An interview for an internal controller position often surprises candidates coming from accounting or external audit. They expect questions on standards and entries; they are asked instead about processes, risks, how to convince a plant manager to document their controls, or how to react when a subsidiary does not respond to a self-assessment campaign. The recruiter, often a head of internal control or a finance director, is looking less for a technician than for someone who can build a control system and work with operational staff. This article groups the questions by theme, with suggested answers, and explains how to showcase external audit experience.
What the interview is trying to measure
Before preparing answers, you need to understand what the recruiter is assessing. Four dimensions recur:
- understanding of processes: can you describe a process from end to end, identify where the risks lie and which controls cover them?
- command of the approach: do you know the deliverables of the job (risk map, risk and control matrices, tests, action plans) and a framework such as COSO?
- the ability to bring operational staff on board: internal control only works if teams apply the controls; the recruiter wants to see how you win their support;
- judgement: can you tell a minor weakness from a deficiency that must be reported to the audit committee?
Our article on the day-to-day work of an internal controller describes the job in detail; it is worth rereading before the interview.
Questions on processes and risks
“Describe the purchasing process, from request to payment. Where are the risks?” Suggested answer: follow the flow (purchase request, order, receipt, invoice, matching, approval, payment) and name the risks at each stage: unauthorised purchases, fictitious suppliers, non-compliant receipt, double payment, fraudulent changes to bank details. For each, propose a control: an approval circuit, supplier creation by a separate person, three-way matching between order, receipt and invoice, a check on changes to bank details.
“How do you build a risk map?” Suggested answer: start from objectives and processes, identify risks with the departments concerned (interviews, workshops), rate them by impact and likelihood, distinguish gross risk from residual risk after controls, then prioritise and have the result validated by management.
“What are the risks specific to our sector?” Prepare by reading the company’s annual report or universal registration document if published: the section on risk factors often gives the priority topics. In retail, shrinkage and in-store inventory management; in industry, inventory valuation and capital expenditure; in services, revenue recognition and contracts.
“What is segregation of duties, and how do you check it?” Suggested answer: one person must not be able to carry out a transaction alone from start to finish (create a supplier, enter its invoice and pay it). Checking it involves reviewing access rights in the ERP, with the IT department, and a matrix of conflicting rights.
Questions on testing controls
“What is the difference between a design test and an operating effectiveness test?” Suggested answer: the design test checks that the control, as described, would cover the risk if applied; the operating effectiveness test checks, on a sample of real cases, that it was actually applied during the period.
“How do you choose a sample?” Suggested answer: according to the frequency of the control (daily, monthly, annual), the period covered and the level of risk, with a documented selection; for an automated control, testing one case may be enough if IT general controls are reliable.
“A key control has not been performed for three months in a row at a subsidiary. What do you do?” Suggested answer: understand the cause (the person was absent, the control was poorly designed, overload), assess the impact (did any misstatements get through during the period?), propose an action plan with an owner and a deadline, and report on it according to its severity.
“How do you assess an automated control in the ERP?” Suggested answer: check its configuration, test one case, and make sure that IT general controls (access management, change management) guarantee it was not modified during the period. The IT auditor CV example shows the vocabulary of these controls.
Role-plays with operational staff
These questions often separate candidates.
“A site manager refuses to document their controls, which they consider useless. How do you react?” Suggested answer: listen to their objections, start from their own risks (losses, disputes, comments from the statutory auditors), simplify the documentation requested, show the benefit to them, and escalate only if the deadlock persists.
“A subsidiary does not respond to the self-assessment campaign. What do you do?” Suggested answer: a personalised reminder, a conversation with the subsidiary’s finance manager to understand the difficulty, an offer of support, then informing the group finance department if necessary.
“You discover an anomaly that could be fraud. What is your approach?” Suggested answer: do not investigate alone, preserve the evidence, inform your line manager and follow the company’s procedure (internal audit, compliance, legal department), without talking to the people concerned.
“How do you present the results of your tests to the audit committee?” Suggested answer: a prioritised summary, focused on significant weaknesses, with action plans, owners and deadlines, without drowning the committee in detail.
Showcasing external audit experience
Many internal controllers come from external audit. It is an asset, provided it is presented from the right angle.
What external audit taught you that is directly useful:
- assessing the internal control of accounting cycles;
- writing recommendations in management letters;
- reading many processes, in different sectors;
- rigour in documentation and sampling.
What the recruiter also wants to hear:
- that you have understood the change of stance: you are no longer the outside assessor who leaves after the engagement, but the person who builds and supports over time;
- that you are ready to work on non-accounting processes (logistics, human resources, information systems);
- that you can persuade without the authority of an audit report.
A sentence such as “in audit, I made recommendations; in internal control, I want to make sure recommendations are applied” sums up this change well. The internal controller CV example shows how firm experience is rewritten for an in-house position, and our article on grades in an audit firm helps translate your level of responsibility.
Questions to ask at the end of the interview
Candidates’ questions are also assessed. A few useful ones:
- “Who does internal control report to, and how does it work with internal audit?”
- “How mature is the system: being built, being rolled out, being improved?”
- “How many entities and processes does the role cover?”
- “Which tools do you use to manage controls and action plans?”
- “What have been the main comments from the statutory auditors or internal audit in recent years?”
These questions show that you are already thinking about the role in terms of a control system. To arrive at the interview with a solid file, the CV editor formats your experience and produces a PDF readable by screening software, which often filters on terms such as risk map, COSO or control matrix.
Sources
- IFACI, internal control: everything you need to know 🔗.
- Autorité des marchés financiers, reference framework for risk management and internal control systems 🔗.
Frequently asked questions
Are technical accounting questions asked in internal control interviews?
Sometimes, especially for a position reporting to the finance department, but they weigh less than questions on processes and risks. Revise the basics of the accounting cycles.
Do you need to know COSO by heart?
You need to know its five components and be able to apply them to an example. Reciting the principles one by one is not expected.
Can a candidate without audit experience succeed in this interview?
Yes, if they show a good understanding of processes, for example through experience in accounting, management control or operations, and a structured approach to the role-plays.
How long does this type of interview last?
Often between forty-five minutes and an hour, sometimes with a written case on a process to analyse. Large groups organise several successive interviews.