The CFO asks you to fix their data. Can you help?
The request is friendly and the fix looks quick. The interview tests whether you see what it would cost the audit.
The question
Wrenhollow’s CFO has seen your revenue analytics. The CFO asks whether your team could set up the same matching tool for the finance team to run every month, and in the meantime add the 141 missing delivery records to the ERP system so the exceptions clear before the audit closes.
- CFOYou know our data better than we do. Could your team set the matching tool up for us, and add the missing delivery records so those exceptions clear?
An auditor must not take on management responsibilities for an audit client, such as making management decisions or preparing or changing the client’s records. Designing or implementing systems that produce information for the financial statements creates a self-review threat and is prohibited for many audit clients. Explaining audit findings and recommending improvements is part of the audit. Refer any request for another service to the engagement partner before agreeing to anything.
“How do you answer the CFO, and what do you do next?”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: Name the problem
What would you do here? Open the move you’d make.
Agree to add the records: it’s quick, and the deliveries probably happened.
Tempting, but it misses something. Changing the client’s records is a management responsibility, and these records are the evidence you’re testing. It would break the audit trail.
Explain that adding records changes the evidence you audit, and building their tool means auditing your own work.
The strong move. It names both threats, management responsibility and self-review, in words the CFO can accept.
Say yes to the tool but no to the records, since software isn’t accounting.
Tempting, but it misses something. A tool that produces the revenue information you then audit is a self-review threat; for many audit clients it isn’t allowed at all.
See how a strong candidate says it
“I can’t do either as your auditor. Adding the records would change the evidence I’m auditing, and building your monthly tool would mean auditing my own work.”
Why it works: Naming the threats keeps a friendly request from becoming a judgment call made on the spot.
Step 2: Offer what you can do
What would you do here? Open the move you’d make.
Decline and leave it there: independence comes first.
Tempting, but it misses something. Correct but unhelpful. Explaining findings and recommending improvements is part of the audit, and it keeps the relationship.
Explain the exceptions and the evidence that would clear them, and recommend a monthly matching control.
The strong move. That’s normal audit communication, and it moves the CFO toward a better control without you doing management’s job.
Send the CFO your team’s analytics scripts to rerun.
Tempting, but it misses something. Handing over the tool is a softer version of building it. Take it to the engagement partner first.
See how a strong candidate says it
“What I can do is explain what the 141 exceptions are, what evidence would clear them, and recommend the finance team runs its own monthly matching.”
Why it works: Saying no to the service isn’t saying no to the client.
Step 3: Take it to the partner
What would you do here? Open the move you’d make.
Keep it informal: nothing was agreed.
Tempting, but it misses something. A request like this is exactly what the partner needs to know about, even when declined.
Tell the manager and partner today, and let the firm decide on any separate service.
The strong move. It puts the decision with the people accountable for independence.
Pass it to the firm’s consulting team as a sales lead.
Tempting, but it misses something. Selling another service to an audit client goes through the engagement partner and independence checks first.
See how a strong candidate says it
“I’d tell the manager and the engagement partner about the request today. Whether the firm could offer the tool as a separate service is their call with the independence team, not mine.”
Why it works: Independence decisions sit with the partner and the firm, and the request itself is worth recording.
Step 4: Keep the evidence clean
What would you do here? Open the move you’d make.
Accept the delivery records the finance team adds after your conversation.
Tempting, but it misses something. Records made after an auditor asks are weak evidence of a delivery months ago. Look for evidence made at the time, or from outside the company.
Ask for cash receipts and customer confirmations instead of new records.
The strong move. Evidence from outside the company, or made at the time, is more reliable than records made to clear an exception.
Drop the 141 from testing now that the CFO knows about them.
Tempting, but it misses something. Knowing about them changes nothing: they’re still $0.52m of revenue without delivery evidence.
See how a strong candidate says it
“The 141 still need evidence. I’d ask for cash receipts and customer confirmations, not records created now to clear the exceptions.”
Why it works: Records created to clear an audit exception aren’t evidence that a delivery happened months ago.
The answer, in short
- Decision
- Decline both requests as the auditor, offer the findings and a recommendation, and take the tool request to the engagement partner.
- Because
- Adding records would take on management’s responsibility and change the evidence; building their monthly tool would mean auditing your own work.
- What would change it
- Nothing about the records. The tool could be offered as a separate service only if the firm’s independence team allows it for this client.
Common traps
- Helping first and checking independence later.
- Saying no without offering what you can do.
- Deciding on a new service yourself.
- Accepting records created to clear an exception.
Check your answer
- Did I name the threats in plain words?
- Did I offer what an auditor can do?
- Did I take the request to the partner?
- Did I keep the 141 exceptions on evidence from outside?
Last reviewed Nov 9, 2026