8 Goldman Sachs Internal Audit Interview Questions With Sample Answers

A junior came to WSG one October, call him S, after striking out of Goldman's Investment Banking Summer Analyst race, figuring his shot at the firm was over. A month later, Internal Audit interviewed him. He walked out with an offer, competing against a fraction of the IB crowd.

I'm Stephen Turban, founder of WSG. Goldman took roughly 2,600 interns from more than 360,000 applications in 2025, under one percent, and the 2026 class ran just as tight . Internal Audit is one of the least crowded doors into that building, and most candidates it sees show up prepped for the wrong interview.

These are the eight Goldman Sachs Internal Audit interview questions that come up over and over, with what each is testing and a sample answer calibrated for a college junior, drawn from WSG students who interviewed with the division and from publicly reported interview experiences.

What does the Goldman Sachs Internal Audit interview process look like?

Apply online, then a HireVue recorded video interview, then live interviews with Internal Audit VPs and often an MD round, run as a superday for campus candidates. The exact process can vary by school, office, and role. Goldman still uses HireVue for campus recruiting in 2026, and the recorded round leans on behavioral questions built around the firm's Business Principles. The live rounds mix audit concepts with behaviorals, and it's the judgment questions, not the technical ones, that decide offers.

Bottom line: know the technicals, but don't treat the interview like an audit exam. Goldman is also evaluating whether you can communicate clearly, exercise judgment, and work effectively with others.

Is internal audit at Goldman Sachs a good job?

It's a real Goldman seat with unusual breadth: IA auditors see trading desks, asset management, engineering, and corporate functions from the inside, at one of the most scrutinized banks in the world. The trade-offs are real, too. Compensation is determined by the firm, division, and individual performance, and Goldman does not publish public compensation bands for Internal Audit. In practice, you should expect the role to have a different compensation trajectory from front-office investment banking or sales and trading.. Take the seat to build a risk and control career with a top-tier brand on it.

1. Why internal audit, and why Goldman instead of a Big 4 firm?

This question filters out everyone using Internal Audit as a consolation prize, which is most of the room. The interviewer wants evidence you understand what the function does and chose it on purpose.

Sample answer: "I want to learn how a bank actually works, and audit is the only seat that gets to look everywhere. At a Big 4 firm I'd audit whichever clients my office staffed. Here, the client is Goldman itself: the desks, the engineering, the new businesses. I'd rather go deep on one world-class institution than shallow on twelve average ones."

A version of this answer that names a specific GS division you'd want to audit first is stronger than any general enthusiasm.

2. What does Internal Audit actually do at a bank?

Interviewers expect the three lines of defense framework, and using it comfortably is what separates prepared candidates. First line: the business owns its risks and controls. Second line: risk management and compliance set frameworks and monitor. Third line: Internal Audit independently tests whether the first two actually work, reporting up to the Board's Audit Committee rather than to the businesses it audits.

Sample answer: "Internal Audit is the third line of defense. The desks own their risks, compliance and risk management oversee them, and IA independently checks that the controls both of them rely on are designed well and operating. The independence is the point: IA reports to the Audit Committee, so it can say things the business doesn't want to hear."

3. Walk me through the lifecycle of an audit.

Interviewers ask this to see whether you've done fifteen minutes of homework on the actual job. The clean structure: risk assessment and planning, walkthroughs to understand the process, testing control design and operating effectiveness, reporting findings with severity ratings, and validating that management actually fixed what it agreed to fix.

Sample answer: "Start with scoping: which business, which risks, which controls matter. Then walkthroughs with the process owners to map how things really work versus how they're documented. Then testing: does the control exist as designed, and did it operate over the sample period. Then the report, where findings get rated and management commits to remediation. Then validation, because a finding that never gets fixed wasn't worth writing."

4. What is a control, and what makes one effective?

This is the most failed conceptual question in the set because candidates have never had to define something so basic out loud. A control is a process or mechanism that prevents or detects a bad outcome. Effective ones are specific, assigned to an owner, and actually performed.

Sample answer: "A control is anything designed to stop an error or catch it fast: a trade approval limit is preventive, a daily reconciliation break report is detective. An effective control has a clear owner, triggers at the right threshold, and leaves evidence it ran. A sign-off that everyone rubber-stamps is a control on paper and not in practice."

Bring one preventive and one detective example and you're ahead of most finance majors in the room.

5. What are the major risk types at a firm like Goldman?

The interviewer is checking you can speak the risk vocabulary the division lives in. Market risk, credit risk, liquidity risk, operational risk, and reputational risk, with operational risk as IA's home turf: failed processes, systems, people, and fraud.

Sample answer: "Market risk from positions moving, credit risk from counterparties failing, liquidity risk from funding drying up, operational risk from broken processes or systems, and reputational risk sitting over all of it. Internal Audit touches everything but lives closest to operational risk, because most audit findings are process and control failures rather than bad market calls."

6. Tell me about a time you saw something wrong and had to speak up.

This is the question the whole interview is built around, because escalation is the job. Goldman's Business Principles get quoted in every info session for a reason: an auditor who buries an uncomfortable finding is worse than no auditor.

Sample answer: "As treasurer of my business fraternity, I found $700 in reimbursements with no receipts, approved by the previous treasurer, who was a friend. I flagged it to our president the same week, proposed a receipts-required policy going forward, and called the alumni advisor myself so it wouldn't look like I was hiding it. The friendship was awkward for a month, and the books were clean from then on."

Pick a story where escalating cost you something, because honesty that cost nothing doesn't prove much.

7. How would you audit our employee expense process?

Process-audit hypotheticals test structure, not expertise, and any process they name works the same way. Identify the risk, find the key controls, and describe how you'd test them.

Sample answer: "The risks are fraudulent or out-of-policy spend and errors in payment. Key controls: policy limits in the booking tool, manager approval, receipt requirements above a threshold, and a back-end analytics check for patterns like split transactions. I'd test a sample of expenses against policy, verify approvals actually happened before payment, and look at exception reports to see whether flagged items got followed up."

8. What's happening in the industry right now that Internal Audit should care about?

The current-events question tests whether you can think like a risk person. In 2026, AI, cybersecurity, and operational resilience are strong topics to know. Banks are adopting AI across areas such as productivity, customer service, and risk management, creating new questions around governance, model risk, data, third-party vendors, and human oversight. In April 2026, the OCC, Federal Reserve, and FDIC issued revised model-risk guidance emphasizing model governance, validation, monitoring, controls, and third-party risk. The agencies also said generative and agentic AI are evolving quickly enough that they require a different supervisory approach.

A strong answer connects the trend to the job: Internal Audit's role is to independently assess whether the bank's governance, risk management, and controls are keeping pace with how the business is changing.

Sample answer: "AI governance. Firms are putting AI tools into real workflows, which creates new questions IA has to answer: who validates the model's output, what happens when it's wrong, and can the firm explain a decision to a regulator. I'd also mention cyber resilience, because the audit plan at any major bank now has to cover technology as heavily as it covers the businesses."

Say this, don't say that

Why internal audit?

Don't say: "It's a great way to get my foot in the door at Goldman and move to the trading floor later."

Say: "I want the seat that sees the whole firm. Audit builds a risk and controls skill set I can use for a career, and Goldman is the most interesting place on earth to build it."

Tell me about a weakness.

Don't say: "I'm a perfectionist and sometimes care too much about details."

Say: "I used to sit on questions too long before asking them. During my research assistant job I lost two days misunderstanding a dataset I could have clarified in five minutes, and now I timebox confusion to an hour before I ask."

How to prepare in one weekend

Read the Goldman Sachs careers page for the division's own description and the Business Principles. Learn the three lines of defense until you can draw them. Write your escalation story and one process walk-through. Then do a full timed HireVue practice with your camera on, because the recorded round is where most rejections happen and it's the only part of this process you can fully rehearse.

Bring two questions of your own to the live rounds. The best one I've heard a student ask: "What's a finding you wrote that the business pushed back on, and how did it resolve?" Every auditor has that story, they enjoy telling it, and the answer teaches you more about the division's real culture than the entire information session.