Auditor
Checks that what the company says happened actually happened — and, in the forensic version, works out what happened when it clearly did not.
Who to hire
The shape of person who does this job well — and whether you should be hiring it at all yet.
Four different jobs under one word, and the distinction decides everything about who you hire. Internal audit works for the company and reports to the board or the audit committee, testing controls before anyone outside does. External audit is a firm you engage to give an opinion on the statements — you do not hire it, you appoint it, and its independence is the entire product. Government audit works for a public body and audits you, not for you. Forensic audit is retained when something has gone wrong: fraud, a dispute, a transaction that needs reconstructing for a court. A startup needs none of these as employees and all of them as relationships.
Education
An accounting designation for financial audit; for IT audit, an information-systems background with an audit credential. Forensic work usually sits on top of one of those plus investigative training.
Experience
5+ years in the relevant kind. Ask what they found that nobody expected, and what happened next — the second half of that answer tells you whether they can carry a finding through an uncomfortable conversation.
Vertical / domain experience
Decisive for the regulated kinds: public-sector auditing, financial services, and anything with a statutory audit regime each come with their own standards and their own reporting lines.
What it pays, roughly
$83,949 median, Canada — for Auditors, accountants and investment professionals, the closest occupation Statistics Canada actually measures, measured from $75,005 to $90,002 over 391,235 people. That occupation is broader than this role, so read it as an anchor, not a salary band — and note that a startup usually pays below it in cash and above it in equity.
Credentials and certifications
What exists, who issues it, and whether it means anything for this seat. A credential is evidence of a floor, never of judgment — and in a few of these roles it is a legal requirement rather than a nice-to-have.
| Credential | Issued by | When it matters | Skiploma |
|---|---|---|---|
| CIA — Certified Internal Auditor | The Institute of Internal Auditors | The internal-audit credential, and the one that signals independence is understood. | Study |
| CPA | CPA Canada / AICPA | Required in substance for anyone auditing financial statements; an external audit opinion can only be signed by a licensed firm. | Study |
| CFE — Certified Fraud Examiner | ACFE | The forensic credential: fraud examination, interviewing and evidence. | Study |
| CISA — Certified Information Systems Auditor | ISACA | For IT and controls audit, which is what a SOC 2 or ISO certification actually tests. | Study |
What this role does at each stage
The same title means three different jobs depending on how much money is in the bank. Read the stage you are at, then read the next one — that is what you are hiring toward.
None. Keep clean records so that the first audit, whenever it comes, is an exercise rather than an excavation.
Still none internally. Appoint an external accountant for the year-end, and know whether your jurisdiction or your investors will require a full audit or will accept a review.
An external audit if investors or lenders require one, and internal audit only once there is enough process to test — usually well after Series A, and reporting to the board rather than to the CFO.
Can one person hold this and something else?
The whole point of the many-hats problem: which of these jobs merge safely into one person, and which merges quietly cost you money or control.
Merges well with
- Financial Controller
- Chief Financial Officer (Founders & fractional leadership)
- Chief Compliance Officer (Founders & fractional leadership)
- Chief Risk Officer (Founders & fractional leadership)
Internal audit sits beside compliance and risk and asks the third question: compliance asks whether the rule was followed, risk asks what could go wrong, audit asks whether the controls actually work. All three are one part-time person in a small company, and that is fine until a regulator says otherwise.
Keep separate from
An auditor who reports to the people whose work they are testing is not an auditor. Internal audit reports to the audit committee or the board; external audit must be independent of the company altogether, which is why you cannot have your accountant both prepare and audit the same statements.
Reading a candidate
What good looks like in an hour, and what should stop the process.
Good signals
- Explains independence without being asked
- Documents the test, not just the conclusion
- Has reported something unwelcome upward
Red flags
- Offers to both prepare and audit
- Treats sampling as a formality
- Cannot describe the control they are testing
What this role runs on
The software categories this job lives in. Each links to our buying brief and to the research behind it.
| Category | Who the default is | What leaving costs | |
|---|---|---|---|
| GRC & Compliance Automation | OneTrust, with Vanta and Drata owning the automation tier | The evidence history | The research → |
| ERP — Enterprise Resource Planning | SAP | Implementation sunk cost | The research → |
| DMS — Document Management Systems | Microsoft SharePoint (bundled in Microsoft 365), with OpenText and Hyland in enterprise ECM | The repository itself: years of documents with their version history, permissions, metadata, retention schedules and legal holds | The research → |