External Audit interview questions

What a strong answer covers

• Define external audit as independent assurance on financial statements.
• Explain that external audit provides reasonable assurance to stakeholders.
• Contrast with internal audit: internal audit focuses on operational effectiveness and risk management, and is an internal function.
• Mention the audit expectation gap and the role of standards.
• Highlight that external audit results in an opinion on the financial statements.

Where people lose the point

• ×Confusing external audit with internal audit or consulting.
• ×Stating that auditors guarantee absolute accuracy.
• ×Omitting the independence aspect.

What a strong answer covers

• State the formula: Audit Risk = Inherent Risk × Control Risk × Detection Risk.
• Define each component and give examples.
• Explain that audit risk is set at an acceptably low level (e.g., 5%).
• Describe how the auditor assesses inherent and control risk to determine detection risk.
• Discuss how detection risk influences the nature, timing, and extent of substantive procedures.

Where people lose the point

• ×Misstating the relationship (e.g., saying detection risk increases when control risk is high).
• ×Confusing inherent risk with control risk.
• ×Forgetting to mention that audit risk is a function of the risk of material misstatement and detection risk.

What a strong answer covers

• Define materiality in the context of financial statement users' decisions.
• Explain that materiality is a matter of professional judgment and is set at the planning stage.
• Describe common benchmarks (e.g., 5% of pre-tax income, 1% of total assets) and factors affecting the choice.
• Discuss performance materiality and its purpose.
• Explain that materiality may be revised during the audit based on new information.

Where people lose the point

• ×Using a single rule without considering qualitative factors.
• ×Confusing materiality with tolerable misstatement.
• ×Ignoring the need to reassess materiality during the audit.

What a strong answer covers

• List the assertions for classes of transactions, account balances, and presentation/disclosure.
• Provide examples: occurrence, completeness, accuracy, cutoff, classification for transactions; existence, rights and obligations, completeness, valuation for balances.
• Explain that the auditor designs procedures to test each relevant assertion.
• Give an example: testing existence of inventory by observing physical count.
• Discuss how the risk assessment for each assertion drives the nature and extent of testing.

Where people lose the point

• ×Mixing up assertions (e.g., existence vs. completeness).
• ×Not linking assertions to specific audit procedures.
• ×Forgetting presentation and disclosure assertions.

What a strong answer covers

• Explain that reliability depends on source and nature of evidence.
• External evidence (e.g., bank confirmations) is more reliable than internal.
• Original documents are more reliable than copies or scanned versions.
• Evidence obtained directly by the auditor (e.g., observation) is more reliable than indirect.
• Written evidence is more reliable than oral representations.

Where people lose the point

• ×Claiming that all evidence is equally reliable.
• ×Overlooking the importance of independence of the source.
• ×Not considering the conditions under which evidence is obtained.

What a strong answer covers

• Define analytical procedures as evaluations of financial information through analysis of plausible relationships.
• Explain their use in planning (to understand the business), as substantive procedures, and in overall review.
• Give examples: ratio analysis, trend analysis, comparison to budget or industry.
• Discuss when they are effective: when relationships are predictable and data is reliable.
• Mention that unusual fluctuations must be investigated and corroborated.

Where people lose the point

• ×Thinking analytical procedures are only used in planning.
• ×Not investigating significant fluctuations.
• ×Relying solely on analytical procedures without corroboration.

What a strong answer covers

• Understand the control environment and entity-level controls.
• Identify key controls relevant to financial reporting.
• Test operating effectiveness through inquiry, observation, inspection, and reperformance.
• Assess the frequency and timing of control testing.
• Evaluate deficiencies and their impact on the audit strategy.

Where people lose the point

• ×Assuming all controls are equally important.
• ×Not linking control testing to risk assessment.
• ×Failing to communicate significant deficiencies to those charged with governance.

What a strong answer covers

• Define control deficiency as a flaw in the design or operation of a control.
• Explain that a significant deficiency is a deficiency or combination that is less severe than a material weakness but important enough to merit attention.
• Define material weakness as a deficiency such that there is a reasonable possibility that a material misstatement will not be prevented or detected.
• Discuss the criteria for classification, including the likelihood and magnitude of potential misstatement.
• Mention the requirement to communicate material weaknesses in writing to those charged with governance.

Where people lose the point

• ×Using the terms interchangeably.
• ×Confusing severity with likelihood.
• ×Not knowing the communication requirements.

What a strong answer covers

• Define tests of controls as procedures to evaluate the operating effectiveness of controls.
• Define substantive procedures as procedures to detect material misstatements at the assertion level (tests of details and analytical procedures).
• Explain that the auditor may rely on controls to reduce substantive testing if controls are effective.
• Discuss factors: effectiveness of controls, efficiency, and risk assessment.
• Give an example: if controls over cash are strong, the auditor may reduce the number of bank confirmations.

Where people lose the point

• ×Thinking tests of controls are always required.
• ×Believing that substantive procedures can be omitted entirely.
• ×Not considering the cost-benefit trade-off.

What a strong answer covers

• Unmodified opinion: financial statements are fairly presented.
• Qualified opinion: material but not pervasive misstatement or scope limitation.
• Adverse opinion: material and pervasive misstatement.
• Disclaimer of opinion: pervasive scope limitation or lack of independence.
• Explain the meaning of 'pervasive' and give examples.

Where people lose the point

• ×Confusing 'material' with 'pervasive'.
• ×Issuing a qualified opinion when an adverse opinion is required.
• ×Not understanding the impact of scope limitations.

What a strong answer covers

• Explain the going concern assumption and its importance.
• Identify events or conditions that may cast significant doubt (e.g., negative cash flows, loan defaults).
• Discuss the auditor's procedures: review management's assessment, evaluate future cash flow projections, consider mitigating factors.
• Explain the reporting implications: if substantial doubt exists, the auditor may include an emphasis of matter paragraph or issue a qualified or adverse opinion.
• Mention the time horizon (usually 12 months from the financial statement date).

Where people lose the point

• ×Ignoring the need to evaluate management's assessment.
• ×Not considering the effect of subsequent events.
• ×Confusing going concern issues with other audit adjustments.

What a strong answer covers

• Define professional skepticism as an attitude that includes a questioning mind and critical assessment of evidence.
• Explain that it is required by auditing standards.
• Discuss the importance in detecting fraud and error.
• Give an example: when management provides an explanation for an unusual fluctuation, the auditor should corroborate it with independent evidence.
• Mention that skepticism does not mean assuming management is dishonest, but not being overly trusting.

Where people lose the point

• ×Equating skepticism with distrust or accusation.
• ×Failing to apply skepticism when evidence is consistent.
• ×Not documenting the skeptical mindset.

What a strong answer covers

• Explain that the auditor is responsible for obtaining reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error.
• Distinguish between fraudulent financial reporting and misappropriation of assets.
• Discuss the importance of understanding the entity's fraud risk factors (e.g., incentives, opportunities, rationalization).
• Describe procedures: inquiry of management, analytical procedures, and testing of journal entries.
• Mention the need to communicate fraud to management and, in some cases, to regulators.

Where people lose the point

• ×Believing auditors are responsible for detecting all fraud.
• ×Not considering fraud risk in planning.
• ×Failing to respond to identified fraud risks.

What a strong answer covers

• List the five categories of threats: self-interest, self-review, advocacy, familiarity, and intimidation.
• Give examples: financial interest in client (self-interest), auditing own work (self-review), promoting client's securities (advocacy), long association (familiarity), threats from management (intimidation).
• Explain safeguards: prohibition of certain services, rotation of senior personnel, review by an independent partner, and ethical training.
• Discuss the importance of independence in fact and appearance.
• Mention that some threats cannot be reduced to an acceptable level and the auditor must decline or withdraw.

Where people lose the point

• ×Only mentioning financial threats.
• ×Not providing specific safeguards.
• ×Underestimating the importance of appearance.

What a strong answer covers

• Explain the requirement to communicate significant findings from the audit.
• Include: the auditor's responsibilities, planned scope and timing, significant risks identified, material weaknesses in internal controls, and disagreements with management.
• Discuss the form and timing of communication (usually written for significant matters).
• Mention that communication should be two-way and timely.
• Give examples of significant findings: uncorrected misstatements, difficulties encountered, and fraud or suspected fraud.

Where people lose the point

• ×Confusing those charged with governance with management.
• ×Not communicating material weaknesses in writing.
• ×Omitting the requirement to communicate the auditor's responsibilities.

What a strong answer covers

• Define subsequent events as events occurring between the balance sheet date and the date of the auditor's report.
• Distinguish between adjusting events (provide evidence of conditions that existed at the balance sheet date) and non-adjusting events (conditions that arose after).
• Explain the auditor's procedures: inquire of management, review minutes of meetings, and consider whether the financial statements need adjustment or disclosure.
• Discuss the auditor's responsibility for events discovered after the report date.
• Mention the impact on the audit report if a material subsequent event is not properly reflected.

Where people lose the point

• ×Confusing adjusting and non-adjusting events.
• ×Not performing procedures up to the date of the report.
• ×Ignoring events that occur after the report date.

What a strong answer covers

• Define audit sampling as the application of audit procedures to less than 100% of items within a population.
• Explain statistical vs. non-statistical sampling.
• Discuss factors affecting sample size: risk of incorrect acceptance, tolerable misstatement, expected misstatement, and population size.
• Describe how sampling risk is controlled.
• Give an example of sampling in testing accounts receivable confirmations.

Where people lose the point

• ×Thinking sampling is always required.
• ×Ignoring the effect of expected misstatement.
• ×Confusing sampling risk with non-sampling risk.

What a strong answer covers

• Explain that the representation letter is written evidence from management acknowledging their responsibilities and providing certain assertions.
• List typical contents: management's responsibility for the financial statements, completeness of information provided, and acknowledgment of fraud or illegal acts.
• Discuss that it is a form of audit evidence but does not replace other procedures.
• Mention that the letter is dated as of the date of the auditor's report and signed by appropriate management.
• Explain that if management refuses to provide the letter, the auditor may issue a disclaimer or qualified opinion.

Where people lose the point

• ×Relying solely on the representation letter as evidence.
• ×Not obtaining the letter at the end of the audit.
• ×Forgetting to include all required representations.