Audit Questions to Ask Management
A working list for internal and external auditors preparing management interviews. The questions cover how transactions move through the business, what changed in the period, where management themselves expect error, which figures rest on assumptions, and what happened to last year's findings.
The questions
Open any question for the note
Walk me through how a sale gets from order to cash. Who touches it?
Why ask it
Asking for the walkthrough rather than the policy surfaces the steps that exist in practice, including the manual workaround nobody documented. Where a manager cannot describe their own process end to end, expect the control descriptions to be aspirational.
What changed this year: systems, people, products, structure?
Why ask it
Almost every control failure traces back to a change, because controls are designed for the arrangement that preceded it. A mid-year system migration or the departure of a single long-serving preparer will reshape your risk assessment more than the financial results will.
Which controls do you personally look at, and how often?
Why ask it
This separates monitoring that happens from monitoring that is described in a manual. If the answer is that reports are reviewed but no exception has ever been questioned, the review is a signature rather than a control.
Where do you think the numbers are most likely to be wrong?
Why ask it
Managers usually answer this quickly and accurately, because they live with the awkward account. An insistence that nothing could be wrong is itself a finding, and it means the rest of the interview needs corroborating from elsewhere.
Which figures in this period rest on an estimate, and who set the assumptions?
Why ask it
The name matters as much as the method: an estimate set by the person whose bonus depends on the result is a different risk from one set by a technical team. Ask how last year's estimates compared with the eventual outcome.
Who can post a journal entry, and who reviews them?
Why ask it
Manual journals are the standard route for a misstatement, particularly ones posted late in the period or by senior staff. A list of authorised posters that is longer than expected, or a reviewer who is also a poster, is worth testing directly.
Has anyone raised a concern about fraud or misconduct this year, and what happened to it?
Why ask it
The follow-through is the informative part. Zero reports in a large organisation usually means the reporting route is not trusted rather than that nothing occurred, so ask how a concern would reach management if it existed.
How do you find out about transactions with related parties?
Why ask it
Identification usually depends on people declaring interests, which means the process is only as good as the declarations. Ask when the register was last refreshed and whether anything was added rather than only confirmed.
Which approvals can be overridden, and who can override them?
Why ask it
Override rights are where segregation of duties quietly ends. What you want is the log: how many overrides happened, who authorised them, and whether anyone reviewed the list afterwards.
How do you satisfy yourself the data coming out of the system is complete?
Why ask it
Completeness is harder to demonstrate than accuracy, and it is where reliance on system reports most often breaks down. A reconciliation to an independent total is a real answer; trusting the report because it comes from the system is not.
What did you do about the points we raised last year?
Why ask it
Repeat findings tell you about management's appetite to fix things, which is more predictive than any single control weakness. Partial remediation is common, so ask what stopped the rest.
Which regulations bite hardest here, and who tracks changes to them?
Why ask it
A named owner suggests compliance is monitored; a general answer about the legal team usually means nobody is watching for amendments. Sectors with licensing or reporting obligations are worth pressing on specifically.
How do you satisfy yourself the company can meet its obligations over the next twelve months?
Why ask it
You are looking for a cash forecast with stated assumptions, not confidence. Ask what has to hold true for the forecast to work, since that list is where the going concern judgement really sits.
Which accounting policy choices this year were discussed rather than obvious?
Why ask it
Debated treatments are where judgement was applied, and the debate itself is useful audit evidence. If nothing was discussed at all in a year with acquisitions, new contracts or new products, that is unusual enough to probe.
Who can change master data such as supplier bank details?
Why ask it
This is the control that stops payment redirection, and it should involve verification against a known contact rather than an emailed instruction. Access lists that include temporary or shared accounts are a specific problem worth reporting.
What is outsourced, and what assurance do you receive from those providers?
Why ask it
Payroll, hosting and fulfilment often sit outside the entity while remaining inside the financial statements. A service organisation report that nobody has read is not assurance, so ask what management did with the exceptions it listed.
What does the board or audit committee ask you about most often?
Why ask it
It shows what governance is actually watching, which is not always what the papers say. Where the answer is only the headline result, oversight of controls may be thinner than the minutes imply.
Which errors did you find yourselves this year, and how did you find them?
Why ask it
Self-detected errors are a good sign, because they indicate the controls are catching things. The detection method is the useful detail: a reconciliation is a control, a customer complaint is not.
If the team had to cut corners to hit a reporting deadline, where would that show up?
Why ask it
Phrased hypothetically, this gets an honest answer about which procedures are the first to be skipped under time pressure. Those areas are where your testing will earn the most.
What have I not asked about that I should have?
Why ask it
A closing question that frequently produces the most valuable item of the meeting, since managers know their own unresolved issues. Silence is not proof of nothing, but a name or a topic here is worth following immediately.
Running a management interview
Practical guidance for the conversation itself
Before the meeting
Read last year's file first
Prior findings, management responses and unadjusted differences tell you what to test now. Arriving without them means asking questions the client has already answered once, which costs you credibility for the rest of the engagement.
Match the person to the question
A finance director can explain judgements and pressures; a ledger clerk can tell you what actually happens on a Friday afternoon. Asking a process question at the wrong level produces the version that appears in the manual.
Send the topics, not the questions
Advance notice of the areas lets management bring the documents you need. Sending the exact wording invites prepared answers to the parts where spontaneity is the point.
During the interview
- 1Open with a walkthrough rather than a control question. Descriptions of process reveal controls; questions about controls reveal policy.
- 2Ask for a document while the topic is live. Requests made afterwards take three weeks and arrive filtered.
- 3Follow every generality with a request for an instance: the last time it happened, who was involved, what the outcome was.
- 4Record the words used, not your summary of them. Management representations matter later and paraphrase loses the qualifiers.
- 5Note what was volunteered without prompting. That is often the item management most wants explained on their own terms.
- 6Close by asking what you missed, then leave the silence long enough for an answer.
Where interviews go wrong
Treating an answer as evidence
An inquiry response is a starting point that has to be corroborated with a document, an observation or a test. Files that rest on interview notes alone do not survive review.
Letting an incomplete answer stand
Interviews drift, and the unanswered half of a question is easy to lose. Keep a visible list of open points and return to them before the meeting ends rather than by email afterwards.
Ignoring incentives
Bonus measures, covenant thresholds and pending transactions all shape what management emphasises. Knowing what is riding on the result tells you which estimates to look at hardest.
Interviewing only the confident
The person who speaks fluently about the process is not always the person who performs it. Cross-check with someone closer to the transaction before concluding a control operates.