Interview guides

Internal Auditors and Risk Advisors

Evaluate analytical thinkers skilled in risk, compliance, and ethics.

Case Scenarios

SCENARIO 1:

A new manager was hired in a department that was resistant to internal audit suggestions. You have been assigned to complete an audit in that department. How would you approach the new manager? How could you convince the new manager that internal audits exist to help improve their operations and not to be the bad guy?

SCENARIO 2:

A new entry-level Internal Auditor has been assigned to complete an assignment reviewing employee expenses. They are an entry-level auditor who began with the company only three months ago. On the other hand, you have extensive experience in the area. Currently, your workload takes up all of your available time. How would you go about assisting this person in completing their assignment?

SCENARIO 3:

The Internal Audit Department just received a new automated auditing software package. Software training is scheduled in four weeks for the staff. No one has any knowledge of how to use it but the software provides many features that will make documenting easier. The software provides help menus to assist with every function. Your manager has mentioned it would be helpful if everyone could spend some time making themselves familiar with the software. You have just been assigned a new audit project that requires a tremendous amount of documentation and the audit will take approximately six months to complete. Explain how you would go about handling this audit. Would you complete the audit using the old method or attempt to use the new software (Initiative/Computer Skills)?

SCENARIO 4:

Being an internal auditor requires a lot of interaction with internal customers. While auditing the commission’s area of the company, you found that the commission’s accounts were not being reconciled and the last date of reconciliation could not be determined. Further review revealed that the commission’s area hired a new manager approximately six months ago and most of the employees had less than one year of experience in the area. As a senior internal auditor having audited the commission’s accounts several times in the past five years, how would you handle this situation? The new manager requests that you train his staff on how to reconcile the accounts. How would you go about accomplishing this?

SCENARIO 5:

You are doing a procurement audit where three quotes are required for all temporary help services over $5,000. You find numerous examples of non-compliance with the policy and you raise the issue with management. You are told the policy is onerous and requires a lot of time and work to comply with. The manager explains she is short-staffed and that sometimes emergencies come up making temporary help an urgent matter. In these cases, compliance with the policy is impossible. What further work would you do to analyze this situation? Would you report on the non-compliance issue or would you take a different approach?

Internal Auditors & Risk Advisors Initial Questions

Career Path & Motivation

  • Identify the types of auditing/advisory work you have done in your career. (Performance/Value for Money Audits; IT Audits; Financial Audits; Legislative Auditing; Risk-Based Audits; Program Evaluations; Control Risk Self-Assessments; Investigations; Compliance Audits; Other).
  • Describe your audit experience starting with your first role to the present.
  • Can you highlight the type of auditing you enjoyed most and which ones were less appealing? Why?
  • Can you explain how you became an internal auditor and why you enjoy it?
  • How does your academic background relate to internal auditing?

Work Environment & Team Experience

  • Do you have experience working in a unionized environment?
  • What is the largest internal audit group you’ve worked with, and the smallest? Which did you prefer?
  • How did your previous audit functions operate in relation to Senior Management and the Board?
  • Did you have obstacles working with any one group? How did you resolve them?
  • How was Internal Audit perceived in organizations you’ve worked for?

Future Outlook & Value

  • What do you think the greatest possibilities are for Internal Auditors of the future?
  • What one step would you take to make the Internal Audit function more effective?
  • How could your role in internal audit add value to our organization?
  • What are you looking for in this role?
Personal Competencies

Professional Judgment

  • Please share your perspective on: "Internal Audit is more an art than a science.”
  • How would you handle an investigation of a trusted accounting employee who falsified statements?

Collaboration & Conflict

  • You are auditing a department where employees are unhelpful and delay information. What would you do?
  • How would you respond to a peer preventing your team from completing its project?
  • Describe a group work situation with conflict. How did you resolve it?

Client Relationships & Trust

  • How would you describe your relationship with audit clients? Positive or resistant?
  • What strategies did you use to build trust with clients?
  • What techniques did you use to help management find practical solutions?

Leadership & Initiative

  • Describe an experience where you had to take charge and resolve a difficult situation.
  • What steps did you take and what was the outcome?
Soft Skills for Internal Auditors & Risk Advisors
  • How do you build trust with stakeholders while maintaining independence?
  • Give an example of explaining a complex audit finding in plain language to non-financial leaders.
  • How do you balance skepticism with collaboration when auditing business units?
  • Describe a time you had to deliver difficult feedback to senior management. How did you frame it?
  • How do you handle stress during high-pressure audits or regulatory reviews?
  • Share an example of showing resilience when facing organizational resistance to audit recommendations.
  • How do you ensure equity, diversity, and inclusion principles are considered in audits or risk reviews?
Specialty Audit Technical Questions

IT Audit

  • Please describe your IT audit experience.
  • What reviews have you been involved with and what key issues did you identify?
  • Do you have experience with IT Governance reviews? Outcomes?
  • What are the most significant IT risks today? Describe your audit experience in this context.
  • Do you have experience using the COBIT Framework? How did you apply it?
  • Do you have experience auditing or advising on cybersecurity risk?

Risk Advisory Services

  • Have you facilitated a Control Risk Self-Assessment workshop? How did you approach it? Was it successful?
  • Have you worked with management to identify risks as an advisory service? Did this compromise independence?
  • What limits do you think are appropriate when providing advisory services?

Financial Institutions

  • Do you have experience with SOX audits? What was your involvement?
  • What Risk and Control frameworks have you used for SOX reviews?
  • Was your experience limited to financial reporting controls or did you expand to operational reporting?

Performance / Value-for-Money Audits

  • Have you done any Value for Money or Performance Audits? Can you describe the work you did and the results?
  • Do you have experience working with a Legislative Audit Function (Auditor General Model)? If so, what level of government was it (Federal, Provincial, Municipal)?
  • Do you follow any methodology or model when performing a performance/value for money/legislative audit (“Yellow Book” Government Audit Standard, INTOSAI Standard)? These audits are usually more prominent in the Public Sector although the Private Sector performs more using the Basel III model (Operational Risk component). Operational auditing is a term used to describe audits that review effectiveness, efficiency and economy of operations.

Program Evaluations

  • Do you have experience performing program evaluations? How did you approach them?
  • What frameworks or standards did you follow?
  • “Program Evaluations should not be done by Internal Auditors.” What’s your perspective? What risks exist?
Technical Components

Frameworks & Standards

  • Are you familiar with the International Professional Practices Framework (IPPF)?
  • How well did your past organizations measure up against IPPF or other professional standards?
  • Did you suggest improvements to audit operations?

Audit Approach & Methodology

  • Can you describe how you approached each audit assignment? Were you given a program to execute or did you develop your own work plan?
  • Did you conduct audits mostly on your own or as part of a team?
  • Describe how you would perform a work plan risk assessment. Where would you start?
  • Once completed, how would you validate the results?

Reporting & Communication

  • When writing your audit report, what information must be on the first page?
  • “Communication and audit report writing is the same.” Do you think this is true? Why or why not?

Technology & Tools

  • What computer programs or applications do you prefer for audit engagements?
  • Have you used data analytic software? How did you apply it and how did it add value?

Problem Solving & Time Management

  • If you had to audit an area with little prior experience, how would you prepare?
  • Describe a situation where you missed a deadline. How did you handle it?
  • What do you think of the statement: “Up to 60% of an audit project is spent on planning.” Too much, too little, or just right?
  • How do you keep up to date on emerging risks and issues?
  • Describe a situation where you had to learn a large amount of material quickly.
  • Suppose you arrive at work with a full schedule and get two urgent requests by early morning. How would you cope?
  • Tell me about the most difficult work problem you faced. How did you handle it?
Technology & AI in Internal Audit

Data Analytics & Automation

  • What data analytics tools (ACL, IDEA, Power BI, Tableau, Alteryx) have you used in audits?
  • Have you leveraged robotic process automation (RPA) for testing transactions?
  • How do you use continuous monitoring dashboards for risk identification?

AI & Emerging Tech

  • Have you worked with AI-driven risk assessments or anomaly detection?
  • How do you see AI transforming audit planning and execution?
  • What are the ethical risks of using AI in audits? How would you mitigate them?

Cybersecurity & Digital Risk

  • What’s your experience auditing cybersecurity frameworks (NIST, ISO 27001)?
  • How do you assess risks related to cloud platforms, remote work, or data privacy (GDPR, CPPA)?

Future-Oriented Risk Advisory

  • How do you evaluate ESG (Environmental, Social, Governance) risks as part of risk advisory?
  • How do you prepare organizations for emerging risks (AI bias, digital fraud, supply chain disruption)?
  • What role do you think internal audit should play in advising on AI governance?

Your next role starts here.