How to Answer 'Tell Me About a Time You Found a Control Failure' in an Interview

Somewhere in most audit and compliance interviews, the conversation turns to a version of this question: "Tell me about a time you found a control failure." Interviewers ask it because the answer reveals almost everything they care about at once, whether you can spot a problem, prove it, handle the person on the other side of it, and drive it to a resolution. A weak answer treats it as a war story. A strong answer treats it as evidence of how you think.

The trap is going straight to the drama of the failure. What the interviewer is actually assessing is your process and your professionalism under friction, not the size of the mess you found.

The framework

Structure your answer around five beats, in order:

• Situation. One or two sentences of context: the process, the control, and why it mattered. Enough to orient, no more.
• What tipped you off. The specific signal or anomaly that made you look closer. This shows curiosity and pattern recognition rather than luck.
• How you validated it. How you confirmed it was a real failure and not a misunderstanding, the testing, the sampling, the corroboration. This is the part interviewers weight most, because it separates a rigorous auditor from someone who jumps to conclusions.
• How you handled the relationship. How you raised it with the control owner, managed defensiveness, and kept the exchange fact-based. Findings involve people, and how you deliver one determines whether it gets fixed or fought.
• The outcome. What changed, the remediation, the process improvement, the reduced exposure, and ideally what you learned.

Keep the failure itself modest and real. You do not need a catastrophic fraud. A well-explained access-review gap says more about your competence than a dramatic story you narrate loosely.

A strong example

"We were auditing user access for a financial reporting system. During walkthroughs I noticed that the quarterly access review was signed off, but the sign-offs always came within a day of each other across every department, which seemed fast for a genuine review of hundreds of users.

I compared the current entitlement export and activity logs against the HR termination roster. I found several terminated employees still holding active accounts, including two with the ability to post journal entries. So the control existed on paper and was being attested to, but it was not actually being performed.

Rather than lead with 'your control failed,' I walked the process owner through what I'd found and asked how the review was being done. It turned out reviewers were approving the whole list without checking it against HR terminations. We confirmed whether that reconciliation was part of the documented control, classified it accordingly (an operating-effectiveness failure where the step existed, a design gap where it did not), and separately flagged the failed termination-deprovisioning control. The remediation built the reconciliation against the termination feed into the review, and the two risky accounts were disabled that week."

This works because every beat is present. The tip-off is specific and plausible, the validation is concrete testing rather than a hunch, the relationship is handled without antagonism, and the outcome is a durable process change with a clear risk that was closed.

A weak example

"At my last job the controls were a mess. I found out people had access they shouldn't have, which was a huge risk. I told my manager and we escalated it, and eventually it got cleaned up. It showed how important internal audit is."

Compare the two. The weak answer names no control, no signal, and no test, you cannot tell whether the candidate actually found anything or repeated what someone else said. "The controls were a mess" is a judgment with no evidence behind it, which is exactly the habit auditors are trained out of. There is no relationship management, no owner, and the outcome is passive: things "got cleaned up" with no visible role for the speaker. The closing platitude fills the space where a lesson should be.

Preparing your own answer

Before the interview, write out two or three real examples using the five beats, and rehearse the validation step until it is specific. Name the control, the anomaly, and exactly how you confirmed it. If your finding was minor, that is fine, pick the one you can explain most rigorously, because rigor is what is being tested.

Two cautions. Do not badmouth the control owner or the former employer; interviewers read that as a preview of how you would talk about them. And do not inflate the story, an experienced interviewer will probe the validation step, and an exaggerated finding falls apart under two follow-up questions. A modest, well-evidenced answer beats an impressive one you cannot defend.