Auditor interview questions and answers

A financial statement audit is an independent examination of a company’s financial statements by a qualified auditor, who gathers evidence and gives an opinion on whether they show a true and fair view in line with the reporting framework, such as Ind AS or IFRS. The auditor aims for reasonable assurance, which is high but not absolute, because audits use sampling and judgement and some fraud is hard to detect. Companies need audits because the people who rely on the accounts, shareholders, banks, investors, tax authorities and regulators, are not the people who prepare them. An independent opinion reduces the risk of relying on misstated numbers. In India the Companies Act requires every company to have a statutory audit, and in the UAE companies are generally required to have their accounts audited too. A good audit also gives management useful feedback on controls.

Assertions are the claims management makes, often implicitly, when it presents a number in the financial statements. For a balance like trade receivables, the assertions include existence, that the customers really owe the amounts; rights and obligations, that the company owns the receivables; completeness, that all amounts owed are included; and valuation, that they are shown at the amount expected to be collected after a loss allowance. For a class of transactions like sales, the assertions are occurrence, accuracy, completeness, cut-off, meaning recorded in the right period, and classification. There are also presentation and disclosure assertions. As an auditor I link risks to specific assertions, because the procedure depends on the assertion. For example, a confirmation tests existence of receivables, while reviewing subsequent receipts and ageing helps with valuation.

Internal controls are the processes a company uses to make sure transactions are authorised, recorded correctly and assets are protected. Examples are approval limits on purchases, segregation of duties between ordering, receiving and paying, monthly bank and ledger reconciliations, and IT controls such as user access rights. Some controls are preventive, like requiring two signatures for a payment, and some are detective, like a reconciliation that catches an error afterwards. Auditors care because the strength of controls affects the risk of material misstatement. If we understand and test key controls and they work well, we can rely on them and reduce the amount of substantive testing. If they are weak, we need more detailed testing. Under SA 265 we also communicate significant deficiencies to management and those charged with governance in writing, so the company can fix them.

I would say materiality is the level at which a mistake in the accounts would start to matter to the people using them, such as investors or lenders. Anything above that could change their decisions, so our audit is designed to find errors of that size. To set it, I pick a benchmark that users focus on: usually profit before tax for a profitable business, revenue or total expenses for a loss-making or not-for-profit entity, and total assets for an asset-heavy entity. I apply a percentage using judgement, for example around 5% of profit before tax. Then I set performance materiality lower, often 50% to 75% of overall materiality, depending on risk and past errors. I also keep qualitative factors in mind: a small payment to a director, a breach of a loan covenant or an illegal act can be material even if the amount is small.

There are four types. An unmodified, or clean, opinion is given when the auditor concludes the financial statements give a true and fair view in all material respects. The other three are modified opinions under SA 705. A qualified opinion is used when there is a material misstatement, or the auditor cannot get enough evidence on something, but the effect is not pervasive; the report says “except for” that matter. An adverse opinion is used when misstatements are both material and pervasive, meaning the statements as a whole are misleading. A disclaimer of opinion is used when the auditor cannot obtain sufficient appropriate evidence and the possible effects could be material and pervasive, so no opinion is expressed. Separately, an emphasis of matter or other matter paragraph can be added to draw attention to something, but it does not change the opinion itself.

Tests of controls check whether a control worked as designed throughout the period. For example, I might select 25 supplier payments and check that each was approved by an authorised person before release, and that the approval happened before payment. Substantive procedures look directly for misstatements in the numbers. They include tests of details, like vouching a sample of sales entries to invoices and dispatch notes, and substantive analytical procedures, like comparing interest expense with average borrowings times the interest rate. The two are linked. If controls test well, I can assess control risk as lower and reduce the extent of substantive testing. If controls fail, I rely more on substantive work and usually increase sample sizes. Some substantive procedures are always needed for each material area, whatever the controls show.

The main procedures are inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. Inspection means examining documents, records or physical assets, like reading a loan agreement or seeing a machine. Observation is watching a process, such as the inventory count. External confirmation is getting a direct written reply from a third party, like a bank or customer. Recalculation checks arithmetic, for example depreciation or interest. Reperformance means the auditor independently carries out a control, such as redoing a bank reconciliation. Analytical procedures compare relationships between data, and inquiry means asking knowledgeable people inside or outside the entity. Inquiry alone is rarely enough, so I combine procedures. The goal is sufficient appropriate evidence: enough in quantity, and relevant and reliable in quality, to support the conclusion for each assertion.

Professional skepticism means keeping a questioning mind and critically assessing evidence, instead of accepting things at face value. It does not mean assuming management is dishonest, but it does mean I do not let a good relationship with the client stop me from asking for proof. For example, in one audit, management explained a sharp rise in sales in March as a new distributor deal. Instead of accepting that, I asked for the distributor agreement and checked dispatch documents and cash received after year end. I found that part of the goods had been returned in April under a clause allowing returns, so revenue for those goods should not have been recognised in March. Skepticism is especially important in estimates, related party transactions and anything that looks unusual or comes from the person who benefits from the result.

An engagement letter, required by SA 210, records the agreed terms of the audit. It sets out the objective and scope, such as a statutory audit under the Companies Act, the auditor’s responsibilities and the inherent limitations of an audit. It also states management’s responsibilities: preparing financial statements under the applicable framework, like Ind AS or IFRS, maintaining internal control, and giving the auditor access to all records, information and people. It mentions the expected form and content of the report, and often covers fees, timelines, the use of other auditors or experts, and the requirement for written representations. It matters because it prevents misunderstandings later, for example a client assuming the audit will find every fraud, and it gives the auditor a clear basis if management limits access or refuses information.

The code of ethics describes five main threats. Self-interest, when the auditor has a financial or other interest, such as owning client shares or depending heavily on one client’s fees. Self-review, when the auditor checks work their own firm did, like preparing the books. Advocacy, when the auditor promotes the client’s position, for example in a dispute. Familiarity, from long or close relationships with client staff. Intimidation, when the client pressures the auditor, for example by threatening to change auditors over a disagreement. They are managed with safeguards: partner and firm rotation, using separate teams for any permitted non-audit service, independent quality reviews, and declining work that creates threats that cannot be reduced. In India, Section 144 of the Companies Act prohibits certain services, such as bookkeeping and internal audit, for the statutory auditor, and Section 141 sets out who cannot be appointed as auditor.

I start by understanding the entity: what it sells, its customers and suppliers, the industry, regulation such as GST or sector rules, ownership and related parties, and the reporting framework. I read last year’s financial statements, the predecessor auditor’s report and board minutes, and meet management and the audit committee. Then I understand internal control, walking through key processes like sales, purchases and payroll, and the IT environment, such as the ERP and who can post entries. Preliminary analytics, comparing this year with last year and budget, highlight unusual movements. From all of this, following SA 315, I identify risks of material misstatement at the financial statement level and at the assertion level, and mark significant risks such as revenue recognition, management override and complex estimates. I then set materiality and write the overall strategy and detailed plan, linking each risk to specific procedures.

Before the count, I review the client’s count instructions, the stock locations and any third-party warehouses, and plan where to focus based on value and risk. On the day, I observe whether counters follow the instructions: areas are marked, goods are not moved during the count, and two people count each area. I do test counts in both directions: from the floor to the count sheets for completeness, and from the sheets to the floor for existence. I record my test counts so I can check them against the final inventory listing. I note the last goods received note and dispatch note numbers to test cut-off later. I also look for damaged, expired or slow-moving goods, which may need to be written down to net realisable value. After the count, I trace my test counts and cut-off documents to the final valuation and investigate differences, as required by SA 501.

I select customers from the receivables listing, focusing on large, old and unusual balances, plus a sample of the rest. The client signs the request, but the audit team prepares and sends it, and replies come directly to us, often by email from verified addresses or through a confirmation platform, so management cannot intercept them. Usually I use positive confirmations, which ask the customer to reply in every case. For replies with differences, I reconcile them, since many are timing items like payments in transit, and treat unexplained ones as possible misstatements. For non-replies I send a reminder, and if there is still no answer, I perform alternative procedures: checking receipts after year end and vouching invoices to orders and dispatch documents. If management refuses to let me confirm a customer, I ask why, consider fraud risk and may need to modify my opinion if I cannot get alternative evidence, as SA 505 explains.

First I define what I am testing and why, for example existence of receivables or whether purchase orders are approved, then make sure the population is complete and pick the sampling unit, such as an invoice or a rupee. I decide whether to use statistical sampling, like monetary unit sampling, or a non-statistical approach. Sample size goes up when the assessed risk is higher, when tolerable misstatement or tolerable deviation rate is lower, when more errors are expected, and when I need higher confidence. It goes down if other procedures, like strong controls or analytics, already give assurance. I usually test very large or high-risk items separately and sample the rest. Selection should give every item a chance, using random, systematic or MUS selection. After testing, I project errors to the population, compare them with tolerable misstatement and decide whether I need more work, following SA 530.

I start by getting the complete general ledger journal data for the year and reconciling it to the trial balance, so I know nothing is missing. I then understand how entries are made: which are system-generated, who can post manual journals, and whether there is review or approval. Using data analytics, I filter entries against risk criteria, such as manual entries to revenue, cash or reserves, entries made by senior staff or unusual users, entries on weekends or after the closing date, round amounts, entries with no narration, and unusual account pairs like debit receivables and credit cash. I pay special attention to entries near year end and adjustments made after the trial balance. For the selected entries, I check the supporting documents, the business reason and approval. Under SA 240 this test is required in every audit because management override cannot be ruled out.

I start by getting the receivables ageing, checking that it adds up and agrees to the general ledger, and testing a sample of items to see they are in the right ageing bucket. For existence, I send positive confirmations to a sample of customers, focusing on large and old balances, keeping control of the process, and I reconcile any differences. For non-replies, I check receipts after year end and vouch invoices to orders and delivery documents. I test sales cut-off by checking dispatch notes and invoices a few days either side of year end, and I review credit notes issued after year end. For valuation, I review the expected credit loss calculation, overdue balances and disputes, and look for customers in financial difficulty. I also check for credit balances that should be shown as liabilities and that related party balances and disclosures are complete.

I begin by agreeing the fixed asset register to the general ledger by class, and preparing a movement schedule of opening balance, additions, disposals, depreciation and closing balance. For additions, I vouch a sample to invoices, contracts and approvals, check that the costs are capital in nature and capitalised from the right date, and look at repairs and maintenance for items that should have been capitalised. For disposals, I check approvals and sale proceeds, recalculate the gain or loss and make sure the asset was removed. For depreciation, I test the rates against policy and Schedule II, perform a proof in total and check useful lives are reasonable. For existence and rights, I physically inspect selected assets and check title deeds and vehicle registrations, which also supports CARO reporting. Finally, I consider impairment indicators like idle assets and review capital work in progress for delays.

I would first understand the payroll process and test key controls: approval of joiners, leavers and salary changes by HR, independent review of each month’s payroll, and restricted access to the payroll master. Then I would perform analytics, comparing monthly payroll cost with headcount and average pay, and investigating unusual months. For details, I would pick a sample of employees and agree their pay to appointment letters, increment approvals and attendance, and recalculate deductions. To test for ghost employees, I would check that leavers were removed on time and look for duplicate bank accounts or PANs. I would reconcile the payroll register to the general ledger, the bank payment file and statutory returns such as provident fund, ESI and TDS on salaries in Form 24Q, and check that dues were deposited on time, which is also a CARO reporting point. Finally, I would review accruals for bonus and leave.

GST returns are an independent record of what the company reported as supplies to the government, so comparing them with revenue in the books is a useful check on completeness and occurrence. I would get the GSTR-1 and GSTR-3B data for the year and reconcile the taxable value with revenue in the general ledger, month by month. Expected reconciling items include non-GST income like interest, exempt or non-taxable supplies, unbilled revenue under Ind AS, advances on which GST was paid before revenue was recognised, credit notes and cancelled invoices. After those, any unexplained difference needs follow-up: books higher than returns could mean under-reported GST, while returns higher than books could mean unrecorded sales. I would also reconcile the GST payable and input tax credit balances with the electronic ledgers, and consider whether any exposure needs a provision or disclosure.

Under SA 260, communication with those charged with governance is two-way and happens at planning and at completion. At planning, I explain our responsibilities, the planned scope and timing, materiality approach and the significant risks we have identified, such as revenue recognition or a complex estimate, and invite their views on fraud risks and other matters. During and at the end, I share significant findings: our views on accounting policies, estimates and disclosures, significant difficulties during the audit, such as delays in getting information, and corrected and uncorrected misstatements. Under SA 265, I report significant deficiencies in internal control in writing. For listed entities, I discuss the proposed key audit matters and confirm our independence, including non-audit services provided. I also raise any suspected fraud or non-compliance with laws. Good communication means the committee hears about problems early, not for the first time in the audit report.

Recurring losses and a large repayment due soon are clear indicators, so I would ask management for its going concern assessment covering at least twelve months from the reporting date. I would test the cash flow forecast: compare past forecasts with actual results, challenge growth and margin assumptions, and run downside scenarios. For the loan, I would see whether refinancing has been agreed, read correspondence with the bank, check covenant compliance, and look for evidence such as a signed term sheet or a letter of support from the parent, along with the parent’s ability to support. I would also review events after the year end and board minutes. Then I conclude: if the going concern basis is appropriate but a material uncertainty exists, I check the disclosure and add a material uncertainty section. If the disclosure is inadequate, I modify the opinion, and if the basis itself is inappropriate, the opinion would be adverse.

First I would not confront the manager. I would gather more evidence quietly: vendor master changes, bank account details, related addresses or PAN links, approvals and the pattern of payments. I would discuss it with my engagement partner and re-assess fraud risk, because if a senior person is involved, other evidence and representations from that person may be unreliable. Under SA 240, we communicate the matter to a level of management above the person involved and to those charged with governance, normally the audit committee. In India, Section 143(12) of the Companies Act requires the auditor to report fraud by officers or employees: amounts of ₹1 crore or more go to the Central Government, and smaller amounts to the audit committee or board, following the prescribed process. I would extend testing to estimate the effect on the financial statements, consider the impact on the opinion, and document everything carefully.

First I would re-check my own position: the facts, the calculation and the requirement in the accounting standard, and consult technical experts in the firm if it is a complex area. Then I would meet management, explain the issue clearly with the evidence, and listen to their reasons, because sometimes they have information I have not seen. If they still refuse, under SA 450 I would communicate the uncorrected misstatement to those charged with governance, usually the audit committee, and explain its effect on my report. I would evaluate it together with other uncorrected misstatements, in total and by nature. If the total is material, I would issue a qualified opinion, or an adverse one if pervasive, under SA 705. I would get written representations stating why management believes uncorrected items are immaterial, and document the discussions. Professional skepticism and independence mean I do not drop a material issue to keep a client happy.

Under SA 540 I would first understand how management calculates the provision, usually a provision matrix under Ind AS 109 or IFRS 9, plus specific provisions, and what controls exist over it. I would test the data: check the ageing report is complete and that invoices sit in the right buckets by tracing samples to invoice dates. Then I would challenge assumptions: recompute historical loss rates, see whether forward-looking adjustments reflect current conditions in the customers’ industries, and look at collections after year end. I would do a retrospective review, comparing last year’s provision with what actually happened. For major customers in dispute or financial trouble, I would read correspondence and legal advice. Where useful I would build my own point estimate or range and compare. Finally, I would consider whether management’s choices consistently push the estimate in one direction, which could indicate bias, and check the disclosures of credit risk and judgements.

IT general controls are the foundation for relying on anything the system does automatically. They cover access security, such as who can create users or post entries; change management, meaning program changes are tested and approved; and IT operations like backups and job monitoring. If these are effective, I can rely on automated application controls, such as three-way matching or credit limits, and on system reports like the receivables ageing, with lighter testing. I would test them by reviewing user access lists and periodic access reviews, checking that privileged and super-user access is limited and logged, and sampling program changes for approval and testing. I also check that the audit trail feature, required for Indian companies’ accounting software, is enabled and not disabled during the year. If ITGCs are weak, I cannot rely on automated controls, so I test reports directly for completeness and accuracy and increase substantive testing.

Under SA 600 I am responsible for the group opinion, so I start by understanding the group structure, which components are significant by size or risk, and how consolidation is done. I set group materiality and lower component materiality for each component. For the UAE subsidiaries, I evaluate the component auditor’s competence, independence and whether they work to ISA, which is aligned with SA. I send detailed instructions covering the risks I want addressed, materiality, reporting deadlines and what they must report back, such as identified misstatements and control issues. I stay involved through calls, reviewing their key working papers, especially on significant risks, and their final reporting. At group level, I audit the consolidation itself: alignment of IFRS figures to Ind AS, foreign currency translation of AED balances, intercompany eliminations, unrealised profit and goodwill. Finally, I evaluate whether the evidence from all components is sufficient for the group opinion.

I would treat it as a significant risk and start by getting management’s list of related parties and transactions, then test its completeness: directors’ declarations of interest, MCA records of directors’ other companies, shareholding patterns, board and audit committee minutes, bank confirmations and large contracts. I would use data analytics to match vendor and customer master data, like addresses, PANs and bank accounts, against related party details. For each significant transaction, I would check approval by the audit committee and, where needed, the board or shareholders under Section 188 and the listing regulations. I would assess the business rationale and whether terms are at arm’s length, comparing with prices for unrelated parties or market data. Transactions outside the normal course of business get extra attention. Finally, I would check Ind AS 24 disclosures and communicate significant matters to the audit committee, considering any impact on the opinion.

I would stay calm and polite but would not agree to sign without the evidence. The report date must be when we have sufficient appropriate evidence, and signing early would breach the standards and the code of ethics. Pressure like this is an intimidation threat, so I would inform my engagement partner immediately. I would explain to the CFO exactly what is outstanding, for example the legal opinion and the calculation behind the provision, why it matters to the opinion, and what we can do to finish quickly, such as working late or accepting draft documents now with signed copies later. If the deadline is regulatory, the partner may discuss it with the audit committee, which oversees the audit. If the evidence truly cannot be obtained, the right outcome is a modified opinion, not a clean one signed early. I would document the pressure and the discussions in the file.

Analytics let me look at whole populations instead of small samples, so I can target the riskiest items. The first step is always to check the data is complete and accurate, by reconciling extracted data to the trial balance. For management override, I run journal entry tests with filters such as manual entries to revenue, postings after the close, weekend entries, round amounts and unusual user and account combinations. For revenue, I match every invoice to dispatch records and cash receipts to spot sales without delivery or cut-off issues. In purchases, I look for duplicate invoices by supplier, amount and date, payments without purchase orders, and vendors sharing bank accounts or addresses with employees. Benford analysis on expenses can point to fabricated amounts. I use tools like IDEA, Excel Power Query or Power BI, keep the scripts and outputs in the file, and follow up exceptions with normal audit procedures.

At planning I confirm whether CARO 2020 applies, since some classes like small companies are excluded, and whether internal financial controls reporting under Section 143(3)(i) applies. I map each CARO clause to work we already do or need to add: fixed assets and title deeds to the PPE audit, inventory physical verification to the count, statutory dues to payroll and tax testing, loans and guarantees to the related party work, and frauds and whistleblower complaints to fraud procedures. For IFC, following the ICAI guidance note, I document key processes and risks, test the design and operating effectiveness of controls, including IT general controls, and evaluate any deficiencies for whether they are material weaknesses. Near completion, I check the three outputs are consistent: for example, a material misstatement corrected late may point to a control weakness, and a qualification in the main report should be reflected properly in CARO and IFC reporting.