Technical command
Check command of IIA Standards, COSO framework, SOX 404 control testing, walkthroughs, sampling methodology, and whether they can define control design versus operating effectiveness testing.
Evidence to listen for
- Commands the instruments, models, or reporting standards the role turns on
- Can build the analysis rather than only interpret someone else's
- Knows the assumptions inside a model and which ones actually drive the answer
- Fluent in the frameworks and disclosure regimes that apply
Five-point scoring guide
Cannot explain the instruments or standards they claim to work with.
Interprets others' analysis but cannot build or defend it.
Solid working command; thin on unfamiliar structures or standards.
Builds the analysis and knows which assumptions actually move the answer.
Cites COSO components by name, explains attribute sampling sizes, and distinguishes design from operating effectiveness testing without prompting.