Positioning Yourself for a Promotion in SOX and Internal Audit

In Internal Audit, promotions often feel like a waiting game. Three years as a Staff Auditor. Three years as a Senior Auditor. Five years as an Internal Audit Manager. And so on and so on...

Many internal auditors assume that career growth is simply a matter of time—that as long as they meet expectations, their next promotion will eventually come. But the truth is, tenure doesn’t guarantee advancement. And you don’t have to wait around hoping for it to happen.

If you want to accelerate your career and increase your earning potential in 2025, you need a proactive approach. So this morning, I wanted to share three areas topics to those with ambition that, if implemented, should increase the odds of your earning a promotion within the next 6 - 12 months.

1. Understanding Promotable vs. Non-Promotable Activities

One of the biggest mistakes internal auditors and SOX professionals make is assuming that simply doing their job well will lead to advancement. While performing your responsibilities effectively is essential, merely checking off items in your job description won't guarantee a promotion. In fact, excelling at routine tasks can sometimes work against you—you might become too valuable in your current role to move up.

To address this challenge, professionals seeking promotion should focus on what Kendall Berg, That Career Coach, calls "promotable activities."

According to Kendall Berg, promotable activities are those that add measurable value beyond routine job expectations. These activities demonstrate leadership, strategic thinking, and a commitment to improving the organization. In contrast, non-promotable activities are those that, while necessary, do not directly contribute to career advancement.

If you have SOX compliance responsibilities, here are some examples of promotable activities:

• Becoming the go-to expert on SEC, PCAOB, and external auditor guidance - According to a recent flash poll during the Internal Audit Collective's SOX Accelerator Program, only 50% of SOX Leaders reported having a good process to keep their organization current on the latest SOX guidance from the SEC, PCAOB, and external auditors. Taking on this leadership opportunity can keep senior leaders informed and help control owners be better prepared when performing their controls—ultimately reducing work for them, your team, and the external auditors at year-end.
• Successfully rationalizing controls to improve efficiency - has your SOX program gone through a thorough refresh to determine if all stated key controls really need to be key? Reducing the number of key controls for SOXcompliance will decrease testing work performed, potential deficiencies to be evaluated, and most importantly, decrease work being done by all involved.
• Leading initiatives that enhance SOX compliance across the organization - rather than just testing your assigned controls, identify ways to streamline SOX work by delegating administrative tasks back to the business. Create a training program for control owners—both those with recurring deficiencies and new owners—to help them manage their responsibilities more effectively. Better yet, identify areas where external auditors can increase their relianceon your team's work.

While most SOX programs have significant room for efficiency improvements, few teams actively pursue these changes.If you spend more of your time in Internal Audit, here are some promotable activities to consider:

• If your internal audit approach focuses only on checking compliance with company policies and procedures, expand your scope by incorporating external subject matter expertise to evaluate processes more comprehensively. Use external research to find relevant benchmarking data and gather insights about how similar companies in your industry manage their processes. Document your research methodology and help your team adopt this enhanced approach as a standard practice.
• Leading the adoption of new audit technologies to enhance efficiency - does your Internal Audit team leverage a purpose-built audit management solution? If not, you could lead the charge by managing the due diligence and evaluation process among relevant vendors. If you already have a solution, consider leading a committee to identify the top 5-10 pain points your team experiences and work with your vendor to resolve them. I've personally seen numerous individuals promoted within 2-3 months after successfully completing their team's digital transformation.
• Driving conformance with new Internal Audit Standards - Many Internal Audit teams still haven't completed a gap assessment against the new standards, even in January 2025. Could you take the initiative to lead this project? You might help your CAE develop their first strategic plan,implement a Quality Assurance and Improvement Program (QAIP), assess team competencies, and create targeted training plans to address skill gaps.

While the promotable activities discussed so far have focused mainly on Internal Audit work, you can find additional opportunities by improving processes that span both Internal Audit and other GRC functions in your organization.Without getting into too many specifics, here is a list of Connected Risk projects that could double as promotable activities.

• Developing a master risk and control matrix to unify risk oversight
• Consolidating issue data from SOX, audit, and enterprise risk management (ERM) processes
• Standardizing risk assessments across audit, SOX, and fraud risk management
• Establishing common taxonomies and definitions for risk and control data
• Defining ownership and accountability across key assurance activities

These activities demonstrate leadership qualities, strategic thinking capabilities, and your ability to create organizational impact beyond routine responsibilities.While these examples provide a starting point, internal auditors can pursue many other initiatives to enhance team efficiency and effectiveness. Look for opportunities both within and outside your department, select one that aligns with your goals, and take decisive action to implement it.

2. Having a Plan to Earn Your Promotion

Successfully completing promotable activities will significantly improve your chances of promotion. But when you combine these activities with a documented career plan, you'll increase the likelihood of getting promoted to your desired position at your target time.

Without a documented career plan, you leave critical promotion variables to chance. In a recent IA 360 webinar, nearly 80% of Internal Auditors and SOX professionals admitted they don't have a structured plan for their next promotion. This suggests that while many professionals hope for career advancement, they aren't taking concrete steps to achieve it.

Your promotion plan must be clear, documented, and have specific timelines. An effective plan needs to include:

• Aligning yourself with promotable projects
• Identifying the skills required for the next level
• Ensuring your manager is aware of your career aspirations
• Taking on responsibilities that mirror the role you aim to achieve
• Building relationships with mentors and sponsors who can advocate for your advancement
• Understanding how others in your organization have been promoted and replicating their strategic moves

By proactively shaping your career trajectory, you position yourself as the natural choice for the next leadership opportunity.

3. Having the Right Mindset

Even with a solid strategy, mindset distinguishes those who advance from those who remain stagnant. Internal Audit is a demanding field—you must grasp complex topics quickly, often with limited resources. You may face resistance from others, and audit findings can lead to tense interactions. A strong, positive mindset helps you navigate these challenges without burning out or losing motivation, while keeping your promotion prospects intact.

Ways to Strengthen Your Mindset

• Practice Positive Self-Talk and Affirmations – Remind yourself of the value Internal Audit brings to the organization. Reflect on your successful audits and the positive impact they've had on your customers, as well as the strong relationships you've built with team members. The more you focus on these positive experiences, the more likely you are to create similar outcomes.
• Surround Yourself with Growth-Oriented Peers – A powerful way to stay inspired and motivated is to regularly connect with others who share similar responsibilities, aspirations, and career achievements. Read about how other Internal Auditors successfully climbed the ladder. Build your professional network and engage in professional communities to meet these individuals, learn from their success stories, and apply their best practices to your own career advancement journey.

Closing Thoughts

A promotion in Internal Audit or SOX isn't determined by time served—it's about impact, strategy, and mindset. By focusing on the right activities, creating a structured career plan, and developing a leadership mindset, you can break free from the traditional waiting game and take control of your career advancement.If you want to be promoted in 2025, take action today. Identify opportunities where you can drive efficiencies beyond your daily responsibilities, create a documented plan that incorporates successful promotion strategies and aligns with your leaders' expectations, and develop a leadership mindset in both thought and action.

The opportunities are there—you just have to position yourself to seize them.

‍