the scope, objectives, risks, and audit program.
- Implementation: evidence collection, process walkthrough, sampling, interviews, and control testing.
- Reporting: preparing reports on findings, root cause analysis, recommendations, and priorities for action.
- Follow-up: monitor the implementation of recommendations and assess the effectiveness of improvements.
2. Specific tasks
- Develop an audit work program.
- Collect and evaluate audit evidence.
- Draw up written findings and recommendations.
- Communicate results to process owners, management, and audit committees.
For issuers and public companies, POJK 56/POJK.04/2015 Article 7 sets the minimum duties and responsibilities of the internal audit unit as follows:
- Prepare and carry out the annual internal audit plan.
- Test and evaluate the implementation of internal control and the risk management system in line with company policy.
- Examine and assess efficiency and effectiveness in finance, accounting, operations, human resources, marketing, information technology, and other activities.
- Provide improvement suggestions and objective information about the activities examined at all levels of management.
- Prepare audit result reports and submit them to the president director and the Board of Commissioners.
- Monitor, analyze, and report on the implementation of the follow-up to the improvements that have been recommended.
- Work together with the Audit Committee.
- Prepare a program to evaluate the quality of internal audit activities.
- Carry out special examinations when needed.
3. Responsibility to management and board
Internal auditors are responsible for delivering findings objectively and maintaining clear communication channels with management, the board of commissioners, and the audit committee. Corrective actions are carried out by management, while the auditor monitors the follow-up.
The reporting line has layers. Under the global standards, internal audit is most effective when it is directly accountable to the board (functional reporting), while administrative reporting is generally to the president director or equivalent (GIAS 2024 Standard 7.1). In Indonesia, the head of an issuer's Internal Audit Unit is accountable to the president director and is appointed with the approval of the Board of Commissioners (POJK 56/POJK.04/2015 Article 5), and the unit can communicate directly with the Board of Directors, the Board of Commissioners, and the Audit Committee (Article 8).
4. Documentation and audit evidence
Maintain adequate documentation for findings to be accounted for and for future review/inspection purposes.
See also: Audit Evidence: Meaning, Types, Properties, Characteristics, & Examples
See also:
- Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One
- Audit Finding Follow-Up: Causes of Overlooked Issues and Their Solutions
- Quality standards of Internal Audit Reports and their important components
What Is the Difference Between Internal and External Auditors?
| Aspect | Internal Auditor | External Auditor |
|---|---|---|
| Status | Works inside the organization, and part of the function can be carried out by third parties | A licensed Public Accountant or KAP appointed from outside the organization (Law 5/2011) |
| Focus | Governance, risk management, control, and efficiency | An opinion on the fairness of financial statements |
| Results | Findings and recommendations (assurance and advisory) | An auditor's report containing an opinion |
| Reporting | Functionally to the board under GIAS; in Indonesia through the president director with access to the Board of Commissioners and the Audit Committee | To the party that engaged them and the users of the financial statements |
| Basis | GIAS 2024, POJK 56/POJK.04/2015, and POJK 1/POJK.03/2019 | Audit Standards (SA) of IAPI and Law 5/2011 |
Examples of differences in practice
If there is a finding of an internal control weakness, the internal auditor gives improvement recommendations and monitors the follow-up. The external auditor can communicate that weakness to management and, if a material misstatement is not corrected, modify the audit opinion.
See also:
- 7 Differences between Internal and External Audit, Let's Know!
- Complete Guide to the external Auditor profession: duties, roles and salary
What Skills and Competencies Does an Internal Auditor Need?
A. Hard skills
- Knowledge of accounting and auditing principles.
- Ability to analyze data and use analytics tools.
- Understanding of it audits (e.g. kontrol akses, change management).
- Evidence sampling and testing techniques.
GIAS 2024 Standard 3.1 lists competency areas that internal auditors should develop, including communication and collaboration; governance, risk management, and control processes; business functions such as finance and information technology; pervasive risks such as fraud; tools and techniques for gathering and analyzing data; and relevant laws, regulations, and practices. Standard 3.2 asks internal auditors to keep developing their professionalism.
B. Soft skills
- Effective communication (oral and written).
- Critical thinking and problem solving skills.
- Stakeholder negotiation and management.
- Integrity and professional ethics.
- Professional skepticism, namely a questioning attitude and a critical assessment of the reliability of information.
What Are the Requirements for an Internal Auditor Under Regulations?
For issuers and public companies, POJK 56/POJK.04/2015 Article 6 requires internal auditors to meet the following requirements:
- Have integrity and professional, independent, honest, and objective conduct.
- Have knowledge and experience of audit techniques and other relevant disciplines.
- Have knowledge of capital market laws and regulations and other related regulations.
- Be able to interact and communicate effectively, both orally and in writing.
- Comply with the professional standards issued by the internal audit association.
- Comply with the internal audit code of ethics.
- Maintain the confidentiality of company information and data related to the performance of duties.
- Understand the principles of good corporate governance and risk management.
- Be willing to continuously improve knowledge, expertise, and professionalism.
These requirements apply to issuers and public companies. Other organizations set their own requirements.
See also:
What Certifications Are There for Internal Auditors?
| Certification | Provider | Main requirements | Notes |
|---|---|---|---|
| CIA (Certified Internal Auditor) | The IIA | A three-part exam; a master's degree with 1 year or a bachelor's degree with 2 years of internal audit or related experience | An international certification; fees are in USD, check The IIA website |
| QIA (Qualified Internal Auditor) | YPIA; certificate issued by DS-QIA | A bachelor's degree (S1) and at least 1.5 years of work experience; three levels (Basic, Advanced, Managerial) | A local certification |
| CISA (Certified Information Systems Auditor) | ISACA | Check the latest requirements on the ISACA website | Focused on information systems audit |
| CFE (Certified Fraud Examiner) | ACFE | Check the latest requirements on the ACFE website | Focused on fraud |
Certification is not the only measure of competence. For banks, the explanation of POJK 1/POJK.03/2019 Article 6 paragraph (1) states that the competence of the head of the SKAI is demonstrated, among other things, through audit-related certification. A CPA or Public Accountant is an accountant's license for auditing financial statements, not an internal audit certification. Requirements can change, so check the providers' official pages (information as of October 2026).
References:
- Certified Internal Auditor (The IIA)
- Qualified Internal Auditor Certification (YPIA)
- Certified Information Systems Auditor (ISACA)
See also:
- Get to know what an IT Audit is and its types, objectives, procedures, and examples
- What is audit Fraud? Definition, types of fraud, and Prevention
How Much Is an Internal Auditor's Salary?
1. Salary determining factors
Salary is influenced by experience, industry sector (finance, manufacturing, technology), location, company size, and job level (junior, senior, manager).
2. Estimated Salary Range
There is no official salary data for internal auditors in Indonesia. The figures below are estimates from secondary sources as of October 2026 and do not specifically distinguish internal auditors.
| Source | Coverage | Estimate |
|---|---|---|
| LokerID (job posting data) | Internal or External Audit positions, calculated from 33 job postings that state a base salary | Rp4.5 million to Rp6.2 million per month, average Rp5.3 million |
| KantorKu (HRIS provider blog) | Auditors in general; the method is not explained | Junior Rp5 million to Rp8 million; 3 to 5 years Rp9 million to Rp16 million; over 5 years Rp17 million to Rp30 million and above |
LokerID combines internal and external audit positions, while KantorKu covers auditors in general, so both are only an initial picture. Compare them with the latest job postings and the size of the target organization.
See also:
What Are the Career and Promotion Paths for Internal Auditors?
A. Typical career path
A common pattern (not a fixed one): auditor or staff, senior auditor or supervisor, internal audit manager, then head of internal audit. The head of internal audit is called the chief audit executive in GIAS, and the Head of the Internal Audit Unit or Head of SKAI in the POJK. From there, some auditors move into risk management, compliance, or other executive positions.
GIAS 2024 Standard 7.2 asks the chief audit executive to help the board understand the qualifications and competencies needed to lead the internal audit function. In banks, the head of the SKAI is appointed and dismissed by the president director after obtaining the approval of the Board of Commissioners, taking into account the Audit Committee's recommendation (POJK 1/POJK.03/2019 Article 3 paragraph 4).
B. Career alternatives
Some auditors move into roles as risk & governance consultants, external auditors, or IT audit and compliance specialists.
See also:
What Is the Code of Ethics for Internal Auditors?
A. Basic principles of the code of ethics
Domain II of GIAS 2024 (Ethics and Professionalism) contains five ethical principles for internal auditors:
- Demonstrate integrity: act honestly and with professional courage to act on the relevant facts.
- Maintain objectivity: be unbiased in assessing and reporting.
- Demonstrate competency: possess or obtain the knowledge, skills, and abilities suited to the job.
- Exercise due professional care: work carefully and thoroughly in line with the complexity of the engagement.
- Maintain confidentiality: protect information obtained in the course of work.
B. Source code
The main reference is GIAS 2024 from The IIA. For issuers and public companies, POJK 56/POJK.04/2015 Article 6 letters e and f require internal auditors to comply with professional standards and the internal audit code of ethics, and Article 9 letter d requires the internal audit charter to contain a code of ethics that refers to the code of the internal audit association in Indonesia or an internationally accepted internal audit code of ethics.
C. Examples of ethical dilemmas and their handling
Example: the auditor found a potential conflict of interest in one of the managers. Proper handling: documentation of findings, notification to the competent level (eg. head of internal audit or audit committee), and recommended mitigation measures while maintaining confidentiality during the investigation process.
See also:
What Are the Challenges and Best Practices?
Common challenges
- Maintain independence while being part of the organization.
- Overcome resistance of operational units to findings.
- Limited resources and audit evidence.
Best practices
- Risk-based audit: prioritize areas with the greatest risk.
- Continuous auditing: utilizing continuous monitoring for early detection.
- Data analytics: incorporate analytics to improve audit coverage and depth.
- Stakeholder engagement: initial communication with the owner of the process to establish buy-ins.
- Strict Follow-up: monitoring so that recommendations are implemented and their impact is measured.
Examples of activities of internal auditors
Case (hypothetical): An Audit of the procurement function found double payments to suppliers due to a manual invoice matching process.
Findings: weaknesses of matching and authorization controls.
Recommendations: apply an automatic matching system, fix the segregation of duties, and train the procurement team.
Follow-up & success metrics: a reduction in duplicate payment incidents, a shorter procurement cycle time, and a follow-up audit testing the effectiveness of the new controls.
FAQ About Internal Auditors
What is an internal auditor?
An internal auditor is a professional who works inside an organization to assess and help improve governance, risk management, and control, then delivers findings and recommendations to management and the board or audit committee, providing assurance and advice.
What are an internal auditor's duties and responsibilities?
Preparing the annual audit plan, testing and evaluating internal control and risk management, preparing audit result reports for the president director and the Board of Commissioners, and monitoring the follow-up on improvements (POJK 56/POJK.04/2015 Article 7). Carrying out the improvements remains management's responsibility.
What is the difference between internal and external auditors?
Internal auditors work inside the organization and focus on governance, risk management, and control, with findings and recommendations as their output. External auditors are licensed Public Accountants or KAPs from outside the organization who focus on giving an opinion on the fairness of the financial statements.
How much is an internal auditor's salary?
There is no official salary data. Estimates from secondary sources as of October 2026 show an average of about Rp5.3 million per month from LokerID job posting data for internal or external audit positions, while KantorKu estimates Rp5 million to Rp8 million for juniors and more with experience.
Which certifications are relevant for internal auditors?
Common certifications are the CIA from The IIA, the QIA from YPIA, the CISA from ISACA for information systems audit, and the CFE from ACFE for fraud. A CPA is an accountant's license for auditing financial statements, not an internal audit certification.
What are the requirements to become an internal auditor?
The requirements differ by organization. For issuers and public companies, POJK 56/POJK.04/2015 Article 6 requires integrity, technical audit knowledge and experience, knowledge of capital market regulations, communication skills, compliance with professional standards and the code of ethics, confidentiality, an understanding of governance and risk management, and a willingness to keep learning.
What is the internal auditor's code of ethics?
Domain II of GIAS 2024 contains five principles: demonstrate integrity, maintain objectivity, demonstrate competency, exercise due professional care, and maintain confidentiality.
Skill apa yang wajib dimiliki auditor internal?
Hard skills: accounting knowledge and audit principles, data analysis, an understanding of IT audit, and sampling and evidence testing techniques. Soft skills: effective communication, critical thinking, negotiation and stakeholder management, integrity, and professional skepticism.
How Does Audithink Support the Internal Audit Function?
Audithink is internal audit management software that can be customized; it is not an audit performer. Its features include risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. The audit itself is still carried out by your organization's internal auditors.
Schedule demo to see how well it fits the internal audit process in your organization.
