Questions to Ask in an Internal Audit Interview
Questions for a candidate for an internal auditor job to ask the hiring manager or head of internal audit when the interview turns to you. They run in the order the decision goes: how independent the function is, what the work is and how the plan is set, how findings land with management, the team, travel and busy periods, then certifications and where people go next.
Want questions from the whole vault instead? Try the random question generator.
The questions
Each question, and why to ask it
Independence
Who does the head of internal audit report to, both functionally and day to day?
Why ask it
A common setup is two lines: one to the audit committee or board for the work itself, and one to an executive for budget and administration. A function that answers only to the CFO is auditing its own boss's area, so if that is the arrangement here, ask how audits of finance are handled.
How is internal audit seen by the rest of the business: called in before a project starts, or after something has gone wrong?
Why ask it
Being invited in early means the business finds the team useful. Being called only for the post-mortem means you would spend the job arriving as bad news. The proof is an example, so ask for the last time someone outside audit came to the team for its view.
How often does the head of audit meet the audit committee without management in the room?
Why ask it
Private sessions are where an audit chief can say what a report could not. A named cadence, such as every committee meeting, suggests the committee treats the function as its own eyes. 'When needed' is only reassuring if they can tell you when the last one was.
Is there anywhere in the business internal audit has been unable to look, or been asked to leave alone?
Why ask it
Most heads of audit will say access is unrestricted, so the telling part is the example that follows. A story about a records request that was refused and then escalated shows the mandate has teeth. A long pause, or 'we pick our battles', is worth remembering when you weigh the offer.
Does internal audit own anything besides auditing, such as risk management, compliance or part of the control testing?
Why ask it
Combined teams are common in smaller companies, and they mean you may end up auditing work your own department does. That is manageable when someone independent reviews those areas. Ask who does, and whether the arrangement is written down.
Has the function had an outside quality review, and what did it recommend?
Why ask it
Many functions follow the standards of the Institute of Internal Auditors, which call for a periodic external assessment, though how closely they are followed varies by employer. A head of audit who can name two things the reviewers told them to fix takes criticism the way they ask others to.
The work
How is the annual audit plan built, and who gets a say in it?
Why ask it
You are hoping to hear about a risk assessment, conversations with executives and sign-off by the audit committee. A plan that mostly repeats last year's, or that management can strike items from, tells you the team audits what is comfortable. Ask which audit was new this year and why.
Which risks sit at the top of this year's audit plan?
Why ask it
The answer is the company's own view of what could go wrong, and a preview of the audits you would be staffed on. Reasons tied to this business, such as a system going live or a unit bought last year, show the plan was thought through. If one of the areas is something you have audited before, this is the moment to mention it.
How often does the plan change mid-year, and what was the last thing that changed it?
Why ask it
Some movement is healthy: an acquisition, a system failure or a new regulation should bump something. Constant reshuffling means half-finished audits and work you never see through to a report. No change at all, in a year when the business changed a lot, is its own warning.
What is the split between SOX or controls testing, operational audits and IT audits?
Why ask it
Ask for rough shares of the team's hours, and then of your own. Controls testing is steady and repeatable, and operational audits are where you learn how the business runs. If the company is not subject to SOX, ask what required testing takes its place, since that depends on where it is listed and who regulates it.
On controls testing, does internal audit test on management's behalf, and does the external auditor rely on that work?
Why ask it
Where the outside auditor leans on your testing, expect their methods, their deadlines and a second look at your workpapers. That is good training and a tighter calendar. Where a separate controls team does the testing, internal audit is often freer to choose its own work, which is worth confirming.
How many audits would I work on in a year, and how long does one usually run from planning to final report?
Why ask it
Six-week audits and four-month audits are different jobs. Short ones bring variety and many reports with your name on them; long ones bring depth and fewer fresh starts. Set the answer against the size of the plan and the team, and ask about the gap if the numbers do not fit.
Would I plan and lead audits myself, or do fieldwork under a senior to begin with?
Why ask it
Neither is wrong, but it should match the level you are being hired at. Leading from the start is only a good deal when someone helps you scope the first one. Starting in fieldwork is fine when they can say how long people usually wait for an audit of their own.
What does an ordinary week look like for an auditor here, during fieldwork and between audits?
Why ask it
Fieldwork weeks are walkthroughs, testing and chasing evidence. The weeks between hold planning, report drafts and follow-up on old actions. A team that describes no gap between audits is probably planning in a hurry and finishing reports after hours.
How much of the team's time goes to advisory work, as against assurance?
Why ask it
Advisory work, such as sitting on a system implementation or looking over a new process before launch, builds contacts across the business. Ask how the team avoids later auditing its own advice. A function that does none may be seen purely as a checker.
Who covers IT and cybersecurity audits: specialists on the team, an outside firm or generalists?
Why ask it
For a generalist, the answer says how technical you will be asked to get and whether anyone is there to teach you. For an IT auditor, the follow-up is how many others there are, because being the only one means nobody can review your work in depth.
How does the team use data analytics: on every audit, or only when someone has the time?
Why ask it
Plenty of functions call analytics a priority, so ask for the last audit where a whole data set was tested in place of a sample. If one person builds every script, find out whether you would be trained to do it or would wait in their queue.
Does internal audit handle investigations or whistleblower reports, and would I be pulled onto them?
Why ask it
Investigations arrive without warning and push planned audits back, so they shape your calendar as well as your skills. Some auditors love the work and some find it draining. A rough count from last year, and who led them, tells you how often your own plan would be interrupted.
Which audit from the past year are you proudest of, and what changed in the business because of it?
Why ask it
The second half is the test. A head of audit who describes a process that was rebuilt, or a loss that was stopped, runs a function people act on. If the proudest moment is a report issued on time, the bar may be completion more than effect.
Is there an area you would like to audit that the team lacks the skills or the capacity for?
Why ask it
An honest reply shows where the gaps are, and possibly why this seat exists. If your background matches the gap, say so on the spot. A claim that everything is covered sits oddly with a team that is hiring, so treat it as a non-answer.
Findings
How does management usually react when internal audit raises a finding?
Why ask it
Expect a diplomatic first answer, then ask for the range: the best reaction they have seen and the hardest. Managers who argue the facts and then fix the problem are normal and healthy. Managers who go over the auditor's head to get wording softened are the thing to listen for.
Can you tell me about a recent finding management disagreed with, and how it was settled?
Why ask it
You want the mechanics: who met, what evidence decided it, and whether the finding survived. An account where audit held its ground, or changed its mind for a stated reason, is reassuring either way. If they say agreement is always reached, ask about the closest it came to not being.
How are findings rated, and who has the last word on a rating?
Why ask it
Ratings are where many arguments happen, because a high rating may reach the audit committee and a lower one may not. Written criteria, and a final call that sits with the head of audit, protect the auditor who did the work. A rating that management can negotiate down is one you would be asked to defend in every closing meeting.
Do process owners hear about issues as they come up, or first see them in the draft report?
Why ask it
Sharing issues during fieldwork tends to mean fewer fights at the reporting stage and faster fixes. It also previews your own days: regular conversations with the people you are auditing, or one tense closing meeting at the end.
Would I present my own findings to the process owner, or does the manager run the closing meeting?
Why ask it
Presenting your own findings is how an auditor learns to defend evidence face to face, and it gets your name known outside the department. Being kept out of the room at a junior level is common. Being kept out for years is a slow way to learn the part of the job that workpapers cannot teach.
How are agreed actions tracked, and what happens when one passes its due date?
Why ask it
Follow-up is the dull half of the job and the half that proves anyone listened. Listen for a tracking system, a named person who chases, and overdue items reported upward. If dates are simply pushed out on request, findings here have little weight behind them.
How long does a report take to issue once fieldwork ends?
Why ask it
A few weeks and a few months describe two very different teams, and the delay usually sits in review layers or in waiting for management's responses. Ask which it is here. Long cycles mean redrafting an old audit while fieldwork on the next one has already begun.
What reaches the audit committee: full reports, summaries or only the high-rated findings?
Why ask it
This shows how far up your work travels. Ask too whether auditors below the head of audit ever present or sit in. Many teams keep that for the head of audit, so a yes is worth noting and a no is ordinary.
When a senior executive pushes back on a draft report, what usually changes: the wording or the finding?
Why ask it
Softer tone and added context from management are routine edits. A finding that was dropped, or moved out of the report into a side memo, is the answer that deserves one more question. Keep this for the head of audit, and say first that you are asking because you want to work where reports carry weight.
Team and hours
How large is the team, and how is it split by level and specialty?
Why ask it
A team of four and a team of forty offer different jobs under the same title. Small teams give broad exposure and thin review; large ones give structure, specialists and a longer ladder. Ask how many people sit at your level and how many seats are open.
Why is the team hiring now: a bigger plan, or someone moving on?
Why ask it
A new seat usually follows an event: a larger plan, a listing, a regulator's comment or work taken back from an outside firm. Whatever it was will fill your first year. For a replacement, find out which audits the person left unfinished, since those may become yours halfway through.
Do you co-source or outsource any of the work, and which parts?
Why ask it
Outside firms are often brought in for IT audits, specialist topics or overflow testing. Find out whether in-house staff work alongside them and learn, or just receive the finished report. If most of the plan goes out, ask what is left for the role you are interviewing for.
How much travel does the job involve, and how far ahead is it scheduled?
Why ask it
Get it as weeks per year and a typical trip length, then ask whether last year matched the estimate. Site visits set a quarter ahead are easy to plan a life around. Trips that appear with a week's notice are another commitment entirely, whatever percentage the posting gives.
When are the busy stretches in the audit year, and what do the hours look like then?
Why ask it
Internal audit keeps its own calendar: year-end testing, audit committee deadlines, the push to finish the plan. Ask which months people avoid booking leave, and ask for hours as a number. If you are told there is no busy season, put the same question to a team member later.
What software does the team use for workpapers and for tracking issues?
Why ask it
Dedicated audit software and a library of past workpapers let you see how an area was audited last time. Spreadsheets and shared drives work too, with more hunting. Experience on a different tool is rarely a barrier, but name the one you know so they can say how long the switch has taken others.
Who would review my workpapers, and how soon after fieldwork do the review notes arrive?
Why ask it
Review is how auditors are trained, so the reviewer matters as much as the manager. Notes within a few days, while you still remember the testing, teach you something. Notes that land a month later, when you are deep in another audit, mostly cost evenings.
How does the team work with the external auditors, and with risk and compliance?
Why ask it
Good coordination means plans are compared and no business unit is tested three times on one control. Ask who is in the room when that comparison happens. Where each group works alone, expect managers who greet you with 'we just went through this'.
How is time split between the office, home and the sites being audited?
Why ask it
Fieldwork bends the usual hybrid arrangement, since walkthroughs and counts happen where the process is. Ask whether remote fieldwork is normal here or an exception, and whether the office days are fixed. Policies differ by employer and sometimes by audit.
How long have the people on the team been here, and how many joined in the last two years?
Why ask it
A group of long-timers with one new seat is stable but may promote slowly. Several recent joiners can mean growth or a string of departures, and the difference matters. Long tenure also means someone can tell you why an area was audited the way it was last time.
Growth
Does the company support the CIA, CPA or CISA: exam fees, study time and membership dues?
Why ask it
Ask what is covered, whether it is paid up front or reimbursed on passing, and whether anything must be repaid if you leave. Then ask who on the team sat an exam recently. Support that exists on paper and has never been used is a weaker promise.
Is there a training budget, and how do people keep up their continuing education hours?
Why ask it
Certifications generally have to be maintained with logged education hours, so this is a recurring cost that somebody pays. Conferences, paid courses and time during the working day are the generous end. 'Free webinars on your own time' is the other, and it is better to know now.
Where have people gone after a few years on this team?
Why ask it
Names and destinations are what you are after: a finance manager role, a move into risk, a promotion within audit. They show how the rest of the company rates the team. If everyone who left went to another employer, ask what the internal options were.
Is there a rotation or guest auditor program between internal audit and the business?
Why ask it
Some companies treat audit as a training ground and move people through on purpose, while others keep a career audit staff. Both work, but they suit different plans. If you mean to stay in audit, ask how many people here have.
What is the path from this level to senior or manager, and how long has it taken the people who made it?
Why ask it
Ask about people, not policy: who was promoted last, and after how long. In a small function the next level may open only when someone leaves. Better to hear that now and weigh it against what you would learn in the meantime.
How is an auditor's performance judged here?
Why ask it
Listen for what gets counted. Audits delivered on budget and the quality of workpapers are fair measures. If the number of findings comes into it, ask how they stop that from rewarding trivia, and whether feedback follows each audit or comes once a year.
What do your best auditors do that does not show up in a workpaper?
Why ask it
Expect things like getting a reluctant manager to talk, knowing when a small exception points to a bigger problem, or writing a finding nobody can misread. Whatever is named is what this head of audit prizes. Pick the one you can back with a story and tell it before the interview ends.
What would you want me handling on my own by the end of the first year?
Why ask it
This is the real expectation for the level: leading a walkthrough, drafting a report section, running a small audit end to end. Write it down. It becomes the yardstick for your first review and a fair thing to refer back to.
What is the function trying to get better at over the next couple of years?
Why ask it
A head of audit with a direction, such as more analytics, wider IT coverage or shorter reports, is building something you could grow with. Ask what part a new hire would play in it. No answer at all suggests the job will look the same in three years.
Closing
What would my first audit here be, and who would I work with on it?
Why ask it
A named audit and a named senior mean they have planned for your arrival. 'Whatever is running when you join' is common and not alarming, as long as one person is clearly responsible for your first month. Whether you would shadow first or go straight into fieldwork is worth settling too.
What brought you into internal audit here, and what has kept you?
Why ask it
Heads of audit often arrive from an outside audit firm or from the business itself, and each background shapes what the team is good at. What has kept them is the honest sales pitch for the job. It also gives the interviewer an easy question after several hard ones about independence and findings.
Is there a gap in my experience you would want to test before making an offer?
Why ask it
A candidate from external audit may hear a doubt about operational experience, and one from the business a doubt about audit method. Either can be answered while you are still in the room. Take the reply calmly and respond with one example, not a defense.
What are the next steps, and who else would I meet?
Why ask it
If the remaining rounds include a team member or someone from the business, that is your chance to check today's answers about travel, hours and how findings land. Ask for a date as well, so a follow-up note a few days after it is expected and not pushy.
How to use your questions in an internal audit interview
Practical guidance for the conversation itself
Before the interview
Find out who you are meeting
The head of internal audit, often titled chief audit executive, can answer for independence, the audit committee and the plan. An audit manager or senior knows review, travel and what the busy weeks are like. A recruiter knows the process and the pay band. Sort your questions by who can answer them, and keep the Independence group for the most senior auditor you meet.
Read what the company publishes
Listed companies generally publish an annual report, and some include an audit committee report or a description of internal audit. What is disclosed depends on where the company is listed, so look and see. If the reporting line is stated there, do not ask for it again. Ask how it works in practice.
Work out which kind of auditor they are hiring
Postings for internal auditors cover controls testers, operational auditors, IT auditors and mixtures of all three. Mark the lines in the posting that point to each, then use the questions under The work to confirm the split. It is the fact most likely to differ from what you assumed.
Pick five and rank them
Interviews seldom leave time for more than a handful. Take one from each group that matters to you and put first the one whose answer could change your mind. For many candidates that is the mix of work or how findings are received.
In the room
Ask the way an auditor would
The job is asking clear questions and following the evidence, and your own questions are a sample of that. Ask for the last time something happened, not how things generally go, and hear the whole answer before you follow up. The interviewer is watching how you do it.
Give a reason before the independence questions
Asking a head of audit whether reports get softened can sound like an accusation. One sentence of framing fixes that: 'I want to work somewhere audit's findings carry weight, so can I ask how disagreements with management get settled?'
Do not ask for confidential detail
Findings, investigations and the names of the people involved are not yours to hear as a candidate. Ask about process and outcome: how it was settled, what changed. An interviewer who volunteers sensitive specifics to a stranger is showing you how discreet the team is.
Raise SOX without sounding above it
If controls testing is a large share of the job, ask about it with interest and then ask what else there is. Sounding as though testing is beneath you is a quick way to lose a manager who needs it done well.
Reading the answers
Examples outweigh assurances
'We are fully independent' and 'management values us' are things any function can say. The evidence is a specific audit, a named disagreement, a date. When you get only the assurance, ask once for an example and note whether one arrives.
Compare the manager's version with the team's
Travel, hours and review turnaround are best checked with a peer if you meet one. Ask the same question in the same words. Small differences are normal. A manager who says a few trips a year and an auditor who says every other week are describing different jobs.
Fit the answers to your own plan
A team heavy on controls testing at a large listed company can be a fine place to earn a certification and learn method. A two-person function with a wide plan can be a fine place to learn a business. Neither is the better job in general. Judge it against what you want from the next three years.
Notice how they talk about the business
A head of audit who describes managers as people to be caught runs a different function from one who describes them as people to be helped. That tone is not in the job description, and you would carry it into every opening meeting.
Mistakes to avoid
Leading with the exit
Asking where people go next is fair and belongs on the list. Asking it first, or twice, suggests you see the job as a waiting room. Put it after your questions about the work itself.
Asking what only an audit could answer
A question such as how strong the control environment is invites a polite non-answer. Stay with things the interviewer knows firsthand: the plan, the team, how the last disagreement went.
Treating travel and hours as the whole decision
They matter, and the notes on those questions say how to pin them down. But two jobs with the same travel can differ completely in whether anyone acts on the reports. Make sure at least two of your questions come from Independence or Findings.
Taking one awkward answer as the verdict
Every function has an overdue action somewhere and a manager who fights findings. One such story, told plainly, is a sign of candor. Look for a pattern across several answers before you decide.