Skip to content
// ← EVERY SEATRISK · COMPLIANCE · AUDIT

Top floor · The boardroom

Internal Auditor

The third line: checks independently that the first two did what they said they did, and reports to the board when they did not.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED

// 01 — WHAT AN INTERNAL AUDITOR DOES

An audit is a scope, a set of tests, a finding and a conversation nobody in the business enjoys. Credit review — re-reading a sample of approved files against the bank's own standard — is the audit that matters most to the lending line, and it is often a separate team with the same reporting independence.

// 02 — WHO ARRIVES HERE

Chartered accountants and audit-practice leavers, technologists into IT audit, and experienced credit people into credit review.

// 03 — WHAT THE INTERVIEW ASKS

These are the shapes the round takes, not a question bank — banks phrase them differently and the wording is never the point.

  1. 01How would you scope an audit of a process you do not know?
  2. 02The business disagrees with your finding. What now?
  3. 03How do you decide a finding is material?
  4. 04What is the difference between a control existing and a control working?
  5. 05How do you stay independent of people you sit next to?
  6. 06Tell me about a finding that changed something.

What the panel is listening for. Whether you can be evidenced and unpopular at the same time, and whether you understand why a control exists rather than only that it does.

Practise the round in the risk, compliance and audit quiz: one of its five questions is this seat's own, and every answer has the senior interviewer's read.

Take the quiz →

// 04 — ONE QUESTION, WORKED

QHow do you decide a finding is material?

A strong answer ties materiality to consequence rather than to the size of the exception: what could go wrong while the gap stays open, how often the process runs, and whether anything downstream would catch it. A small error in a process that feeds a regulatory return can matter more than a large one a reconciliation catches the next morning. The facts are agreed with the business first; the rating is then set against audit's own scale, so the argument happens once, on the evidence.

A weak one counts — a finding is material above a dollar figure or a number of exceptions — which rates a noisy, harmless process harshly and a quiet, dangerous one not at all.

The seat is tested on whether you can be evidenced and unpopular at the same time, and whether you understand why a control exists rather than only that it does. Credit review is where the third line meets the lending desk directly — a sample of files read cold against the bank's own standard — and the drills are that exercise in miniature, with a senior read to compare yours against.

START HERE · The case drills

THE IN-TRAY · ONE MINUTE

Make the call on one file.

A short file on the ground this page covers. Every option opens with how far it sits from a senior banker’s read.

THE FIRST QUESTION · THE BORROWER · ASSURANCE

The auditor's opinion on a borrower's accounts is 'except for': it could not verify the stock at one warehouse, which holds 30% of inventory. The stock is the bank's main security.

What do you ask first?

1 FILES · PICK A CALL ON ANY OF THEM

7 MORE ON THE BORROWER · ASSURANCE →WHERE DO YOU READ FROM? THE PLACEMENT →