LIKELY QUESTIONS
- How have you developed and implemented risk-based internal audit strategies, policies, and procedures in your current or previous organization?
- Can you describe your experience preparing annual risk-based audit plans and presenting them to an Audit Committee or Board committee for approval?
- How do you assess the adequacy and effectiveness of internal controls across finance, procurement, operations, and compliance functions?
- Tell us about a time you reviewed organizational manuals, policies, or procedures and identified gaps affecting efficiency, compliance, or accountability.
- What approach do you use to monitor enterprise risk management, including risk profiling, risk appetite, and maintenance of risk registers?
- How have you evaluated budget processes and financial controls to provide assurance on compliance, accuracy, and value for money?
- This role requires close engagement with management while maintaining independence. How do you balance collaboration with objectivity as a Principal Internal Auditor?
- What audit, governance, and compliance risks do you think are most relevant to a state corporation like KAGRC, and how would you prioritize them in your first 6 months?

BEHAVIOURAL QUESTIONS
- Describe a time you identified a major control weakness that management had overlooked.
Model approach: Situation - Internal audit review found a high-risk gap in procurement/payment controls. Task - Establish facts, quantify risk, and recommend corrective action without damaging relationships. Action - Gathered evidence, tested transactions, benchmarked against policy and law, held fact-based discussions with process owners, graded the risk, and proposed practical controls with timelines and owners. Result - Management accepted recommendations, controls were strengthened, exposure reduced, and follow-up confirmed closure.

- Tell us about a time you had to influence senior leaders or an Audit Committee to act on a difficult audit finding.
Model approach: Situation - A sensitive finding involved a long-standing practice with compliance and reputational implications. Task - Present the issue clearly and secure action from senior stakeholders. Action - Built a concise paper with evidence, root cause, risk impact, and options; aligned the message to governance responsibilities; answered challenge calmly; and recommended a phased remediation plan. Result - Audit Committee endorsed the recommendations, management implemented corrective measures, and reporting improved.

- Give an example of when you helped build or improve a risk register or enterprise risk management process.
Model approach: Situation - The organization had fragmented risk reporting and inconsistent risk scoring across departments. Task - Create a more reliable, organization-wide risk profiling process. Action - Engaged department heads, defined scoring criteria, facilitated risk workshops, mapped strategic and operational risks, assigned owners and mitigation actions, and introduced regular review cycles. Result - A usable risk register was established, reporting became consistent, and management could prioritize mitigation based on risk appetite.

- Describe a time you managed competing audit priorities under tight deadlines.
Model approach: Situation - Several assurance assignments and committee reporting deadlines converged at the same time. Task - Deliver quality work on schedule while managing the team and stakeholders. Action - Reprioritized work using risk impact, delegated clearly, set milestone check-ins, communicated timelines early, and escalated only where necessary. Result - Key audits and reports were delivered on time, high-risk areas received coverage, and stakeholder confidence was maintained.

SMART QUESTIONS TO ASK
- How is the internal audit function currently positioned within KAGRC in terms of reporting lines, independence, and access to the Audit Committee?
- What are the top governance, compliance, and operational risks KAGRC wants the incoming Principal Internal Auditor to address in the first year?
- How mature is the Centre's enterprise risk management framework, particularly around risk appetite, risk registers, and management accountability for mitigation actions?
- What is the current status of implementation of previous internal audit and external audit recommendations across the Centre?
- How does KAGRC measure success for this role in the first 6 to 12 months: audit plan delivery, control improvements, risk management maturity, or another set of outcomes?

RED FLAGS TO WATCH FOR
- If they describe weak audit independence, unclear reporting to the Audit Committee, or pressure for audit to be management-controlled, that is a concern.
- If they cannot clearly explain major current risks, status of unresolved audit findings, or management's responsiveness to recommendations, that may signal poor governance culture.
- If expectations are very broad but resources, team capacity, systems, or leadership support for internal audit are unclear or inadequate, the role may be set up for frustration.