Auditor interview questions

I build the plan from risk and reporting obligations, then test it against people and timing before I commit it.

• I rank engagements by public-interest exposure, reporting deadlines, business change, prior findings, and technical complexity.
• I map partner, manager, specialist, and quality-review capacity to the periods when key judgments will be made, not just to fieldwork dates.
• I revisit the plan when risk changes, but I make the effect on quality, deadlines, and other engagements explicit before moving resources.

A balanced portfolio leaves enough experienced attention for the risk in each engagement instead of maximizing billable work.

• I look at complexity, deadline overlap, first-year clients, listed entities, and the amount of partner or specialist involvement each audit needs.
• I avoid concentrating the same scarce reviewer or technical expert across several critical milestones.
• I keep contingency capacity because an acquisition, restatement, or control issue can change an apparently manageable portfolio quickly.

I treat acceptance and continuance as a risk decision, not a sales approval.

• I assess management integrity, the reason for changing auditors, the reporting framework, regulatory exposure, and whether we can obtain the information we need.
• I confirm independence, competence, specialist needs, timetable, and fees are compatible with a quality audit.
• If risks cannot be reduced through clear conditions or added resources, I recommend declining or discontinuing the engagement.

The process should identify threats early, evaluate them consistently, and prevent work from starting until they are resolved.

• It covers financial interests, business and family relationships, non-audit services, overdue fees, employment discussions, and team rotation where required.
• I make every team member confirm independence and create a route for updating that confirmation when circumstances change.
• Any safeguard or conclusion is documented with the facts, applicable rule, consultation, and approval rather than a simple compliance checkbox.

I first establish whether we can serve both clients objectively and protect confidential information.

• I identify the parties, transaction, services, informed-consent requirements, and any legal or professional restrictions.
• Information barriers can address confidentiality, but they do not cure a prohibited conflict or an advocacy threat that is too significant.
• If the conflict cannot be reduced to an acceptable level, the firm must withdraw from or decline one of the engagements.

I would make the methodology drive a clear line from business risk to assertion, response, evidence, and conclusion.

• Core requirements should be standardized for risk assessment, significant risks, controls reliance, sampling, estimates, fraud, and completion.
• The methodology should allow tailoring by industry and engagement while requiring teams to explain why a standard procedure is not relevant.
• Templates and workflow should support judgment, not replace it, and recurring inspection findings should feed directly into methodology updates.

I calibrate the reasoning behind risk ratings rather than forcing every engagement into identical labels.

• Teams use common definitions for inherent risk, significant risk, relevant assertions, and reliance on controls.
• Portfolio reviews compare similar balances and industries so unexplained differences in risk or planned response become visible.
• I challenge weak links between the identified risk and the audit response, then preserve the rationale where facts genuinely differ.

I require materiality to reflect the users and economics of each entity, with portfolio review for consistency.

• The benchmark and percentage must fit the entity, so profit may be unsuitable for a volatile or loss-making business where revenue or assets matter more.
• Performance materiality reflects aggregation risk, control quality, and prior misstatements rather than a default percentage.
• Materiality is reassessed when actual results or circumstances change, and scope and testing are updated when the change matters.

I scope the group from where material misstatement could arise, not from a mechanical coverage target alone.

• I consider component size, specific risks, unusual transactions, control centralization, prior findings, and the degree of aggregation across locations.
• Each selected component gets a clear work scope, materiality, significant risks, reporting instructions, and expected evidence.
• I also test whether work at central functions and analytical procedures over remaining components closes the group-level evidence gap.

I revisit scope whenever new facts change the assessed risk or the evidence available.

• Common triggers are acquisitions, forecast deterioration, control failures, unexpected misstatements, system changes, or delays in receiving reliable data.
• I trace the new fact to affected assertions and components before adding or removing work.
• The revised plan, resource effect, and governance communication are documented promptly so the team is not working from an obsolete strategy.

I would organize the program around financial reporting risks and control ownership, not around a large inventory of controls.

• Entity-level, process, IT general, and automated controls are mapped to significant accounts, disclosures, assertions, and relevant systems.
• The program defines ownership, evidence standards, testing responsibilities, deficiency escalation, and a calendar that leaves time for remediation.
• Changes in systems, acquisitions, and process design pass through formal scoping and control-impact review during the year.

I decide based on internal audit's objectivity, competence, and disciplined approach, then match the extent of use to control risk.

• I evaluate reporting lines, performance assessment, training, supervision, documentation, and quality review of the internal audit function.
• Higher-judgment or higher-risk controls receive more direct external-auditor work even when the function is strong.
• I test selected internal-audit work and document exactly what reliance changes in our nature, timing, or extent of procedures.

I challenge whether each control addresses a real financial reporting risk before accepting more controls into scope.

• Duplicate, purely operational, and low-risk controls should not remain key controls just because they were tested last year.
• I favor precise controls with clear evidence and ownership over several broad controls that are difficult to evaluate.
• Rationalization is documented against risks and assertions so efficiency never becomes an unsupported reduction in coverage.

Both demand risk-responsive evidence, skepticism, supervision, and documentation, but I anchor the engagement in the standards and regulator that actually apply.

• For PCAOB audits I pay particular attention to integrated-audit requirements, critical audit matters, documentation, and recurring inspection themes.
• Under ISAs I apply the relevant group, quality management, going-concern, and key audit matter requirements in their jurisdictional context.
• I do not mix labels casually, because a sound procedure can still fail review if the applicable requirement and conclusion are unclear.

I build skepticism into the points where management evidence and judgment can most influence the conclusion.

• Planning identifies contradictory evidence, bias indicators, unusual transactions, and estimates that deserve explicit challenge.
• Reviews ask what evidence could disprove management's position, not only whether the file supports it.
• I reward well-founded challenge and escalation, so staff do not learn that meeting the deadline matters more than raising an uncomfortable issue.

I judge evidence against each assessed risk and assertion, considering both reliability and whether the evidence actually addresses the question.

• External, direct, and system-controlled evidence is generally stronger, but its source and the controls over its production still matter.
• More weak evidence does not compensate for evidence that is irrelevant or unreliable.
• At completion I look for unresolved contradictions and evidence gaps across workstreams before accepting the overall conclusion.

It identifies the firm's quality risks and assigns responses, ownership, monitoring, and remediation to each one.

• Governance, ethics, acceptance, people, engagement performance, resources, and information are connected rather than managed as separate policies.
• Quality objectives and indicators reveal whether controls operate, while inspections and root-cause analysis test the system's real outcomes.
• Deficiencies lead to accountable remediation with effectiveness testing, not just revised guidance sent to teams.

I place reviews before key decisions become expensive to reverse.

• Early reviews cover risk assessment, materiality, scope, planned reliance, and specialist involvement.
• Mid-engagement reviews focus on significant judgments, emerging misstatements, control findings, and whether evidence is changing the risk assessment.
• Completion review resolves contradictions and reporting matters, while routine work is reviewed close enough to execution for coaching to remain useful.

The team should consult when a significant or unfamiliar judgment exceeds the engagement's established expertise or has no clear authoritative answer.

• Typical triggers include novel transactions, difficult accounting interpretations, independence questions, reporting modifications, and disagreements on major conclusions.
• The consultation states the facts, alternatives, literature, and team's proposed view so the consultant can address a defined question.
• The team follows and documents the conclusion, including any facts that later require the consultation to be reopened.

An engagement quality review provides an objective evaluation of significant judgments before the report is released.

• The reviewer must have the competence, authority, time, and independence from the engagement needed to challenge the team.
• I identify the reviewer early and schedule involvement around planning, major judgments, and reporting rather than sending a finished file at the end.
• The report is not dated until required review procedures and concerns are complete and documented.