Internal Auditor

Smartsuite; Newport Beach (CA); On-site; USD 90,000 - 120,000; Full time

Job summary

Capitolis is seeking an Internal Auditor to execute testing procedures, gather evidence, and support fieldwork. You will validate controls, log observations with root causes, and ensure corrective actions are implemented and effective across SOX and risk management workflows.

Reporting to the Audit Manager, you will document workpapers, address review notes, and collaborate with control owners and risk analysts to ensure audit readiness and regulatory compliance.

Qualifications

• Experience performing testing procedures in fieldwork.
• Ability to document evidence and findings clearly.
• Strong root-cause analysis skills.
• Familiarity with SOX and control testing.

Responsibilities

• Execute test procedures and gather evidence in fieldwork.
• Document workpapers and address review notes.
• Validate that controls operate and evidence supports findings.
• Log observations with root causes and severity assessments.
• Link findings to risks, controls and process owners.
• Verify corrective actions are implemented and effective.

Skills

Test procedures

Evidence collection

Root-cause analysis

Documentation & reporting

Job description

SmartSuite for the Internal Auditor

The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork. They validate that controls operate, log observations with root causes, link findings to risks and process owners, and verify that corrective actions are implemented.

Reports to:

Audit Manager

What you own

The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork.

• Execute test procedures and gather evidence in fieldwork
• Document workpapers and address review notes
• Validate control execution and supporting evidence
• Log observations, root causes and severity assessments
• Link findings to related risks, controls and process owners
• Verify that corrective actions are implemented and effective

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Internal audit

Touches

contributes or approves

Issues and actions

Compliance management

Depends on

consumes its output

Risk management

Policy management

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Internal Auditor: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Audit Manager

Works closely with

Control Owner

Compliance Analyst

Risk Analyst

Controls Testing Lead

How SmartSuite supports the Internal Auditor

The Internal Auditor produces the workpapers, evidence and findings that the Audit Manager reviews and that external auditors and regulators may place reliance on. SmartSuite gives fieldwork a structured home, so every test step has its evidence attached, every observation its root cause and owner, and every corrective action a verification trail.

Execute fieldwork with evidence in the record

Evidence requests that chase themselves

Workflow-driven evidence requests go to the Control Owner with automated reminders and validation, so you spend fieldwork testing what arrived rather than emailing for what has not.

Tests executed where the results live

Perform each test procedure directly in SmartSuite with structured steps, results and automated status updates, so the Audit Manager sees progress without a status email and the workpaper is the record of the test.

Observations with cause and severity

Log each observation with its root cause and severity assessment and route it to the process owner for response, so the finding the Audit Manager reviews already carries the cause and the rating rather than being reworked at review.

Stay connected to control owners, risk and compliance

ITGCs and business controls in one workflow

Test IT general controls and business controls in the same connected SOX workflow, with consistent procedures and scoring across cycles, so your work and the Controls Testing Lead's line up at year end.

Findings linked to the risk and the owner

Each finding connects to the related risk, control, KRI and process owner, so the Risk Analyst and Compliance Analyst see your finding in their context and the Control Owner knows exactly which control failed.

Questions asked on the workpaper itself

In-record conversations, @mentions and email integration keep every exchange with the Control Owner attached to the procedure it concerns, so review notes and clarifications are part of the audit file, not a separate inbox.

Stand behind every finding under review

Deficiency narratives drafted with the AI Assistant

Use the AI Assistant in a SmartDoc field to generate testing summaries and deficiency narratives from your results, so the draft the Audit Manager reviews is grounded in the recorded test and your time goes to judgment.

Workpapers an external auditor can rely on

Complete histories of testing, evidence, approvals and changes are retained, and external auditors get controlled access to results and supporting evidence, so reliance on your work is a decision they can make from the file.

Audit files seen only by the right people

Granular, role-based permissions keep sensitive workpapers and draft findings with the engagement team until release, so a finding about a department is not read by that department before the Audit Manager has signed it off.

Internal audit. Manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners.

Compliance management. Reviews control execution and supporting evidence with full testing history for SOX and compliance testing.

Issues and actions. Logs observations with root causes and routes findings for management response and remediation verification.

Reporting. Produces audit‑ready summaries and findings from the testing records.

Products this role uses most

Internal Audit Management

Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.

SOX Compliance

Manage SOX compliance with structured control testing, evidence tracking, and real‑time visibility into financial reporting controls and audit readiness.

Issues Management

Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real‑time visibility into resolution status.

Compliance Assessments & Testing

Manage assessment campaigns and testing schedules with a reusable question library, automated workflows, and one place for evidence collection.

Industry reference

The IIA’s Global Internal Audit Standards (2024) and the CIA body of knowledge define the work: sufficient, reliable evidence; documented workpapers; findings with criteria, condition, cause and effect; and follow‑up of management actions. Independence and objectivity requirements apply to every engagement.

What is tested depends on sector: FFIEC‑based control areas in banks, HIPAA and billing controls in healthcare, Yellow Book compliance audits in government, and IT general controls and SOC 2 criteria in technology. In each case the auditor’s workpapers may be reviewed by regulators or external auditors placing reliance on them.

Related roles

Audit Manager

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Internal Auditor executes the test procedures in the audit program, gathers sufficient, reliable evidence in fieldwork, documents workpapers and addresses review notes from the Audit Manager. They validate that controls operated and that the supporting evidence holds, log observations with root causes and severity, link findings to the risks, controls and process owners concerned, and later verify that management's corrective actions were implemented and effective. Independence and objectivity apply to every engagement.

Internal Audit Management manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners. Each test step carries its evidence, the Audit Manager's review notes sit against the workpaper they concern, and sign-off is recorded when they are cleared. Because findings link to the control and process owner, the auditor is not re-describing the control in every workpaper, and an external auditor placing reliance can follow the trail.

SOX Compliance reviews control execution and supporting evidence with full testing history, so the Internal Auditor can see how a control tested in prior periods, what evidence was accepted and whether exceptions recurred before testing it again. Compliance Assessments & Testing covers the wider compliance testing on the same model. The Controls Testing Lead and Control Owner work from the same records, so the evidence request and the evidence supplied are in one place.

Observations are logged with root causes in Issues Management and routed for management response and remediation verification, so a finding carries the criteria, condition, cause and effect, the owner's response and the evidence of remediation. The Internal Auditor verifies closure against that evidence rather than taking a status update on trust, and the follow‑up the IIA's Global Internal Audit Standards require is a step in the record, not a separate project months later.

SmartSuite produces audit-ready summaries and findings from the testing records, so the Internal Auditor's report to the Audit Manager is drawn from the workpapers, observations and management responses as they stand. The Compliance Analyst and Risk Analyst who worked alongside the engagement see the same findings linked to their risks and controls, and the summary that goes forward is traceable back to each test step and its evidence.

New customers can start with SmartSuite Onboarding, a guided four‑week program around one or two priority workflows. For an audit team the first workflow is one engagement: load the audit program for the next engagement with its test steps and the control owners who will supply evidence, then run that engagement in the system so review notes and sign-offs happen there. Prior findings can be loaded so follow‑up verification has its history.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.