Interview Questions to Ask an Auditor
These are interview questions to ask an auditor candidate, written for the audit manager, CFO, controller or audit committee member doing the hiring, whether the job is internal or external audit. The 54 questions follow the order of a real interview: background, technical knowledge, planning and documenting fieldwork, skepticism and ethics, delivering findings, then deadlines and fit. The notes say what a strong or a worrying answer sounds like, and they flag the questions that suit only one side of audit or that need you to explain your own standards, rating scale or policies first.
Want questions from the whole vault instead? Try the random question generator.
The questions
Each question, and why to ask it
Background
What kinds of audits have you worked on, and what was your own part in each?
Why ask it
Audit experience on a resume covers everything from footing schedules to running the engagement, so sort it out first. A good answer names the type of work, such as financial statement, controls, operational, IT or compliance, and says plainly whether they tested, led or reviewed. If every sentence starts with 'we', ask which workpapers carried their initials.
Walk me through the last audit you finished, from planning to the report.
Why ask it
Someone who did the work tells it in order: understanding the area, assessing risk, writing the program, testing, concluding, reporting. Notice where the account goes thin, since that is usually the stage a senior handled for them. With an experienced hire, ask where the plan changed partway through and why.
Why did you go into audit, and why this side of it, internal or external?
Why ask it
People move between a firm and an in-house team for good reasons, such as wanting to see fixes through, and for poor ones, such as expecting an easier life. The reason should fit the job you have. If they are switching sides, ask what they expect to be different and correct anything they have wrong before an offer.
What do you think separates a good auditor from an average one?
Why ask it
Attention to detail, integrity and communication come up in nearly every reply, so the list alone tells you little. Ask for an audit where they saw the difference, in their own work or a colleague's. The replies worth having are particular: someone who reopened a test they had already closed, or who explained a finding so clearly that its owner fixed it without being chased.
Pick two industries you have audited. What did you have to test in one that hardly mattered in the other?
Why ask it
The comparison separates someone who audited a bank from someone who understood why a bank is audited the way it is. A strong candidate names a risk that belonged to the sector, such as loan loss estimates, grant restrictions or inventory held at someone else's warehouse. A candidate with one sector behind them can compare two clients or two business units instead.
Which certifications or licenses do you hold, and where are you with any you are working toward?
Why ask it
CPA, CIA, CISA, ACCA and their equivalents differ from country to country, and what each allows a person to sign depends on local rules, so find out which one your role really requires where you are before you screen on it. A candidate midway through exams should be able to say which parts are passed and when the next sitting is. Plans with no dates attached tend to stay plans.
What have you used to run and document an audit: a workpaper system, spreadsheets, a data analysis tool? What did you build in them yourself?
Why ask it
Products differ from one employer to the next and a capable auditor can learn a new one, so brand names make a poor screen. What carries over is depth: whether they filled in templates someone else built, or wrote a query, designed a test or set up a file structure the team then used. Say what your team works in and ask what they would have to learn.
What do you know about our organization, and where would you expect an auditor to look first?
Why ask it
A prepared candidate has read what is public and offers two or three risk areas with reasons. The guesses do not have to be right. You are hearing whether they reason from the business to the risk or reach for a stock list of cash, revenue and payroll.
Technical
Which auditing standards governed your last few jobs, and which requirement shaped your work the most?
Why ask it
Which standards apply depends on the country, the kind of entity and whether the work is internal or external, so say which ones govern yours and ask how much would be new. Reciting the names is easy. The requirement they pick, perhaps a documentation rule or an inquiry they could not skip, shows whether they have read the standards or only the firm's templates.
How do you set materiality, and what do you do with it once you have it?
Why ask it
A definition is the weak answer. A working auditor talks about a benchmark chosen for a reason, a lower figure for testing, a floor for trivial items, and revisiting all three when the numbers move. For an internal audit role, ask instead how they decide whether an exception is big enough to report.
Explain inherent risk, control risk and detection risk using an account or process you have audited.
Why ask it
Tying it to a real account stops this from being a recital. The answer you want shows a high risk assessment changing what they tested, when, or how much. If they can define all three and cannot say what they did differently because of them, the model has not yet reached their fieldwork.
When would you test controls, and when would you go straight to the transactions or balances?
Why ask it
Good candidates give a reasoned choice: rely on controls where volume is high and the control is automated or well run, test directly where the population is small or the controls are weak. 'Whatever we did last year' is the reply to worry about. Follow up by asking what they do when a control they planned to rely on fails.
What experience do you have with a formal controls testing program, such as SOX work, and which parts did you own?
Why ask it
Skip this if no such regime applies to you, which depends on where your organization is listed and regulated. Scoping, walkthroughs and evaluating deficiencies are a different level from executing test steps someone else wrote. Ask what they would change about how the program was run, because people who only followed it have no view.
How do you tell a minor control deficiency from one serious enough to go to the board or audit committee?
Why ask it
The labels and thresholds depend on the framework and the rating scale in force, so explain yours and have them apply it to an example. Their reasoning is what counts: how likely the failure is, how large the effect could be, and whether another control would catch it. Be wary of someone who rates by how annoyed management will be.
How do you decide how many items to test, and how do you pick them?
Why ask it
Expect a distinction between statistical and judgmental selection, some mention of the size and risk of the population, and a point at which they would query every record instead of sampling. Then ask what they do when one item in the sample fails. 'Pick another one' is a bad sign.
Where is fraud most likely in an organization like ours, and how would that change your testing?
Why ask it
Revenue timing, journal entries posted by senior people and changes to supplier bank details are common answers, but a thoughtful one is fitted to your business. The change in testing matters more than the list: an unpredictable procedure, a look at who can override an approval. A candidate who treats fraud as someone else's problem deserves a second question.
How do you audit an estimate that management cannot prove and you cannot recalculate?
Why ask it
Allowances, impairments and valuations are where a junior tends to accept the client's spreadsheet. A stronger auditor tests the assumptions and the underlying data separately, builds their own expectation, checks how last year's estimate turned out and knows when to call in a specialist. For an operational internal audit job this one can be dropped.
Before you rely on a report from a system, how do you know it is complete and accurate?
Why ask it
So much audit evidence starts as a system report that an auditor with no answer here is leaning on listings nobody tested. Checking the parameters, tying a total to an independent source and asking who can change the report logic are the basics. For a specialist IT audit post, treat this as the first question of many.
Which change in standards or regulation over the last couple of years altered something you do on a job?
Why ask it
Continuing education hours show attendance and little else. A candidate who can name a change and say what it did to a program, a workpaper or a report has absorbed it. Have one from your own field in mind so you can tell a real answer from a headline.
Fieldwork
How do you plan an audit of an area you have never seen before?
Why ask it
The order tells you most: reading prior reports and policies, talking to the people who do the work, following one transaction through, and only then writing risks and tests. Starting from last year's program and adjusting it is rollover, which is fine for a repeat audit and thin for a new one.
If you had to draw up next year's audit plan for us from a blank page, where would you start?
Why ask it
Keep this for a senior internal audit hire or a head of audit. A risk-based answer begins with what the organization is trying to do and what could stop it, takes in what management and the audit committee are worried about, and only then counts the days available. Visiting every department on a fixed cycle is the weaker plan, because it gives the petty cash float the same time as the payments system.
Tell me about a walkthrough where the real process turned out to be different from the written procedure.
Why ask it
Every experienced auditor has one, because documented processes drift. In the good version the candidate redesigns the test around what really happens and reports the gap. If they have never found a difference, ask how they run a walkthrough, since reading the procedure aloud to the process owner finds nothing.
What makes a workpaper good enough for a reviewer who was not there?
Why ask it
A common test is whether an experienced auditor with no link to the job could see what was done, what evidence was obtained and what was concluded. Hear whether they mention purpose, source, procedure, result and conclusion without being led. If your process allows it, set a short documentation exercise, since talking about workpapers and writing one are different skills.
Which review notes do you get most often, and what have you changed because of them?
Why ask it
Honest candidates have this ready: conclusions that ran ahead of the testing, tick marks nobody explained, a sample described too thinly. Knowing their own pattern suggests they read the notes and did not just clear them. With a senior, turn it around and ask which note they most often write on other people's files.
Tell me about a time the evidence you were given did not support what you had been told.
Why ask it
Explanations that the documents do not bear out turn up on most audits, so a working auditor has a recent case. Follow the sequence: a specific question back to the auditee, a different source requested, the test widened, the senior told early. Accepting a verbal explanation and writing it up as evidence is the habit you are screening for.
How do you judge whether a piece of evidence is reliable enough to rest a conclusion on?
Why ask it
Most auditors rank by source: something obtained directly from outside the organization, or produced by the auditor, outweighs a document the auditee prepared, and any of them outweighs a verbal answer. Better candidates add that a PDF or a screenshot can be edited. Ask how they would satisfy themselves that a document is what it claims to be.
A test produces an exception. What do you do next?
Why ask it
A sound reply covers confirming the exception is real, finding the cause, deciding whether it is a one-off or a pattern, and extending the test if needed. Note when the process owner hears about it. Calling it isolated with no work to show that it is should worry you.
Tell me about a test you ran on a whole population of data instead of a sample. What did it turn up?
Why ask it
Plenty of candidates claim analytics and mean a pivot table. A real example has a question, data they had to obtain and check for completeness, and results that needed follow-up, false positives included. If they have none, ask which test from their last audit they would convert first.
What do you do when a document you need keeps being promised and never arrives?
Why ask it
Late evidence is among the commonest reasons fieldwork overruns, so expect a real case and not a theory. Practical answers start with dated requests tracked in one place, move to a conversation about what is in the way, then to the manager, and consider whether other evidence would do. A candidate who blames the auditee for every delay is telling you how they will be received.
How do you get straight answers from someone who is nervous about being audited, or tired of it?
Why ask it
A good share of fieldwork is interviewing, and most auditors pick it up on the job. Open questions, asking to be shown instead of told, explaining why a document is needed and staying out of the way at month end all count in their favor. You also have live evidence: how they have handled your questions today.
Skepticism and ethics
What does professional skepticism look like in practice? Give me a time it changed what you did.
Why ask it
Anyone can define a questioning mind. The example should have a specific moment in it: an explanation that was plausible but unsupported, a number that was too smooth, a document that appeared remarkably fast. Skepticism that never changed a procedure is only a word.
Tell me about a time you accepted an explanation and later wished you had pushed further.
Why ask it
It takes some security to answer this, and the candidates who can are often the careful ones. What you want is the blind spot they found, such as trusting a long-serving contact or running short of time. From someone with several years of audits, 'that has not happened' is hard to believe.
You have audited the same area and the same people three years running. How do you avoid seeing only what you expect to see?
Why ask it
Familiarity is the quiet threat to an audit because it feels like expertise. Changing how the sample is drawn, testing something left alone before, reading the prior file last or asking a colleague to challenge the plan are all credible. It doubles as a way to learn how they feel about being rotated off work they know.
You notice that a colleague has signed off a test you know was not finished. What do you do?
Why ask it
Candidates tend to reach for one of two easy answers, saying nothing or going straight to the top. The better one starts with the facts, by looking at the file and asking the colleague, and ends with the reviewer knowing before the report goes out. Where a concern like this goes, and whether there is a confidential route for it, depends on your organization, so tell them how it works with you.
What would make you tell us you should not be assigned to a particular audit?
Why ask it
Independence rules differ by jurisdiction, by standard and by employer policy, so say what yours are and ask how they compare with what the candidate knows. The instinct is what you are testing: a relative or close friend in the area, a financial interest, a process they designed or recently ran. Someone who cannot think of a case has probably never been asked.
Someone you have audited for years offers you tickets to an event. What do you do?
Why ask it
Gift limits vary by employer and sometimes by law, so the right answer begins with checking the policy and telling a manager. Past that, see whether they understand why it matters when no rule is broken: how it would look to a reader of the report. Both extremes are worth noting, the candidate who sees no issue and the one who would report a cup of coffee.
How do you stay objective when the people you audit are colleagues, and one of them might be your boss one day?
Why ask it
This is independence as an internal auditor lives it, and a candidate from a firm may not have met it. A thoughtful answer admits the pull and names what holds against it: a reporting line outside the area, an evidence standard that does not bend, a manager to hand a conflicted job to. For an external role, ask the same about a client who might offer them a job.
Auditors see pay, investigations and results before almost anyone. How have you handled being asked about something you could not discuss?
Why ask it
The request rarely arrives as a formal breach. It comes from a friend over lunch, so hear whether they have a polite refusal they have used before, and habits around screens, files and talk in shared spaces. If your work touches personal or market-sensitive information, describe the rules you operate under and ask which are new to them.
Something looks like fraud partway through a test. What do you do in the first hour, and what do you avoid doing?
Why ask it
What they would hold back from is the part to hear. A careful candidate keeps what they have, does not confront anyone or go digging beyond their remit, and takes it promptly to the right person, which depends on your escalation policy and local law, so explain yours. Eagerness to play investigator is the worrying answer.
Findings
What is the most significant issue you have uncovered on an audit, and what led you to it?
Why ask it
The route matters more than the size. An issue that came from a planned test, an odd number or a question nobody had asked shows method, and one handed over by a tip shows less. Ask what became of it afterward, since an auditor who never learned the outcome was not close to it.
Tell me about a finding that management did not want to hear. How did you deliver it?
Why ask it
Here is the core of the job in one story. Good versions have the facts agreed before any opinion was offered, the process owner hearing it in person before the draft report, and wording that named the risk without blaming anyone. Then ask what the working relationship was like a year later.
A senior executive asks you to soften a finding or leave it out. What happens next?
Why ask it
Correcting a factual error or an unfair tone is one thing and removing something true is another, and a good candidate draws that line unprompted. They should also say who they would tell, and the route above that depends on your reporting lines, so describe them. If it has happened to them, ask what the final report said.
Tell me about a time you were wrong about a finding. How did you find out?
Why ask it
An auditor who has never withdrawn a point has been lucky or has not been listening. In a good account they check the new evidence, amend or drop the point without a fight, and work out what in their testing misled them. It also hints at whether auditees feel able to correct them.
How do you write up a finding so a busy executive grasps it in a minute?
Why ask it
Many auditors learn a structure along the lines of what should happen, what did happen, why, and what it could cost. See whether the candidate leads with the risk or buries it under a description of the procedure. A ten-minute exercise from a set of facts will tell you more than the spoken answer.
How do you make sure a recommendation is something the business can carry out?
Why ask it
Recommendations written at a desk tend to say 'implement a review', and then nothing changes. Stronger candidates talk the fix through with whoever will own it, weigh its cost against the risk, and leave with a name and a date. How far an external auditor may go in recommending or designing a fix depends on the independence rules that apply, so for that role ask how they handled points in a management letter.
An agreed action is overdue and its owner has stopped replying. What do you do?
Why ask it
Follow-up is where findings get fixed or quietly lapse. A sensible approach is a direct conversation, a realistic new date if the reason is fair, and escalation by an agreed route if it is not. Marking it overdue in the tracker and moving on is record keeping, not auditing.
You and your manager or partner disagree about whether something is a finding. How does that get settled?
Why ask it
You want someone who argues from the evidence, accepts a reasoned decision, and knows the difference between being overruled and being asked to sign something untrue. Ask for a real instance and who turned out to be right. Organizations record such disagreements in different ways, so tell them how yours does.
Deadlines and fit
Tell me about an audit that ran over budget or past its date. What caused it, and when did you say so?
Why ask it
Overruns usually trace to scope that grew, evidence that came late or a problem found near the end. The timing of the warning is the thing: a manager told in the first week can act, and one told the day before cannot. Be cautious when the cause in every version is someone else.
The report is due tomorrow and one test is not finished. What are your options?
Why ask it
It is the cutting-corners question, asked without accusing anyone. Telling the manager, asking whether the date can move, getting help or reporting the work as incomplete with the reason are all acceptable. Signing off work that was not done, or thinning the test without saying so, is the answer that rules a candidate out.
How do you manage being on several audits at once, each with a different manager?
Why ask it
Common in firms and in any internal team of more than a handful. A real system helps, such as one list of commitments with dates, along with the habit of warning one manager when another's job is about to take the week. Ask what gave way the last time two jobs collided.
What has your hardest stretch of fieldwork been like, and what kept the quality of the work up?
Why ask it
Describe your own busy season, travel and hours first and honestly, because they differ widely between employers and a surprised hire leaves. Then hear how they protected the work when tired: a checklist, an earlier review, stopping before a careless error. Pride in the hours alone is a different thing.
When you review a junior auditor's file, where do you start, and how do you give the notes?
Why ask it
For a senior or manager hire only. Reviewers worth having begin with whether the conclusion follows from the work, move to the higher-risk areas, and leave formatting for last. Explaining the reason behind a note, not just the correction, is what produces juniors who improve.
Do you see audit as a long-term career, or as a few years on the way to another job?
Why ask it
Both are ordinary answers and each changes the hire. Someone aiming at a finance or operations job may give you a few good years, which can suit an internal team that rotates people into the business. Someone who means to stay will want to hear about specialties and promotion, so say truthfully what progression looks like with you, since a promised path that does not exist costs you the person later.
You check things for a living. What would you want to verify about this team before you accepted the job?
Why ask it
Their questions are evidence too. Strong candidates want to know who the function reports to, how findings are received, how the plan is set and who reviews their work. One with nothing to check about independence or review may not yet see how much those shape the job.
How to interview an auditor
Practical guidance for the conversation itself
Before the interview
Decide which auditor you are hiring
An external audit associate, an internal auditor who covers operations, a controls tester and an IT auditor share a title and little else. Write down the work this person will do in their first year, then mark the questions that fit it. Several notes on this page say when a question belongs to one side only, and the Technical group in particular should be cut to match your work.
Choose by level
For a graduate or first-year hire, stay with Background, the simpler Technical questions and the scenarios under Skepticism and ethics, since they have little fieldwork to describe. For a senior, spend most of the time on Fieldwork and Findings. For a manager or a head of audit, add the questions on the annual plan, review, disagreement and overdue actions, and expect examples from more than one audit.
Have your own answers ready
Many of these questions only work if you can say how it is done where you are: which standards apply, how findings are rated, what the gifts policy says, who a concern about fraud goes to. Those depend on your country, your regulator and your own policies. Look them up before the interview so you can state them and judge the reply against them.
Prepare a short exercise
Auditing is a written job and an interview tests speech. A one-page set of facts from which the candidate writes a finding, or a small spreadsheet with a few planted exceptions, shows documentation and judgment in the time one long answer takes. Give every candidate the same one, and strip out anything confidential.
In the room
Ask about the last audit, not audits in general
'How do you handle pushback?' gets a philosophy. 'What happened the last time an auditee disputed your finding?' gets a story with evidence, people and an ending. Nearly every question under Fieldwork and Findings improves when you tie it to a recent job.
Sort out I from we
Audit is team work, so 'we' is natural, and it also hides who did what. When a story matters to your decision, ask which part was theirs: who selected the sample, who wrote the point, who sat in the closing meeting.
Push back once
Disagree mildly with one of their answers and watch what happens. Auditors are regularly told they are wrong by people senior to them. You want someone who restates the evidence calmly, and who changes their mind when you give them a reason and not before.
Split the groups across the panel
With several interviewers, give the technical groups to whoever can judge the answers, usually the audit manager, and let the CFO, controller or committee member take Skepticism and ethics and Findings. A candidate who answers the same question twice has less time for the ones nobody asked.
Reading the answers
Detail is the evidence
Hold the candidate's account to an auditor's own standard. The procedure they ran, the size of the population, what the exception turned out to be and how the report was worded are hard to invent. A story that stays general after one follow-up was probably somebody else's audit.
Weigh judgment above recall
A standard can be looked up and a methodology can be taught. Knowing when an explanation is too convenient, or when a small exception points at something larger, takes much longer to learn. If you have to choose, the candidate who reasons well and has gaps is often the better bet than the one who recites.
Firm is not the same as combative
The Findings questions show temperament. An auditor who enjoys catching people out will cost you cooperation on every later job, and one who cannot bear to disappoint anyone will write reports that say nothing. The stories to look for have a hard message delivered and a working relationship still standing afterward.
Check what can be checked
Confirm a license or certification with the body that issued it, and ask that body how if you are unsure. Where a former employer will give more than dates, ask the manager about review notes, deadlines and how auditees responded to the person, which are the three things a candidate describes most kindly.
Mistakes to avoid
Running a technical quiz
A long run of definitions tests memory and exam technique. Two or three technical questions tied to work the candidate has done tell you the same thing and leave room for the rest of the page.
Describing the job you wish you had
Travel, busy-season hours, how much of the year goes to routine controls testing and how management really receives findings are what people leave over. Say them plainly. A candidate who accepts the real job is likelier to stay than one who accepted a brochure.
Hiring the auditor who agrees with you
If this person will audit your own area, or report to you while auditing your peers, notice whether you are favoring the candidate who would be easiest to live with. Part of an auditor's value to you is that they will say things you would have preferred not to hear.
Asking what you may not ask
What an interviewer may ask about a candidate's personal circumstances is set by employment law where you are, and it differs from place to place. If you are unsure whether a question about travel, hours or background is acceptable, check with your HR or legal contact before the interview, not after.