IT Auditor (BFSI) interview questions

I've been in IT audit for nine years, four in Oman. Started in external audit at a Big-Four firm in India focused on IT general controls (ITGC), moved to internal audit at a regional bank, and for the past three years I've been senior IT auditor at an Omani Tier-1 bank. My remit covers ITGC, application controls, cybersecurity audit, third-party assurance, and supporting our annual SOX and CBO reviews. CISA and CRISC certified. I report to the head of internal audit and run a small team of two auditors.

Start with the audit universe and risk assessment to confirm what's in scope and why. For each audit, define objectives clearly: what control objectives are we testing, what risks are we assessing. Then planning: identify the systems and processes in scope, the control owners, the evidence I'll need, the testing approach (walk-throughs, sample-based testing, full-population analysis with data analytics where possible). Scoping memo signed off by my audit head. Then fieldwork: testing per the plan, documenting evidence, raising preliminary findings, holding closing meetings. Final report with management responses. Strict timeline; audit findings late are far less actionable.

Five core areas. Access management: do user accounts get provisioned and de-provisioned per policy, are privileged accounts reviewed? Change management: are changes tested, approved, and deployed properly? Computer operations: are jobs scheduled, monitored, and incidents managed? Backup and recovery: are backups taken, tested, and restorable? Information security: is the security program functioning, are vulnerabilities managed? For each I test through walk-throughs (does the control exist and is it operating), then sample testing (over a 12-month period, does it operate effectively). Document findings with evidence and rate severity.

Data analytics moves audits from sample-based to full-population testing. Examples: pull all change-management records over 12 months and check programmatically for missing approvals; pull all privileged-access actions and look for after-hours activity outside business need; analyse all transactions for segregation-of-duties violations. Tools: ACL, IDEA, or simple SQL where the data is accessible. I'm not chasing every anomaly; analytics surfaces patterns that warrant follow-up. The benefit is testing the whole population, not just a sample, which catches issues samples might miss.

Treat them as partners, not as suspects. I open every audit with a kickoff meeting explaining the scope, the timeline, and how findings will be communicated. I share preliminary findings during the audit so there are no surprises at the closing meeting. I listen seriously to management responses; sometimes a finding is incorrect or there's a control I missed. I follow up after the audit to support remediation, not just to verify it later. Auditees who fear audit are usually responding to bad auditor behaviour; the relationship can be rebuilt with consistent professionalism.

For a senior IT auditor role at this seniority in Oman banking I'd target OMR 1,600 to 2,100 total package depending on the team scope and audit-universe complexity. Banking IT audit commands a premium because of regulatory scrutiny. I'm on 60 days' notice. Beyond pay I'd value continuous learning opportunities; audit skills decay if you don't keep up with changing technology.