Interviewers for internal audit roles test how you think, not only what you remember. Expect questions on risk-based planning, controls, sampling, scepticism and how you handle pushback, and answer each with a definition, a short example and the reason it matters. The model answers below are written to be adapted to your own experience.
Last reviewed: 17 October 2026. Facts checked. We searched for common internal audit interview themes. The results were interview-prep sites and posts, which point to risk-based planning, inherent and residual risk, design versus operating effectiveness, sampling and professional scepticism, and say interviewers look for reasoning more than memorised definitions. They are not authoritative and many target experienced candidates. We did not open a standard or a regulator page for this article. The answers are our own and use general audit concepts.
How to answer
Use a simple shape. Say what it is, give a one-line example, and say why it matters. Keep answers under a minute. If you do not know, say how you would find out.
Basics
1. What is internal audit, and how does it differ from statutory audit?
Model answer. Internal audit is an independent check for management and the board on whether processes and controls work. Statutory audit gives an opinion on the financial statements for shareholders. Internal audit covers the whole year and operations as well as finance. For example, internal audit may test whether goods are received before invoices are paid, while the statutory auditor tests whether the year-end payables balance is right. The two overlap, but their purpose and reader are different.
2. What is risk-based internal audit?
Model answer. It means putting audit time where the risk is highest, not auditing everything equally. You list the processes, score each for likelihood and impact, and plan more work on the high scores. See our guide to the risk assessment matrix.
3. What is the difference between inherent risk and residual risk?
Model answer. Inherent risk is the risk before controls. Residual risk is what is left after controls. If cash handling has a high inherent risk and a strong daily reconciliation, residual risk may be low. If the reconciliation is not done, residual stays high.
4. What is an internal control? Give examples.
Model answer. A control is an action that stops, finds or corrects a mistake or misuse. Preventive controls stop it, such as approval before payment. Detective controls find it, such as a monthly bank reconciliation. Corrective controls fix it, such as recovering a duplicate payment.
Testing
5. What is the difference between design and operating effectiveness?
Model answer. Design asks whether the control, if followed, would address the risk. Operating effectiveness asks whether it was followed over the period. A dual-approval rule is well designed, but if approvers sign without looking or one person approves for both, it does not operate.
6. How do you decide sample size?
Model answer. It depends on risk, how often the control runs and how many items there are. Higher risk and more items call for larger samples. I follow the firm's sampling guidance, and where data is available I prefer testing the full population with a script, because it removes sampling risk. I record why I chose the sample.
7. How would you test whether payments go to real vendors?
Model answer. I would compare the vendor master with a trusted source such as tax registration data, look for vendors sharing bank accounts or addresses with employees, check for vendors created and paid shortly after, and review who can change master data. This links to segregation of duties, because the person who creates a vendor should not release payment.
8. What is professional scepticism?
Model answer. It is a questioning mind that does not accept explanations without evidence. It does not mean assuming people are dishonest. If a manager says "we always check this", I ask to see last month's check.
9. What would you do if you find a possible fraud?
Model answer. Stop and do not confront anyone. Secure the evidence, note facts without drawing conclusions, and report to my reporting head right away, who escalates under the company's policy, often to the audit committee. I would not discuss it with the process owner or colleagues. Our guide to fraud risk assessment covers where to look.
Reporting and judgement
10. How do you write a good audit finding?
Model answer. I use four parts: condition (what I found), criteria (what should be), cause (why it happened) and effect (the risk or loss). Then I add a clear recommendation and the owner. The example: "Three of 25 payments lacked second approval (condition); policy requires two approvers (criteria); the system allows single release (cause); this exposes the company to unauthorised payment (effect)."
11. How would you rate a finding?
Model answer. I consider the likelihood that the issue causes loss and how big the loss could be, and whether other controls offset it. A finding where one control failed but another catches the problem is rated lower than one with no backup. I use the company's rating scale and explain the reasoning in the report.
12. Management disagrees with your finding. What do you do?
Model answer. I first check whether I got the facts right and listen to their reasons. If they give evidence I missed, I correct the finding. If the facts stand, I explain the evidence and risk calmly and record their response in the report with their action plan. I do not drop a valid finding because it is uncomfortable.
13. You have a short deadline and cannot finish all planned tests. What do you do?
Model answer. I tell my senior early, show what is done and what remains, and propose which tests carry the most risk. I do not skip tests silently or sign off work that is incomplete. The reduced scope is recorded in the working papers and report.
Preparing
- Pick one process, such as purchase-to-pay, and be ready to describe its steps, risks and controls. Our purchase-to-pay RCM checklist is a good start.
- Learn the audit committee's place in the structure: see audit committee in India.
- Practise one finding aloud using condition, criteria, cause, effect.
Frequently Asked Questions
What are the most common internal audit interview questions?
Expect questions on risk-based planning, inherent and residual risk, design versus operating effectiveness, sampling, how to write a finding and how to handle disagreement with management.
How should a fresher prepare?
Know the basic concepts well, learn one business process end to end, and practise explaining them with simple examples. Interviewers value clear thinking over memorised definitions.
Should I quote standards in my answers?
Only if you know them well. A clear plain-language answer is better than a wrongly quoted standard. If you mention one, be ready to explain it.
How do I answer if I do not know?
Say so, then explain how you would find out or reason through it. That shows judgement, which is what the interviewer is testing.
What do interviewers look for beyond technical knowledge?
Clear communication, tact with management, honesty about limits, and a habit of backing statements with evidence.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error