Head of Internal Audit: Career Path at FCA-Regulated Firms

Internal audit is the third line of defence — the function that gives the board independent assurance that the first and second lines are actually working. At many FCA-regulated firms the Head of Internal Audit holds SMF5, a senior management function. This article sets out what the role involves, the career path into it, and what firms and the regulator look for.

What the role is, and what makes it different

The Head of Internal Audit maintains oversight of the firm’s control environment and reports findings and recommendations directly to the governing body. The defining feature of the role is independence: internal audit must be independent of the executive management it examines, which is why the function typically reports to the Audit Committee rather than to the executive, and why SMF5 is kept separate from the risk and compliance functions it audits.

That independence is not a nicety — it is the source of the function’s value. An internal audit function that has been captured by the executive, or that pulls its punches, gives the board false assurance, which is worse than none.

Where it sits in the three lines

Understanding the three-lines model is central to the role. The first line owns and manages risk in the business. The second line — risk under SMF4, compliance under SMF16 — sets the framework and provides oversight. The third line, internal audit, independently assures the board that the first two are functioning. SMF5 is deliberately independent of SMF4 and SMF16, and a candidate who cannot articulate why that separation matters will not be credible.

The career path in

Heads of Internal Audit typically arrive from one of a few directions:

• Internal audit progression — rising within the function, the most direct route, often via a professional internal audit or accountancy qualification.
• External audit — moving from a practice background, bringing audit discipline and often a chartered accountancy qualification.
• Risk or controls — crossing from a second-line role, though this requires establishing genuine independence from the areas previously worked in.

A professional qualification is common and valued — whether a chartered internal auditor credential or an accountancy qualification such as the ICAEW. The role is fundamentally about the integrity of assurance, so evidence of technical rigour and independence of mind matters more than management polish.

What firms look for

Beyond technical audit capability, hiring firms and audit committees prioritise: genuine independence and the willingness to report uncomfortable findings; the judgement to focus audit effort on the areas of real risk rather than the easily auditable; the ability to communicate findings to a board in a way that drives action; and enough understanding of the regulatory framework to audit against the right standard. An internal audit function that produces thorough reports nobody acts on has failed, so the ability to land findings and secure remediation is part of the specification.

The independence question in interview

Audit committees probe independence directly, because it is the quality most easily compromised and most damaging when it is. Expect questions about a time you delivered a finding the executive did not want to hear, how you maintained objectivity while working closely with the teams you audit, and how you would handle pressure to soften a conclusion. Candidates who can answer with real examples — and who demonstrate they understand that their loyalty runs to the board and ultimately the firm’s safety rather than to executive comfort — stand apart.

Positioning yourself for the step

The practical moves: build audit breadth across the firm’s significant risk areas rather than depth in one; develop the board-facing communication the role demands, because much of it is influencing at committee level; take the relevant qualification; and, if crossing from a second-line role, be deliberate about establishing independence from your former area. Firm size shapes the route, as with other SMFs — a first Head of Internal Audit role often comes sooner at a smaller firm, with broader personal scope, than at a large firm with a bigger function.

FD Capital recruits Heads of Internal Audit and senior assurance professionals into FCA-regulated firms.

What the function actually does day to day

It helps to be concrete about the work. A Head of Internal Audit builds a risk-based audit plan — deciding, on a view of where the firm’s real risks lie, what to examine and when. They lead audits that test whether controls are designed well and operating effectively, from financial controls to regulatory processes to operational resilience. They report findings to the Audit Committee with clear conclusions and recommendations, track remediation to completion, and give the board an annual opinion on the overall control environment.

The judgement in the role is largely about focus: audit resource is finite, and directing it at the areas of genuine risk rather than the easily-tested is what distinguishes a valuable function from a box-ticking one.

The relationship with the regulator and external audit

Internal audit does not operate in isolation. The function’s work informs the board and, indirectly, the regulator’s view of the firm’s control environment. At many firms internal audit also coordinates with external audit to avoid duplication and ensure coverage. A Head of Internal Audit who understands how their assurance fits into the wider picture — regulatory expectations, external audit, the second-line functions — runs a more effective function than one who treats internal audit as a self-contained exercise.

Career progression from the role

SMF5 is a strong platform. The independence, board exposure and firm-wide view it provides open routes toward audit committee membership and chairmanship (itself a controlled function), toward wider governance and risk roles, and toward non-executive careers where audit-committee readiness is highly valued. For a qualified accountant, the combination of audit depth and board-level standing is a genuine asset in the non-executive market.

What to establish before taking the role

Candidates weighing a Head of Internal Audit appointment should test a few things first. How genuinely independent is the function — does it report to the Audit Committee, and does the committee protect it? Is it resourced to cover the firm’s risk profile, or stretched too thin to be credible? Does the executive respect its findings, or is it treated as an obstacle? And are there open regulatory concerns about the firm’s control environment that the role would inherit?

The answers determine whether the role is a genuine assurance function or a compromised one, and a candidate accepting personal accountability as SMF5 should know which they are taking on.

Why the role has grown in importance

Internal audit has risen up the regulatory agenda as the third line’s role in effective governance has been emphasised. Regulators increasingly expect a firm to be able to demonstrate that its control environment is independently assured, not merely self-assessed by the functions that run it. That has raised both the profile and the expectations of the Head of Internal Audit role, and made genuine independence and rigour more valuable than ever. For capable candidates, it is a role of growing standing rather than a back-office posting.

The value of the role to the board

Ultimately the Head of Internal Audit exists to give the board something it cannot get from management: an independent, honest view of whether the firm’s controls actually work. A board that receives only management’s own assessment of its controls is being asked to trust the people being assessed. Internal audit breaks that circularity. That is why the role’s independence is protected so carefully, and why a capable, genuinely independent Head of Internal Audit is one of the most valuable governance assets a regulated firm has.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.