Internal Auditor Interview Questions and Scorecard
Internal auditor interview questions for small businesses: 6 sets covering controls, risk, independence, and fraud, plus a scorecard. Download as DOCX.
Internal Auditor Interview Questions and Scorecard
40 interviewer questions across five competencies, each with what a strong answer sounds like, plus a 1-to-5 scorecard, a red-flag list, and an independence checklist. Built for companies hiring without an HR department. Download as DOCX.
An internal auditor is the one hire whose job is to disagree with you. Every other role you fill is measured on how well it supports the plan; this one is measured on how honestly it reports what the plan is actually producing. That flips the interview on its head, because the qualities you most need, independence and the nerve to write down an uncomfortable finding, are the ones a candidate can perform beautifully in a room and abandon the first time a department head pushes back.
At FirstHR, we build for companies that hire without an HR department, where the owner or the finance lead runs the whole interview between everything else. This page gives you 40 interviewer questions grouped into five competencies, each with a note on what a strong answer sounds like, plus a scorecard, a red-flag list, and an independence checklist you can download and reuse for every candidate.
Interview an internal auditor on five things: controls and methodology, risk assessment and planning, independence and ethics, fraud and findings, and behavioral evidence. Ask every candidate the same questions, then score each area 1 to 5 on the rubric. The pay anchor is a median of $83,680 (BLS, May 2025). Download 40 questions and the scorecard as DOCX.
What to Assess in an Internal Auditor
Assess four things, in this order: independence, risk judgment, technical audit skill, and communication. Technical skill is the easiest to verify and the least likely to be the reason a hire fails. Independence is the hardest to verify and the most common point of failure, which is why it deserves the most interview time rather than a single closing question.
Independence here is not a personality trait. It is structural: who the auditor reports to functionally, whether they own any of the processes they review, and whether a disputed finding has a defined path upward. A candidate who understands that distinction will ask you about your reporting line during the interview, which is one of the better signals you can get.
Technical audit skill
Tests a control end to end and says why
Explains sampling in plain language
Documents work another auditor could repeat
Risk judgment
Ranks risks against business objectives
Builds a first-year plan that fits your size
Reprioritizes openly instead of quietly
Independence
Discloses conflicts without being asked
Has held a finding under real pressure
Understands the functional reporting line
Communication
Writes findings with an owner and a date
Explains a weakness to a non-accountant
Gets fixes agreed rather than imposed
Certifications such as the CIA, CPA, CISA, or CFE tell you someone completed a body of training, and they are worth listing as preferred. They are not evidence of judgment. Score the answers, not the letters, and treat a certified candidate who cannot describe a single finding they held under pressure exactly as you would an uncertified one.
The Six Question Sets
The 40 questions below are grouped into five competencies plus a scorecard. Each set stands on its own, so you can run a short screening interview from one set and a full interview from all five. A strong candidate should hold up across every set, not just the technical ones they have rehearsed.
Controls and Methodology
Can they run an audit?
Control testing, sampling, compensating controls, and workpaper documentation, each with a note on what a strong answer sounds like.
Risk and Audit Planning
Where do the hours go?
How they build an annual plan, scope an engagement, rank risks, and handle a request that is not on the plan.
Independence and Ethics
The set that decides it
Reporting lines, conflicts of interest, and what happens when a senior leader wants a finding softened or dropped.
Fraud and Findings
The uncomfortable part
The first hour after suspected fraud, writing findings that get fixed, blocked access, and tracking remediation to closure.
Behavioral and Situational
STAR evidence
Past examples scored on Situation, Task, Action, and Result: a wrong finding, bad news delivered upward, a clean audit.
Scorecard and Red Flags
Rate and decide
A 1-to-5 rubric across six areas, a red-flag checklist, and an independence checklist for the role itself.
Do Not Skip the Independence Set
Candidates arrive prepared for methodology questions and behavioral questions, because those are what the candidate-facing lists drill. The set that actually separates people is independence and ethics, where a rehearsed answer runs out within two follow-ups. Ask all eight of those questions, ask for a name and an outcome every time, and use the scorecard so a polished technical answer does not paper over a weak one on conflicts.
40 Questions and a Scorecard to Download
Download all six as one Word document, or copy the individual sets you need. Each set follows the same structure: why it exists, the questions with notes on what a strong answer sounds like, what to listen for, and space for notes. The final file is the scorecard with the red-flag and independence checklists.
Download All 6 Internal Auditor Question Sets
Controls, risk and planning, independence, fraud and findings, behavioral, plus a scorecard with red flags. All in one DOCX.
Set 1: Internal Controls and Audit Methodology
Whether the candidate can actually run an audit: testing a control end to end, sampling, compensating controls, and documentation another auditor could repeat a year later.
Internal Controls and Audit Methodology Questions
INTERNAL AUDITOR INTERVIEW: CONTROLS AND AUDIT METHODOLOGY
Candidate: __
Company: __
Interviewer: __
Date: _
WHY THIS SET
This set tests whether the candidate can actually run an audit rather than talk
about one. Every question below has a note on what a strong answer sounds like,
so a founder or finance lead can judge the technical depth without being an
auditor. Ask five to eight of these, then score on the rubric in Set 6.
QUESTIONS TO ASK
1. Walk me through how you test a single control, start to finish.
(Strong answer: understand the control, confirm it is designed to address a
real risk, pick a sample, test operation, document the evidence, conclude.)
2. What is the difference between a design failure and an operating failure?
(Strong answer: a design failure means the control would not catch the risk
even if performed perfectly; an operating failure means it exists but was not
performed. The fix is different for each.)
3. How do you decide how many items to sample when you test a control?
(Strong answer: ties sample size to frequency, risk, and population, and can
explain the reasoning in plain language rather than quoting a table.)
4. Which control frameworks have you worked with, and how did you apply one?
(Strong answer: names a framework and describes using it to structure real
work, not just to cite it in a report.)
5. How would you test segregation of duties on a finance team of four people?
(Strong answer: accepts that full separation is impossible at that size and
proposes compensating controls plus owner review, rather than writing an
unusable finding.)
6. What is a compensating control, and when would you accept one?
7. How do you document work so another auditor could repeat it a year later?
(Strong answer: describes a workpaper that states the objective, the
population, the sample, the evidence, and the conclusion.)
8. Tell me about a workpaper you are proud of and why it held up to review.
WHAT TO LISTEN FOR
•Plain-language explanations, not framework jargon on its own
•A repeatable method rather than a case-by-case improvisation
•Practical judgment about what is testable at your company size
•Evidence and documentation habits that would survive an external review
NOTES
__
__
Set 2: Risk Assessment and Audit Planning
Where the limited hours go. Building an annual plan, scoping one engagement, ranking risks, and handling the request that arrives outside the plan.
Risk Assessment and Audit Planning Questions
INTERNAL AUDITOR INTERVIEW: RISK ASSESSMENT AND AUDIT PLANNING
Candidate: __
Company: __
Interviewer: __
WHY THIS SET
An internal auditor cannot audit everything, so the plan is the job. This set
tells you whether the candidate can point limited hours at the risks that matter
to your business, and whether they can defend that choice when someone senior
disagrees. Use it for any level above a junior hire.
QUESTIONS TO ASK
1. How do you build an annual audit plan when you cannot cover everything?
(Strong answer: starts from a risk assessment tied to business objectives,
not from last year list, and reserves capacity for the unplanned.)
2. Walk me through how you scope one engagement.
(Strong answer: objective first, then process walkthrough, then risks, then
the tests that address those risks. Scope is written down and agreed.)
3. How do you rank risks? What makes one high rather than medium?
(Strong answer: uses likelihood and impact with a stated basis, and can name
a risk they downgraded and why.)
4. Management asks you to audit a topic that is not on the plan. What now?
(Strong answer: assesses it against the plan, is willing to reprioritize, but
documents the trade-off rather than quietly dropping planned coverage.)
5. What data do you pull before fieldwork starts, and what do you do with it?
6. How do you set materiality for an operational audit rather than a financial one?
7. Tell me about an audit where your original scope turned out to be wrong.
(Strong answer: caught it early, changed scope, and said so openly.)
8. How would you build a first-year plan for a company that has never had
internal audit?
(Strong answer: starts small and visible: cash handling, procurement, payroll
and access controls, then expands. Does not propose auditing everything.)
WHAT TO LISTEN FOR
•Risk language tied to your business, not a generic list
•Willingness to say no, with reasoning, to a low-value request
•A realistic first-year plan for a company of your size
•Comfort revising a plan when facts change
NOTES
__
Still Using Spreadsheets for Onboarding?
Automate documents, training assignments, task management, and track onboarding progress in real time.
The set that decides the hire: reporting lines, self-review conflicts, and what happens when someone senior wants a finding softened or dropped entirely.
Independence, Objectivity, and Ethics Questions
INTERNAL AUDITOR INTERVIEW: INDEPENDENCE, OBJECTIVITY, AND ETHICS
Candidate: __
Company: __
Interviewer: __
WHY THIS SET
This is the set most generic question lists skip, and it is the one that decides
the hire. An internal auditor who cannot hold a finding under pressure gives you
the cost of the role with none of the protection. Ask all eight, and push for
real examples rather than principles.
QUESTIONS TO ASK
1. Who should an internal auditor report to, and why does the reporting line
matter?
(Strong answer: functional reporting to the board, audit committee, or owner,
with administrative reporting elsewhere. Explains why reporting only to the
finance lead undermines the work.)
2. You are asked to audit a process you helped design. What do you do?
(Strong answer: discloses the conflict and asks for someone else to perform
or review the work. A candidate who sees no problem here is a serious risk.)
3. How do you stay objective when you are friendly with the people you audit?
4. Describe a time a senior leader wanted a finding removed or softened.
(Strong answer: kept the finding, adjusted the wording for accuracy only, and
escalated through the reporting line rather than negotiating it away.)
5. What would you do if the owner told you to drop a finding entirely?
(Strong answer: documents the request and the decision, and knows that a
management decision to accept a risk is legitimate as long as it is recorded.)
6. How do you handle a personal relationship or financial interest that overlaps
an area you are assigned to audit?
7. What is your view on internal audit taking on operational work?
(Strong answer: can help temporarily, but must not audit its own work later.
Knows where the line sits at a small company.)
8. How do you keep an audit confidential without becoming secretive?
WHAT TO LISTEN FOR
•Concrete examples of holding a position, not statements of principle
•Understanding that independence is structural, not a personality trait
•Recognition that management may accept a risk if it is documented
•Immediate, unprompted disclosure of conflicts
NOTES
__
Set 4: Fraud, Findings, and Difficult Conversations
The first hour after suspected fraud, writing findings that get fixed rather than argued with, blocked access to records, and tracking remediation through to closure.
Fraud, Findings, and Difficult Conversations Questions
INTERNAL AUDITOR INTERVIEW: FRAUD, FINDINGS, AND DIFFICULT CONVERSATIONS
Candidate: __
Company: __
Interviewer: __
WHY THIS SET
Findings only create value if they are written well and land without a war. This
set covers the suspected-fraud response, the quality of written findings, and
the conversations that follow. It is the set that separates a careful auditor
from a technically strong one who cannot work with people.
QUESTIONS TO ASK
1. Walk me through what you do in the first hour after you suspect fraud.
(Strong answer: preserves evidence, limits who is told, does not confront the
person, escalates through a defined channel. A candidate who starts
interviewing suspects is a red flag.)
2. How do you write a finding so it gets fixed rather than argued with?
(Strong answer: condition, cause, effect, recommendation, with an owner and a
due date agreed before the report is issued.)
3. How do you handle a manager who will not give you access to records?
4. Tell me about the most uncomfortable finding you have had to deliver.
5. How do you track remediation through to closure?
(Strong answer: a follow-up log with owners and dates, retested rather than
closed on a verbal assurance.)
6. How do you distinguish an error from an irregularity?
(Strong answer: intent and pattern. Errors are random and self-correcting;
irregularities repeat, favor one party, and hide.)
7. How would you explain a control weakness to an owner who is not an accountant?
8. What makes you look harder at a vendor file or an expense claim?
(Strong answer: round numbers, sequential invoices, a new vendor with a
personal address, approvals that never vary, activity just under a threshold.)
WHAT TO LISTEN FOR
•A defined escalation path, not improvised confrontation
•Findings written to be fixed, with an owner and a date
•Follow-up that involves retesting, not a checkbox
•Language a non-accountant can act on
NOTES
__
Companies Using FirstHR Onboard 3x Faster
Join hundreds of small businesses who transformed their new hire experience.
Past behavior scored on the STAR pattern. Use these alongside the general behavioral question set if you want a broader read on the person.
Behavioral and Situational Questions
INTERNAL AUDITOR INTERVIEW: BEHAVIORAL AND SITUATIONAL
Candidate: __
Company: __
Interviewer: __
WHY THIS SET
Past behavior predicts future behavior better than stated intentions. Score
these with the STAR pattern: Situation, Task, Action, Result. Ask for the result
every time, because the result is where a rehearsed answer runs out.
QUESTIONS TO ASK
1. Tell me about an audit that changed how the business actually operated.
(Strong answer: names the change, who made it, and what happened afterward.)
2. Describe an audit that found nothing significant. What did you do with it?
(Strong answer: a clean result is a real result, reported plainly, with the
scope explained. Watch for candidates who imply they always find something.)
3. Tell me about a time you were wrong about a finding.
(Strong answer: found it themselves or accepted correction quickly, corrected
the record, and adjusted the method.)
4. Describe a time you delivered bad news to someone far more senior than you.
5. Tell me about the heaviest period you have worked. How did quality hold up?
6. Describe a time you had to learn an unfamiliar part of a business quickly.
(Strong answer: a repeatable method: walkthroughs, system reports, and asking
the people who do the work.)
7. Tell me about a disagreement with an external auditor or a regulator.
8. Describe a time you improved the audit process itself, not a client process.
WHAT TO LISTEN FOR
•Specific situations with named outcomes, not job descriptions
•Ownership of mistakes without defensiveness
•Curiosity about how a business actually runs
•Consistency with the answers given in the other sets
NOTES
__
Set 6: Scorecard, Red Flags, and Independence Checklist
A 1-to-5 rubric across six areas, a red-flag checklist, and a checklist for the role itself, so the structure that protects the auditor is in place before day one.
Internal Auditor Scorecard and Red Flags
INTERNAL AUDITOR INTERVIEW SCORECARD AND RED-FLAG CHECKLIST
Candidate: __
Company: __
Interviewer: __
Date: _
HOW TO SCORE
Score every area from 1 to 5 immediately after the interview, while the answers
are fresh, and anchor each score to something the candidate actually said. If
more than one person interviews, each scores independently before the group
talks, so no single strong impression sets the tone. Use the same rubric for
every candidate for the same role.
Rating scale:
5 = Strong, specific evidence 4 = Solid evidence 3 = Some evidence
2 = Weak or mixed evidence 1 = No evidence or red flags
SCORING AREAS
Controls and methodology: control testing, sampling, documentation
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
Risk assessment and planning: builds and defends a risk-based plan
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
Independence and objectivity: discloses conflicts, holds findings
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
Fraud awareness and findings: escalation path, written findings, follow-up
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
Communication and influence: explains issues plainly, gets fixes agreed
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
Business judgment and fit: proportionate to a company of our size
Score [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ]
Evidence: ______
RED FLAGS (WEIGH CAREFULLY)
[ ] Sees no problem auditing a process they designed
[ ] Cannot describe a single finding they held under pressure
[ ] Would confront a suspected wrongdoer directly instead of escalating
[ ] Speaks about audited teams with contempt
[ ] Frames the role as catching people rather than fixing controls
[ ] Only framework vocabulary, no worked example behind it
[ ] Vague or shifting account of what they personally did on past audits
[ ] Reluctant to provide references from people they audited
INDEPENDENCE CHECKLIST FOR THE ROLE
[ ] Functional reporting line to the board, audit committee, or owner is defined
[ ] The auditor has no operational ownership of the processes they audit
[ ] Access to records and systems is granted in writing before day one
[ ] Conflict-of-interest disclosure is signed at hire and refreshed annually
[ ] A documented path exists for escalating a disputed finding
Test independence with situations, never with principles. Ask a candidate whether independence matters and every one of them says yes; put them inside a self-review conflict or a finding under pressure and the answers separate immediately. Four checks do most of the work.
Define the reporting line first
Decide before the interview whether the auditor reports functionally to you, the board, or an audit committee. Then ask the candidate what they would want, and compare.
Ask about self-review directly
Put the candidate in a process they helped build and see whether they disclose the conflict unprompted. This single question sorts candidates faster than any technical one.
Require a real pressure example
Ask for a specific finding that someone senior wanted changed, including who, what they said, and how it ended. Principles without an example are not evidence.
Check references on the audited side
Speak to a manager who was audited by this person, not only to their own boss. You learn whether findings were fair and whether they got fixed.
The structural side is yours to fix, not the candidate's. Decide before the interview who hears a disputed finding, and write down how a decision to accept a risk gets recorded. Federal internal control standards in the GAO Green Book treat that oversight structure as part of the control environment itself, which is a useful reminder that hiring the person is only half of it.
One more practical note: a small company usually cannot separate every duty, and a candidate who writes findings demanding textbook segregation on a four-person finance team is telling you they will produce unusable reports. The better answer proposes compensating controls and owner review, which is also the answer your whistleblower policy and code of conduct should support.
Strong Answers, Weak Answers, and Red Flags
The questions get you started; the follow-ups tell you the truth. For each of the three questions below, the gap between a strong and a weak answer is wide enough that you can score it confidently without an audit background of your own.
You are asked to audit a process you helped design. What do you do?
Strong answer: Discloses the conflict straight away and asks for the work to be performed or reviewed by someone else. A strong candidate treats self-review as a structural problem rather than a question of personal integrity, and offers a practical alternative at a small company: an external reviewer, a peer, or direct owner review of that section.
Weak answer: A weak answer says they would simply be careful and objective, or does not recognize a conflict at all. That answer tells you the person will audit their own work the first time it is convenient.
A senior leader wants a finding removed. What happens next?
Strong answer: Separates accuracy from comfort: they will correct anything factually wrong, and they will not delete a valid finding. They escalate through the defined reporting line, and they know that management is entitled to accept a risk as long as the acceptance is documented and visible to whoever oversees the function.
Weak answer: A weak answer either caves (rewrites the finding to make the problem disappear) or goes to war (refuses any discussion and treats every challenge as interference). Both cost you the value of the role.
Walk me through the first hour after you suspect fraud.
Strong answer: Preserves evidence, restricts who knows, avoids tipping off the suspected person, and escalates through a channel agreed in advance. A strong candidate asks who that channel is at your company before answering, which tells you they have done this in a real organization.
Weak answer: A weak answer starts by confronting the person or interviewing colleagues informally. That destroys evidence, warns the subject, and can create legal exposure for the business.
Across all five sets, the most useful follow-up is some version of what happened next. A candidate with real experience has an outcome ready, including the ones that went badly. A candidate working from a prepared script runs out of specifics within two questions, which is exactly what you want the interview to surface.
Weigh the red flags in the scorecard file carefully rather than mechanically. Seeing no problem in auditing your own work is close to disqualifying on its own. Contempt for audited teams, or framing the job as catching people rather than fixing controls, predicts a first year of arguments and no closed findings.
Scoring the Interview
Score all six areas from 1 to 5 immediately after each interview, anchored to something the candidate actually said. Scoring from memory two days later measures how much you liked the conversation. Scoring against evidence measures the candidate, which is the whole point of using a written rubric at all.
Scoring area
What a 5 looks like
Controls and methodology
Tests a control end to end and explains sampling plainly
Risk assessment and planning
Builds and defends a risk-based plan sized to your company
Independence and objectivity
Discloses conflicts unprompted; held a finding under pressure
Findings with an owner and a date, in plain language
Business judgment and fit
Proportionate recommendations for a company of your size
If more than one person interviews, each should score independently before the group talks, so the most senior voice does not set the anchor. Keep the completed scorecards with the rest of the hiring file and give the runners-up a clean interview feedback step. FirstHR stores those records on the employee profile once someone is hired. Applicant tracking is coming soon to FirstHR.
Fair, Legal, and Structured Interviewing
A fair interview and a legal interview are the same interview: the same job-related questions for every candidate, scored on the same rubric. That structure is what makes a hiring decision defensible, and it also happens to predict on-the-job performance better than a free-flowing conversation, which is the case for structured interviews generally.
Same Questions, Same Rubric, Every Candidate
Federal law prohibits basing employment decisions on protected characteristics including age, race, color, religion, sex, pregnancy, national origin, disability, and genetic information (EEOC prohibited practices). Guidance from the same agency on tests and selection procedures makes the practical point: a selection method should be job-related and consistent with business necessity. A fixed question set scored on a fixed rubric is the simplest way to meet that standard.
Keep protected topics out of small talk as well as the formal questions, since the informal opening is where most problems start. If you want the specifics, the guide to illegal interview questions lists the common traps, and the same consistency reduces bias at the same time. This is general information, not legal advice.
Internal Auditor Pay and Level
Internal auditors fall inside the broader federal accountants and auditors occupation, so that is the pay anchor. Set your range by level first, then adjust for certification, industry, and region, because the spread within the occupation is wider than the median suggests.
Median $83,680 a Year (BLS, May 2025)
Accountants and auditors reported a median annual wage of $83,680, about $40.23 an hour, with the lowest 10 percent under $56,020 and the highest 10 percent above $144,090 (Bureau of Labor Statistics Occupational Employment and Wage Statistics survey, May 2025, published via the U.S. Bureau of Labor Statistics). The occupation held about 1.58 million jobs, with roughly 124,200 openings projected each year through 2034.
A staff or junior auditor sits toward the lower end of that range, a senior auditor at or above the median, and an audit manager or head of internal audit well above it. Decide the level before you interview, because the questions you weight most heavily change with it, as the comparison below shows.
Expectation
Staff / Senior Auditor
Audit Manager
Tests controls and writes workpapers
Scopes an individual engagement
Owns the annual risk assessment and plan
Presents findings to the board or owner
Supervises and reviews other auditors
For an outsourced or co-sourced arrangement, price the engagement rather than the salary, and ask who specifically will do the work, since the person in the pitch is not always the person on the job. Either way, the total cost includes audit software, continuing education, and the internal time the audit consumes.
Interviewing an Internal Auditor Without HR
At a large company this candidate meets a panel, an audit committee chair, and a recruiter who keeps the scorecards consistent. At a small business one person usually runs the entire process, which changes what can go wrong. Three realities shape how you should run it.
You are hiring someone whose job is to disagree with you
Every other hire is measured on how well they support the plan. An internal auditor is measured on how honestly they report what the plan is actually producing, which means the interview has to test a quality most interviews reward the opposite of. A candidate who agrees with everything you say in the room will agree with everything a department head says in year one. Ask for a specific occasion when they held a finding against pressure, and push until you get a name, a decision, and an outcome. If the answer stays at the level of principle, score it low.
Most small companies need an audit function, not a full-time auditor
Before you run the interview, be honest about whether the role is a full-time hire. Many smaller companies get most of the benefit from a co-sourced or outsourced arrangement, or from a controller who owns controls with periodic independent review. The questions on this page work for all three: you can ask them of a firm pitching for the work, of a fractional auditor, or of a full-time candidate. What changes is the weighting. For an outsourced arrangement, weight scope, availability, and who exactly will do the work; for an employee, weight independence and fit with your size.
One interviewer, no panel, and no HR to keep the process clean
At a large company an internal audit candidate meets a panel, an audit committee chair, and a recruiter who keeps the scorecards consistent. At a small business the owner or finance lead runs the whole thing between other work, and consistency has to come from the paperwork instead. Use the same six sets for every candidate, score immediately after each interview, and keep the scorecards together so the decision rests on written evidence. FirstHR handles the part that starts once you decide: e-signature on the offer and confidentiality agreement, document management for the signed records, and task workflows for access and policy sign-off. Applicant tracking is coming soon to FirstHR.
The practical fix for a single interviewer is consistency on paper: the same sets, scored the same day, kept in one place. If you can add a second interviewer for the independence set alone, do it, and have them score before you compare notes. A short guide to running the interview covers the mechanics.
From Interview to Onboarding
The interview is step one. Onboarding an internal auditor has two extra steps that most roles do not: the reporting line has to be stated in writing, and access to records has to be granted before the first audit rather than negotiated during it. Handle both alongside the usual Form I-9 and new hire paperwork.
Offer, confidentiality, and ethics
Send the offer with the exempt classification and the reporting line stated, plus a confidentiality agreement and a conflict-of-interest disclosure to sign.
Grant access in writing
Systems, ledgers, and records the auditor needs, documented before day one, so access is never negotiated finding by finding.
Set the escalation path
Write down who hears a disputed finding and how a risk acceptance is recorded. Do this on day one, not the first time it is needed.
Store the records
Keep the signed offer, disclosures, policy acknowledgments, and the interview scorecards organized and easy to retrieve.
The document sequence is familiar: the offer letter template for the terms and classification, a confidentiality agreement given the records involved, a conflict-of-interest disclosure, and an onboarding checklist for the first weeks.
FirstHR connects that sequence in one place: e-signature on the offer, the confidentiality agreement and the ethics acknowledgment, document management for the signed records, task workflows and an AI onboarding wizard for access and policy sign-off, and an HRIS org chart that shows the functional reporting line the role depends on. FirstHR is an onboarding and HR platform, not audit software, and it does not run payroll or administer benefits, so connect those separately. Applicant tracking is coming soon to FirstHR.
Key Takeaways
Assess an internal auditor on independence first, then risk judgment, technical audit skill, and communication.
Test independence with situations: a self-review conflict and a finding someone senior wanted removed.
Ask what happens in the first hour after suspected fraud; preserving evidence and escalating beats confrontation.
Use the same 40 questions and the same 1-to-5 rubric for every candidate, and score the same day.
Pay anchor: accountants and auditors reported a median of $83,680 in May 2025, with managers well above it.
Define the reporting line and the escalation path before the interview, not after the first disputed finding.
Frequently Asked Questions
What questions should I ask an internal auditor candidate?
Ask across five competencies: controls and audit methodology, risk assessment and planning, independence and ethics, fraud and findings, and behavioral evidence. Strong openers include walk me through how you test a single control from start to finish; how do you build an annual audit plan when you cannot cover everything; you are asked to audit a process you helped design, what do you do; describe a time a senior leader wanted a finding removed; and walk me through the first hour after you suspect fraud. Ask the same core questions of every candidate and score them on one rubric. The independence questions matter most, because an auditor who cannot hold a finding under pressure gives you the cost of the role without the protection it exists to provide. This page includes six downloadable sets and a scorecard.
What skills should I look for in an internal auditor?
Look for four things in roughly this order: independence, risk judgment, technical audit skill, and communication. Independence means the candidate discloses conflicts without being asked and can point to a specific finding they held when someone senior pushed back. Risk judgment means they can aim limited hours at what actually threatens your business rather than auditing whatever is easiest to test. Technical skill covers control testing, sampling, and documentation good enough for another auditor to repeat a year later. Communication means findings written with an owner and a due date, explained in language a non-accountant can act on. Certifications such as the CIA, CPA, CISA, or CFE signal training but do not substitute for evidence in the interview, so score the answers, not the letters.
How do I test whether an internal auditor is actually independent?
Test it with situations rather than principles. Put the candidate in a process they helped design and see whether they disclose the conflict unprompted; a candidate who says only that they would be careful has told you they will review their own work. Ask for a specific occasion when a senior leader wanted a finding softened, and push for the name of the issue, what was said, and how it ended. A strong candidate separates accuracy from comfort: they will correct anything factually wrong, and they will not delete a valid finding. They also know management may accept a risk if the acceptance is documented. Finish by checking references on the audited side, not only with the candidate’s own former manager, so you hear whether findings were fair and whether they were actually fixed.
What is the difference between an internal auditor and an external auditor?
An internal auditor works for your company and evaluates internal controls, risk management, and governance on an ongoing basis, reporting functionally to the board, an audit committee, or the owner. An external auditor is independent of the company and gives an opinion on the financial statements for the benefit of outside parties such as lenders, investors, or regulators. The scope differs too: internal audit covers operations, compliance, and process risk as well as financial controls, while an external financial statement audit is narrower and follows a defined standard. The two are not interchangeable, and one cannot replace the other for a company that has a genuine requirement for both. If you are hiring for either, define the reporting line and the scope in writing before you interview.
Should a small business hire a full-time internal auditor?
Usually not, unless a regulator, a lender, a board, or a contract requires an internal audit function. For most small companies the practical alternatives deliver more value per dollar: a co-sourced or outsourced arrangement for periodic reviews, or a controller who owns internal controls with an independent review scheduled once or twice a year. A full-time internal auditor makes sense once the control environment is complex enough that continuous coverage pays for itself, or when governance requirements make the function mandatory. The interview questions on this page work for all three routes, since you can ask them of a firm pitching for the work, a fractional auditor, or a full-time candidate. What changes is the weighting: scope and availability matter more for outsourced work, independence and fit matter more for an employee.
What are red flags in an internal auditor interview?
The clearest red flag is a candidate who sees no problem auditing a process they helped design, because that single answer predicts self-review across the whole role. Others worth weighting heavily: cannot describe one finding they held under real pressure; would confront a suspected wrongdoer directly instead of preserving evidence and escalating; speaks about audited teams with contempt; frames the job as catching people rather than fixing controls; recites framework vocabulary with no worked example behind it; or gives a shifting account of what they personally did on past engagements. Reluctance to give a reference from someone they audited is also telling. None of these is disqualifying on its own, but two or more together usually means the interview has already answered your question.
How much does an internal auditor cost to hire?
Internal auditors sit inside the federal accountants and auditors occupation, which reported a median annual wage of $83,680 in May 2025 according to the Bureau of Labor Statistics, with the lowest 10 percent under $56,020 and the highest 10 percent above $144,090. A junior or staff auditor sits toward the lower end, a senior auditor near or above the median, and an audit manager or head of internal audit well above it. Certification, industry, and region move the number substantially, and a regulated industry typically pays a premium. Budget the salary plus payroll taxes, benefits, audit software, and continuing education. If a full-time role is not justified, compare that total against the cost of a co-sourced arrangement before you post the job. This is general information, not financial advice.
Are these internal auditor interview questions legal to ask?
Yes. Every question on this page is job-related: audit methodology, risk assessment, independence, fraud response, and past professional behavior. The legal caution is the same as for any interview. Avoid questions touching characteristics protected under the laws the EEOC enforces, including age, race, color, religion, sex, pregnancy, national origin, disability, and genetic information, and keep protected topics out of small talk as well as the formal questions. Ask the same core questions of every candidate for the role and score them on the same rubric, because a consistent, job-related process is both fairer and easier to defend if a decision is ever challenged. Background and reference checks are common for a role with access to financial records, but follow the applicable rules for them. This is general information, not legal advice.
