Senior Internal Audit & Risk Management Officer

LIKELY QUESTIONS

- How would you develop a risk-based annual internal audit plan for UFAA using available financial, operational, compliance and systems data?
- Describe your approach to auditing vouchers, cashbooks and general ledger transactions to establish propriety, accuracy and compliance.
- Tell us about an audit or investigation where you identified a significant control weakness, fraud indicator or irregular transaction. What did you do?
- How would you conduct a cash survey or unannounced spot check, and how would you document and report any variance?
- What procedures would you apply when investigating allegations of fraud, corruption or abuse of Authority resources?
- How do you evaluate the design and operating effectiveness of internal controls within a public-sector institution?
- How would you audit an information system or information-processing environment, including access controls, data integrity and system-generated reports?
- What should a high-quality internal audit report to management and the Risk and Audit Committee contain, and how would you follow up on recommendations?

BEHAVIOURAL QUESTIONS

- Describe a time you had to deliver an audit finding that senior management did not agree with.
Model approach: Situation: Briefly describe the audit area and the disputed finding. Task: Explain your responsibility to provide independent, evidence-based assurance. Action: Describe how you verified facts, referred to policy, law or procedure, discussed the issue professionally, considered management's explanation, and maintained appropriate working papers. Result: State the final agreed outcome, recommendation, management action plan and improvement achieved.

- Tell us about a time you managed competing audit assignments or tight reporting deadlines.
Model approach: Situation: Describe the competing audits, investigation or committee deadline. Task: Explain the required deliverables and risks of delay. Action: Show how you prioritised using risk, materiality and statutory deadlines; created a work plan; delegated or coordinated work where appropriate; and communicated progress early. Result: Quantify timely completion, quality outcome, stakeholder satisfaction or risks addressed.

- Give an example of when you identified an error or irregularity through detailed financial analysis.
Model approach: Situation: Identify the process reviewed, such as payments, reconciliations, imprest, procurement or payroll. Task: State your responsibility to test transaction accuracy and compliance. Action: Explain the specific analytical procedures, sample testing, reconciliations, document review and follow-up performed. Result: Describe the value recovered, error corrected, control strengthened or recurrence prevented.

- Describe a time you had to handle confidential or sensitive information during an audit or investigation.
Model approach: Situation: Describe the confidential matter without disclosing protected details. Task: Explain your duty to preserve evidence, confidentiality and fairness. Action: Outline how you restricted access, maintained secure records, used objective evidence, followed investigation protocols and escalated through authorised channels. Result: State how the matter was resolved appropriately while maintaining trust, integrity and due process.

SMART QUESTIONS TO ASK

- What are the Authority's highest-priority strategic, operational and compliance risks for the coming financial year?
- How mature is the current risk management framework, and what role is this position expected to play in strengthening risk registers, control ownership and risk reporting?
- What are the most significant recurring audit findings, and how effectively have management action plans been implemented and tracked?
- How is the Internal Audit function structured, including reporting lines to management and functional access to the Risk and Audit Committee?
- Which financial systems, data analytics tools and audit management tools does the Internal Audit team currently use, and what systems audit coverage is most needed?

RED FLAGS TO WATCH FOR

- Lack of clarity on Internal Audit's independence, including pressure to report only through management or reluctance to provide direct access to the Risk and Audit Committee.
- A culture that treats audit as fault-finding rather than assurance and improvement, especially if management routinely disputes evidence-based findings or delays corrective action.
- Unclear investigation protocols, inadequate fraud-reporting channels or suggestions that sensitive matters should be handled informally without documentation and due process.