Auditor Assessment

Why Auditors are hard to hire well

Audit is one of the few professions where the quality of the work and the volume of the work point in opposite directions. An auditor who returns thirty findings has not necessarily been more thorough than one who returns four; they may simply have failed to distinguish between a control that is broken and a control that is untidy. Hiring processes struggle with this because volume is measurable and discrimination is not. The candidate who describes an exhaustive testing programme sounds diligent, and diligence in the wrong place is the most common way an audit function wastes a year.

The training pipeline compounds the problem. Practice-trained auditors arrive with excellent methodology, real discipline about documentation, and a habit of working to a programme somebody else designed. Move them into an internal function where nobody hands them a scope and a meaningful number of them stall, not through lack of ability but because deciding what to audit is a different skill from auditing it well. The CV shows years of audit experience either way, and interviews rarely probe which kind.

There is also the matter of independence, which is easy to state and difficult to sustain. An internal auditor works alongside the people whose controls they are testing, sees them at lunch, and needs their cooperation on the next engagement. The pressure that arrives is almost never a request to hide something. It is a request to soften a rating, delay a finding until after a deadline, or characterise a failure as an isolated incident. Each request is individually reasonable, and the auditor who accepts all of them has produced a report that agrees with management about everything.

What separates the best from the rest

The best auditors start from where the money and the risk actually are. Given a business they have not seen before, they can work out within a day which three processes could cause real harm and which twenty are simply untidy, and they spend their time accordingly. Weaker auditors work the cycle: every process gets its turn, each receives comparable effort, and the report is a comprehensive account of a business’s minor housekeeping with the significant exposure somewhere in the middle of it.

They also treat evidence as evidence. There is a persistent temptation in audit to accept an explanation because the person giving it is credible and their account is plausible. A strong auditor will accept the same explanation only once they have seen the record that supports it, and they will do this without implying that they doubt the person, which is the social skill that keeps them welcome in the building. Scepticism that reads as hostility is a career-limiting version of the right instinct.

The third difference shows up in the writing. A finding has to do three things at once: state what was tested, state what was found, and make the consequence clear enough that somebody with a budget will act. Weak findings describe the deviation and stop, leaving management to work out whether it matters. Strong ones connect the control failure to the outcome it makes possible, propose a remediation that is proportionate to the risk, and are consequently agreed rather than argued about. The best auditors are read; the rest are filed.

Why interviews alone fall short

Audit interviews are dominated by methodology, and methodology is exactly what the profession trains hardest. Ask about sampling approaches, walkthroughs or the difference between design and operating effectiveness and competent candidates from every background will answer correctly. That establishes they were trained, which their qualification already established. It does not establish what they conclude when a sample of twenty-five produces one exception with a sympathetic explanation attached.

The behavioural questions fare no better. Every auditor has prepared an answer about a time they held a difficult position with management, and the answers are uniformly good because the profession selects for people who understand that they are supposed to. What the format cannot show you is the smaller decision made repeatedly and privately: whether to extend a sample when extending it will cost three days, whether to raise a rating that will make a colleague’s quarter difficult. Situational scenarios put every candidate in front of the same version of that decision and make the answers comparable.

Work samples have their own limitation, which is that they are usually reviewed by the person who set them. A candidate’s workpaper looks convincing when the reviewer already knows what the right answer was, and it is very difficult to tell, after the fact, whether a well-documented conclusion was reached through reasoning or arrived at first and evidenced afterwards. Scenarios avoid this by making the reasoning itself the answer rather than the artefact it produced.

Common hiring mistakes in audit recruitment

• Confusing thoroughness with judgement - the candidate who tests everything equally is not being rigorous, they are declining to decide what matters
• Assuming practice experience transfers to an internal function - executing a scope and setting one are different skills, and only one of them is trained in an audit practice
• Overlooking the report - a finding that a busy executive cannot act on has no effect, however well the underlying testing was performed
• Testing methodology knowledge that every qualified candidate has - it separates trained from untrained, which the qualification already did
• Ignoring how the candidate handles being liked - independence is eroded by ordinary collegial pressure far more often than by anything resembling misconduct
• Never asking what they chose not to audit - the decision to leave a process untested is the most consequential judgement in the role and the one nobody is asked to defend
• Recruiting only from audit practices - operational and finance experience often produces a sharper sense of which control failures actually cause harm in a working business

The work this role is assessed against

• Conduct scoping, walkthroughs, and control identification for assigned processes
• Design samples and perform tests including vouching, tracing, re-performance, and recalculation
• Extract and analyse data using Excel, SQL, and analytics tools to identify anomalies and trends
• Draft audit observations with risk ratings and agreed action plans, and present them to management
• Maintain controls testing artefacts, evaluate deficiencies, and support management certifications

Tools and outputs this role works with

Microsoft Excel (advanced), CaseWare Working Papers, AuditBoard or TeamMate+ for audit management, Galvanize and ACL Analytics or IDEA, Power BI or Tableau, Alteryx, SQL at basic to intermediate level, SAP or Oracle ERP in a read-only reporting capacity, Workiva for controls documentation, Thomson Reuters Checkpoint or CCH research tools, Microsoft Teams and SharePoint, and Visio or Lucidchart for process mapping.