Principal Internal Audit & Risk Management Officer

LIKELY QUESTIONS

- How would you develop a risk-based annual internal audit plan for UFAA, and how would you ensure it aligns with the Authority's strategic objectives?
- Describe your approach to evaluating the adequacy and effectiveness of governance, risk management and internal control systems.
- How have you conducted a corruption risk assessment, and what practical mitigation measures did you recommend?
- What audit procedures would you use to review controls over receipt, safeguarding, reconciliation and reporting of unclaimed financial assets?
- Tell us how you would investigate suspected fraud, while preserving evidence, maintaining confidentiality and observing due process.
- How do you assess compliance with internal policies, the Public Finance Management framework, tax obligations and other statutory requirements in Kenya?
- What would you include in an internal audit report for senior management, the Audit Committee and the Board, particularly where high-risk findings remain unresolved?
- Explain your experience with audit follow-up, Quality Assurance and Improvement Programmes (QAIP), cash surveys, stocktaking and surprise spot checks.

BEHAVIOURAL QUESTIONS

- Tell us about a time you identified a significant control weakness that management had not recognised.
Model approach: Situation: Briefly describe the process or unit audited and the control gap. Task: State your responsibility to assess the risk and provide assurance. Action: Explain the evidence gathered, root-cause analysis, risk rating, stakeholder engagement and practical recommendations. Result: Quantify the outcome, such as reduced losses, improved compliance, stronger controls or closure of audit findings.

- Describe a time you handled resistance from management or staff during an audit.
Model approach: Situation: Describe the audit area and source of resistance, such as delayed records or disagreement with a finding. Task: Explain your duty to remain independent while maintaining constructive relationships. Action: Show how you communicated audit criteria, listened to management's perspective, validated facts and escalated appropriately where necessary. Result: State how the issue was resolved and how the working relationship or control environment improved.

- Give an example of an investigation into suspected fraud, misconduct or irregular expenditure.
Model approach: Situation: Summarise the allegation or red flag without disclosing confidential details. Task: State your role in planning or conducting the investigation. Action: Describe how you secured records, analysed transactions, conducted interviews, maintained chain of custody, documented evidence and observed due process. Result: Explain the conclusion, corrective action, recovery, disciplinary process or preventive controls implemented.

- Tell us about a time you led an audit recommendation follow-up that improved implementation rates.
Model approach: Situation: Describe a backlog of overdue or high-risk audit recommendations. Task: Explain your responsibility for monitoring implementation and reporting status. Action: Outline how you created a tracker, agreed action owners and deadlines, verified evidence of implementation and reported exceptions to the Audit Committee. Result: Give measurable improvement in closure rates, reduction in repeat findings or strengthened accountability.

SMART QUESTIONS TO ASK

- What are the Authority's highest-priority strategic, operational and compliance risks over the next 12 to 24 months?
- How is the Internal Audit function positioned within UFAA's governance structure, including reporting lines to the CEO, Audit Committee and Board?
- What are the most significant recurring audit findings or control challenges currently facing the Authority?
- What level of maturity does UFAA currently have in enterprise risk management, fraud risk management and its Quality Assurance and Improvement Programme?
- What would success look like for the person in this role during the first six and twelve months?

RED FLAGS TO WATCH FOR

- Lack of clarity on Internal Audit's independence, unrestricted access to records and personnel, or direct access to the Audit Committee and Board.
- A culture that treats audit as fault-finding, discourages reporting of fraud or corruption concerns, or routinely delays implementation of recommendations.
- High-risk responsibilities without adequate staffing, audit tools, investigation protocols, training budget or management support for follow-up.