Most interview-prep content fails you in one of two ways: it lists questions with no sense of what the interviewer is actually listening for, or it hands you scripted answers that collapse the moment a real interviewer asks the second question. This bank is built differently. For every question you get three things: the question as it is actually asked, what the interviewer is really assessing (rarely the surface topic), and an answer architecture — the structure a strong answer follows, which you fill with your own material. Architectures survive follow-up questions; scripts die on contact.
Thirty-nine questions across five sections (the six most recent additions are in their own section below): twelve technical fundamentals, eight scenario questions (“you find X — what do you do”), eight behavioral probes mapped to the competencies audit teams actually hire for, and the five questions that change when you interview at senior level. One more thing that makes this bank different: nearly every technical question links the guide on this site that teaches the underlying topic properly — so your study list assembles itself as you read. This is the anchor of our Interview Lab, alongside manager and director interviews, the CAE panel, the case study round, and the questions you should be asking them.
In this guide
- How audit interviews actually evaluate — and what an answer architecture is
- Technical fundamentals (12 questions)
- Scenario questions (8)
- Behavioral probes, mapped to competencies (8)
- What changes at senior level (5)
- The preparation protocol: five stories and a mock loop
- Six questions that have joined the bank since 2024
- What loses offers
- The 48-hour preparation plan
- How the bank changes by employer type
- Panel, video and test formats
- Frequently asked questions
How audit interviews actually evaluate — and what an answer architecture is
Audit interviewers are not grading trivia recall — they can teach you definitions in a week. They are testing four things through every question: do you think in risk (can you tell what matters from what doesn’t), do you respect evidence (is “someone told me” ever enough for you), can you hold a position under pressure (the profession’s entire value depends on it), and can you communicate to someone busier than you. Every architecture in this bank is built to display one or more of those four — which is also why the worst interview strategy is memorizing model answers: interviewers probe one level deeper on purpose, and a candidate who can extend their answer under the follow-up shows the thinking; one who can’t shows the memorization. An architecture is simply the load-bearing structure: the two or three moves a strong answer makes, in order. Learn the moves, supply your own content, and the follow-ups become the easiest part of the interview.
Technical fundamentals (12 questions)
Where the guide column shows a link, that page teaches the topic at working depth — the study list assembles itself:
| The question | What they’re really assessing | The answer architecture |
|---|---|---|
| 1. What’s the difference between inherent and residual risk? | Whether you think in controls at all | Define both in one breath, then show the move: inherent tells you where controls must exist, residual tells you what’s left to worry about — land it with one concrete example. Study: risk assessment |
| 2. Preventive vs. detective controls — when do you want each? | Design sense, not vocabulary | Definitions in a sentence, then the doctrine: prevent first, detect always — and one process shown in layers. Study: the taxonomy with 50 examples |
| 3. What makes audit evidence strong? | Your relationship with proof | The hierarchy — independent source beats internal, documentary beats verbal, auditor-obtained beats provided — then the corroboration rule: an explanation is a claim, and claims get verified. Study: audit evidence |
| 4. How would you decide a sample size? | Judgment vs. formula-fetching | Anchor on control frequency and assurance sought, name the standard grids as the starting point, then the modern kicker: when the data allows, test the full population instead. Study: sample sizes |
| 5. What is segregation of duties, and why does it matter? | Fraud-prevention fundamentals | The four function types (authorization, custody, recording, reconciliation), one toxic pair with the fraud it enables, and the small-team reality: compensating controls when separation is impossible. Study: SoD framework |
| 6. Design vs. operating effectiveness? | Methodology precision | Could it work vs. did it work — then prove you know the practical difference: a walkthrough or test-of-one settles design; samples over the period settle operation. Study: TOD vs. TOE |
| 7. What would you check before relying on a system report? | The question that separates studied candidates — IPE instinct | Source, logic, parameters — and the direction rule: accuracy traces report-to-source, completeness needs an anchor outside the report. Study: IPE testing |
| 8. Walk me through the five C’s of a finding. | Reporting craft | Name them — criteria, condition, cause, consequence, corrective action — then the insight that upgrades the answer: cause is the one that drives the recommendation, and restating the condition as the cause is the classic failure. Study: the five C’s |
| 9. What’s a management review control, and why are they hard to audit? | Currency with real practice | A control whose operation is judgment — so the questions become precision (thresholds, disaggregation) and evidence (a signature proves presence, not review). Study: MRCs |
| 10. How do ITGCs relate to application controls? | IT literacy — non-negotiable now | The reliance chain: an automated control is only as good as the access and change management beneath it, which is what lets you test it once and rely. Study: ITGC vs. application controls |
| 11. What is a walkthrough, and what can’t it prove? | Knowing the limits of procedures | One transaction end-to-end confirms understanding and design — and cannot prove operating effectiveness, because one instance is not a period. Bonus point for saying what it’s best at: finding the gap between the documented process and the real one |
| 12. Where does internal audit’s independence actually come from? | Whether you understand the profession’s architecture | Structure, not personality: functional reporting to the audit committee, the charter’s authority, and the CAE’s protected position — then the personal layer: objectivity safeguards per engagement. Study: Domain III |
Scenario questions (8)
Scenario questions test judgment in motion. The universal architecture: verify the facts → act within your role → escalate through the right channel → document. Watch how it flexes:
| The scenario | What they’re really assessing | The strong answer’s moves |
|---|---|---|
| 1. Two of your twenty-five sampled approvals are missing. What now? | Method under exception — do you panic, hide, or process? | Verify they’re true deviations (approval elsewhere? alternate per procedure?), dig the root cause, then the fork: extend testing or accept and evaluate the finding — and say the words “I would not conclude effective on this sample” |
| 2. The auditee says “we’ve always done it this way — last year’s auditors had no issue.” | Courage with grace | Acknowledge without conceding, anchor to the criteria (“the policy requires X — let’s look together”), test anyway, and if blocked, escalate rather than argue |
| 3. Mid-audit, you notice something serious — outside your scope. | Scope discipline vs. tunnel vision | Never chase it silently and never ignore it: flag to the lead same-day, let the scope-change decision happen at the right level, document what you saw |
| 4. A VP calls your manager asking to soften your finding’s wording. | Where your spine is | Facts and ratings are not negotiable; tone is. Offer the accuracy conversation, hold the substance, and trust the escalation chain — pressure on conclusions goes up, not away |
| 5. You suspect fraud during fieldwork. | Protocol over heroics | Stop expanding on your own, preserve what you have, escalate per the fraud-response protocol — investigation belongs to trained people with counsel involved. Study: the red-flags discipline |
| 6. Two days left, three tests open. | Prioritization and honesty | Risk-rank what remains, flag early with options (extend, descope with disclosure, add hands) — the one forbidden move is quietly shrinking the work |
| 7. Your data request is three weeks late and half-complete. | Resourcefulness inside process | Escalate through the agreed channel, find alternative sources for what can’t wait, and document the delay’s impact on the timeline — friction is normal; silence about friction is not |
| 8. The auditee’s verbal explanation would close your exception. | Skepticism as habit | The explanation is a lead, not a resolution: corroborate it (“timing” is checkable by definition — it reverses), and close only on evidence |
Behavioral probes, mapped to competencies (8)
Use STAR-L — situation, task, action, result, plus the learning, which is what separates a story from a lesson. Each probe below maps to the competency it’s mining:
| “Tell me about a time you…” | Competency being mined | What the strong story contains |
|---|---|---|
| 1. …disagreed with your senior’s conclusion | Evidence-based courage | You disagreed with evidence, not opinion; you changed the outcome or accepted the call gracefully; the relationship survived |
| 2. …made a real mistake in your work | Integrity | Fast self-report, clean correction, root cause on yourself, and the habit that changed — interviewers distrust candidates with no mistake story |
| 3. …got what you needed from an uncooperative person | Stakeholder craft | You sought their constraint first (empathy as tactic), adjusted the ask, and escalated only after exhausting the direct route |
| 4. …explained something complex to a non-expert | Communication altitude | You started from their decision, not your analysis — and the proof: they acted on it |
| 5. …balanced competing deadlines | Prioritization under load | An actual ranking logic (risk, dependency, stakeholder cost) plus early communication — not “I worked weekends” |
| 6. …got up to speed on an unfamiliar area fast | Learning agility | A repeatable method — process docs, a walkthrough, an hour with the expert, then testing your own understanding — not talent mythology |
| 7. …held a position under pressure to change it | Professional courage — now literally Standard 1.1 | The pressure named, the facts held, the tone flexed, the outcome owned; bonus credibility for knowing courage is a written standard now |
| 8. …delivered unwelcome news | Directness with empathy | No surprises — the news traveled early, in person, with options attached; the recipient stayed a working partner |
What changes at senior level (5)
Senior interviews reuse everything above with harder follow-ups — and add five questions about leading the work. “How do you review someone else’s workpaper?” — they want a method: evidence chains checked, conclusions supported, stand-alone standard applied, and review notes that teach rather than just correct. “Walk me through an audit you ran end-to-end.” — the architecture is the engagement arc: risk assessment → scope and criteria → program → fieldwork → findings → report → follow-up, told with one real complication and how you handled it. “A strong junior is drowning — what do you do?” — diagnose before rescuing: skill gap, load problem, or confidence; then the specific intervention. “How do you scope an engagement?” — start from what could go wrong (the risk lens), not from last year’s file. “An exit meeting turns hostile — walk me through it.” — separate heat from substance, concede genuine fact corrections instantly, hold ratings calmly, and know your escalation line before the meeting starts.
The preparation protocol: five stories and a mock loop
You do not need thirty-nine rehearsed answers. You need five true stories, well-chosen, because five cover essentially every behavioral probe: a conflict you handled, a mistake you owned, a deadline you managed, something complex you explained, something hard you learned fast. Write each as STAR-L bullets (never scripts), then practice mapping — any behavioral question above should route to one of your five within seconds. For the technical bank: read the linked guides, then have someone fire follow-ups at you (“why?”, “what if the data isn’t available?”, “give me an example”) — the follow-up drill is the whole game, because that is where interviews are actually decided. Two mock loops with a skeptical friend beat twenty hours of silent review. And prepare the reverse direction too — the questions you ask are scored as hard as the answers you give: here is that list.
Final thoughts
Interviews reward the same four things the job does: risk thinking, evidence discipline, steadiness under pressure, and clear communication. Learn the architectures, load your five stories, study the linked guides — they were written to working depth precisely so a candidate who reads them can talk like a practitioner — and walk in ready for the follow-up question, because that is the one that gets you hired.
The Interview Lab: manager and director interviews · interviewing for CAE · the case study round · questions to ask your interviewer.
Six questions that have joined the bank since 2024
Interview banks age. The 33 questions above are evergreen; the six below have appeared in staff and senior interviews at most functions since the 2024 Standards took effect and analytics and AI moved from specialism to expectation. Treat them as technical fundamentals with a shorter history, and notice that the architecture for each still displays one of the four things interviewers test.
| The question | What they’re really assessing | The answer architecture |
|---|---|---|
| 34. What changed in the 2024 Global Internal Audit Standards, and what does it mean for your work? | Currency with the profession; whether you read | Name the structure (five domains, fifteen principles) and two changes that touch a staff auditor’s day: engagement documentation and supervision requirements made explicit, and professional courage written into the ethics domain; then one implication for your own files. Study: GIAS 2024, what changed |
| 35. How would you use data analytics in a control test? | Whether analytics is a tool you reach for or a word you know | The full-population move: when the data allows, test every item instead of sampling, and treat the exceptions as the sample; then the discipline that goes with it: documented completeness of the extract, and the query saved as evidence. Study: audit data analytics |
| 36. What would you check before relying on an AI-assisted process or output? | IT literacy extended to the current decade | Treat it as a system report with extra questions: what data it was built on, how its output is monitored, who owns it, what the human review actually reviews; and the auditor’s own version: never paste confidential evidence into a public tool. Study: auditing agentic AI and writing audit reports with AI |
| 37. How do you audit a third party you cannot visit? | Resourcefulness and knowledge of the topical requirement | The reliance chain: contract terms, the provider’s assurance reports (and their scope limitations), the organisation’s own monitoring controls, and the exit plan; name the IIA’s third-party topical requirement as the framework now in force |
| 38. A control is automated. What do you test? | Whether you understand reliance on ITGCs | Test the configuration once (test of one) and then the general controls that keep it unchanged: change management and access; a change in either reopens the conclusion. Study: the ITGC primer |
| 39. How would you handle confidential information you saw during fieldwork that is unrelated to the audit? | Ethics in practice, not in the abstract | The confidentiality principle applied: you use information only for the engagement, you do not discuss it, and if it suggests misconduct you escalate through the protocol rather than acting on it yourself |
What loses offers: the answer patterns interviewers mark down
Candidates rarely lose audit interviews on knowledge. They lose on patterns in how they answer, which interviewers notice within three questions and then test for deliberately. Eight patterns, each with the signal it sends and the repair.
| Pattern | How it sounds | What the interviewer concludes | Repair |
|---|---|---|---|
| The script | Fluent model answer; collapse on the first follow-up | Memorised, not understood | Learn architectures and your own examples; invite the follow-up |
| The hedge | “It depends” with no statement of what it depends on | Cannot commit to a position | Say what it depends on and then take a position for the common case |
| The hero | Every story ends with the candidate being right and everyone else wrong | Will be a management problem | Include the story where you were wrong and what changed |
| The passenger | Stories in which things happened to the candidate; no decisions | Will not own anything | Name the decision you made and the alternative you rejected |
| The reciter | Standards numbers and definitions with no example | Knows the words, not the work | One concrete instance per concept |
| The flatterer | Agrees with every premise the interviewer offers, including the wrong ones | Will not hold a finding under pressure | Disagree once, politely, with evidence, when the premise is wrong |
| The complainer | Former employers, auditees and managers described as obstacles | Will describe this firm the same way | Describe constraints neutrally and what you did inside them |
| The volume answer | Four minutes per question; the interviewer stops taking notes | Cannot communicate to someone busier | Answer in sixty to ninety seconds and offer depth |
The flatterer pattern is the one specific to this profession. Interviewers often plant a wrong premise (“so a signed approval proves the control operated”) precisely to see whether the candidate corrects it. The escalation ladder guide describes the behaviour the question is probing for at full scale: holding a position with evidence, at the right level, in the right tone.
The 48-hour preparation plan
The preparation protocol above tells you what to prepare. With two days to an interview, this is the order to do it in, with the time each step deserves. The plan assumes a staff or senior interview of sixty to ninety minutes with one technical and one behavioural interviewer; adjust the technical block upward for an IT audit or data-focused role.
| When | Step | Time | Output |
|---|---|---|---|
| Day 1, morning | Read the job description and map each requirement to one of your five stories or to a technical topic in this bank | 45 minutes | A one-page map: requirement, story or topic, guide to read |
| Day 1, morning | Research the function: size, reporting line, SOX share, recent news about the organisation; read the day in the life guide if the role type is new to you | 45 minutes | Three facts to use and three questions to ask |
| Day 1, afternoon | Write your five stories as STAR-L bullets; check that each has a decision, a number and a lesson | 90 minutes | Five stories, one page |
| Day 1, afternoon | Technical refresh: read the linked guides for the questions you could not answer cold; skip the ones you can | 2 hours | Notes on three to five topics |
| Day 1, evening | Prepare your questions for them, including the two that reveal the function’s standing | 30 minutes | Six questions, ranked |
| Day 2, morning | Mock loop one: a friend fires fifteen questions from the bank with follow-ups; record it | 60 minutes | A list of the answers that wobbled |
| Day 2, midday | Repair the wobbles: rewrite the architecture for each, aloud | 60 minutes | Revised answers |
| Day 2, afternoon | Mock loop two, shorter, with the scenario questions only | 30 minutes | Confidence on the scenarios |
| Day 2, evening | Logistics, documents, the resume you submitted (reread it; they will quote it), and stop | 30 minutes | Nothing new; rest |
The plan allocates more time to the stories and the mock loops than to technical reading, which surprises candidates who prepare by rereading textbooks. The reason is in the first section: interviewers can teach definitions in a week; they cannot teach judgment, and judgment is displayed in stories and in follow-ups. If the resume you submitted makes a claim, expect to be asked for the story behind it; the mock loops should include those claims.
How the bank changes by employer type
The 39 questions are asked everywhere, but the weighting shifts with the kind of function, and knowing the shift tells you where to spend the technical block of the plan. The Big Four vs industry guide covers the career difference; this is the interview difference.
| Employer type | Heavier weighting | Lighter weighting | A question to expect |
|---|---|---|---|
| Big Four internal audit services | Methodology precision; SOX and ICFR; client-handling scenarios; travel and utilisation tolerance | Deep knowledge of one industry | “How would you explain a deficiency classification to a client controller who disagrees?” |
| Listed industrial or consumer company | SOX fundamentals; operational audit judgment; working with plant and commercial people | Regulatory frameworks beyond SOX | “Walk me through an inventory count observation and what could go wrong with it.” |
| Bank or insurer | Regulatory knowledge; issue validation; conduct and compliance risk; the supervisory relationship | Pure financial-statement topics | “What is an MRA and what is audit’s role in closing one?” See the banking guide |
| Technology company | ITGCs, cloud and access; SOX in a fast-changing environment; analytics fluency | Traditional operational audit | “The company deploys code daily. How do you test change management?” |
| Government or public sector | Yellow Book or local equivalents; performance audit; value-for-money reasoning; stakeholder breadth | Commercial fraud schemes | “How is a performance audit different from a compliance audit, and how do you set criteria?” |
| Small or new function | Breadth; self-direction; building methodology; stakeholder courage without a large team behind you | Narrow specialism | “Nobody has audited procurement here. How would you start?” |
Panel, video and test formats: what changes
The bank assumes a conversation with one or two interviewers. Three other formats are common, and each changes how the same answers land.
| Format | What changes | Adjustment | Trap |
|---|---|---|---|
| Panel of three to five | Different interviewers score different dimensions; the technical interviewer and the people interviewer want different answers to the same story | Address the asker, then bring one other panellist in with a glance; keep answers at ninety seconds so every scorer gets material | Playing to the most senior person in the room and losing the others’ scores |
| Video interview | Tone and energy carry less; pauses read as uncertainty; notes are allowed and visible | Sit higher, slow down slightly, keep the five stories on one printed page below the camera; test the connection with the recruiter’s platform the day before | Reading answers; the eye movement is obvious |
| Recorded one-way interview | No follow-ups, so the architecture must carry the depth itself | State the architecture explicitly (“three things: …”), give one example per point, finish inside the time limit with a sentence of summary | Filling the full time because it is available |
| Technical or case test | A sampling exercise, an Excel test, a short case with a control failure to analyse, or a writing sample | Show the working: population, method, computation, conclusion, as in a workpaper; see the workpaper example for the structure examiners reward | Producing an answer with no visible method |
Whatever the format, the follow-up after the interview is the same: a short message within a day to the recruiter or the lead interviewer, thanking them, naming one thing from the conversation that interested you, and confirming your availability for the next step. It is read, it is rarely sent by the other candidates, and it should be three sentences long. If a decision date was promised and passes, one further message a week later is reasonable; a third is not. Silence after that is an answer, and the next interview in the pipeline deserves the attention.
Frequently asked questions
What questions are asked in an internal audit interview?
Four kinds: technical fundamentals (inherent and residual risk, preventive and detective controls, evidence, sampling, segregation of duties, design versus operating effectiveness, IPE, the five C’s, management review controls, ITGCs, walkthroughs, independence, plus newer questions on the 2024 Standards, analytics, AI and third parties); scenario questions testing judgment in motion; behavioural probes mapped to competencies; and, at senior level, questions about reviewing and leading work.
How should I answer “tell me about a time” questions in an audit interview?
With STAR-L: situation, task, action, result and the learning. Five true stories (a conflict, a mistake, a deadline, a complex explanation, a fast learning curve) cover nearly every behavioural probe. Each story needs a decision you made, a number and a lesson; interviewers distrust candidates who have no mistake story.
What do internal audit interviewers look for?
Four things, through every question: whether you think in risk, whether you respect evidence, whether you can hold a position under pressure and whether you can communicate to someone busier than you. Memorised answers display none of them; follow-up questions are where interviews are decided.
How do I prepare for an internal audit interview in two days?
Map the job description to your stories and the technical topics, write five STAR-L stories, refresh only the technical topics you cannot answer cold, prepare six questions to ask, and run two mock loops with someone who fires follow-ups. Spend more time on stories and mock loops than on reading.
What should I ask the interviewer in an internal audit interview?
Questions that reveal the function’s standing and what the job will actually be: why the role is open, how the budget conversation goes, when the last external quality assessment was, how often the CAE meets the committee privately, the SOX-versus-operational mix, where recent leavers went, and what would make your first year a failure in their eyes.
Are internal audit interview questions different for IT audit roles?
The behavioural and scenario layers are the same; the technical block shifts toward ITGCs, access and change management, cloud and SaaS controls, the reliance chain between general and application controls, and analytics. Expect to be asked how you would test change management in an environment that deploys code daily.
Related guides
- Internal audit resume guide — impact bullets, ATS and three rewrites.
- What does an internal auditor do? — the job description level by level, with pay and hours.
- Audit manager and director interviews — the questions that test leadership judgment.
- A day in the life of an internal auditor — what the job is actually like, hour by hour.
- Big Four vs industry internal audit — how the two paths differ and how to choose.
- Is internal audit a dead end? — where the career leads, with evidence.
- The internal audit career ladder — staff to CAE, level by level.
- Global Internal Audit Standards 2024: what changed — the Standards knowledge interviewers now expect.
Leave a Reply