IT Auditor Interview Questions UK: 8 Real Questions and What Interviewers Want

Before your IT Auditor interview, it helps to see the questions from the interviewer's side. We have picked eight from our set of 12 and added the reason each one gets asked.

Eight IT Auditor interview questions, and what the interviewer is thinking

1. What attracted you to IT audit rather than general audit or a pure IT role, and what does a typical engagement involve for you?

Why they ask: They want to see you understand the hybrid nature of the role and have a genuine interest.

2. How would you test user access controls for a key financial application?

Why they ask: Access control is the most commonly tested IT general control, and they want a practical approach.

3. How do you test change management controls, and what would concern you about the results?

Why they ask: Uncontrolled change can undermine the reliability of financial systems, so it is a common audit area.

4. What is the difference between IT general controls and application controls, and how do you test an automated control?

Why they ask: This is fundamental and shows whether you understand how IT supports financial reporting.

5. If a client relies on a cloud provider or outsourced payroll service, how do you obtain assurance over the controls at that third party?

Why they ask: Outsourcing is widespread, and auditors need to know how to handle it.

6. During your testing you find that several developers have administrator access to the production environment, and the IT manager says a compensating control exists. What do you do?

Why they ask: They test technical scepticism and your response to management assertions.

7. You find that a leaver's account was used to log in and post journals two weeks after they left the company. What would you do?

Why they ask: It could signal fraud or a serious weakness, and they want to see a measured, correct response.

8. Tell me about a time you explained a technical IT risk or finding to a non-technical audience.

Why they ask: IT auditors must make findings understandable to finance and management stakeholders.

A sample answer to question 1

What attracted you to IT audit rather than general audit or a pure IT role, and what does a typical engagement involve for you?

I enjoy being between technology and finance. A pure IT role means doing the work, but in IT audit I get to understand how many different systems work and test whether the controls around them actually protect the business. On a typical engagement I would be scoping the IT environment with the audit team, so we know which applications and infrastructure matter for financial reporting. Then I would run walkthroughs with the IT teams, carry out testing of general controls such as access, change management and operations, and test application controls where we plan to rely on them. I would document evidence in the audit file, raise exceptions with the IT management and agree remedial actions, and feed the conclusions to the financial audit team. I am working towards CISA, because I want to build deep expertise, and I like that every client shows me a different mix of systems, from SAP and Oracle to cloud platforms.

Common mistake to avoid: Presenting it as a fallback from IT or accounting; no mention of working with the financial audit team

Want the rest?

Full model answers, key points and common mistakes for all 12 questions are on the IT Auditor interview questions page. The first five are free, no sign-up needed.