Compliance Analyst interview questions
What does a Compliance Analyst interview ask?
One question per competency the role leans on, 8 in all, the core ones first. Interviewers are not testing whether you know the frameworks; they are testing whether you have run the practice. Answer each with a case, a decision and the evidence: what the situation was, what you decided and why, and what the evidence showed afterwards.
- 1. Regulatory change management, core to the role
A new regulation lands. How do you decide what changes in your program by when, and how do you prove you noticed in time?
A strong answer shows: Spots a regulatory change, decides applicability, assigns actions, updates controls and keeps the implementation evidence.
- 2. Control design and operating-effectiveness testing, core to the role
Pick one AI control and tell me how you would test that it operated all year, not only that it was designed.
A strong answer shows: Maps risks to preventive, detective and corrective controls, then tests design and operation with samples, evidence and defensible findings.
- 3. Evidence collection and audit-ready documentation, core to the role
What evidence would you have ready before an auditor asks about an AI system, and how do you produce it as a byproduct of the work?
A strong answer shows: Collects, labels and preserves the evidence that a control operated, a decision was made, and a claim can be defended to an auditor or regulator.
- 4. Framework crosswalking without false equivalence, required
Map one control to the EU AI Act, NIST AI RMF and ISO/IEC 42001 at once, and tell me where the mapping breaks.
A strong answer shows: Compares the EU AI Act, NIST AI RMF, ISO/IEC 42001 and sector rules by intent and control objective, and says where they do not overlap.
- 5. EU AI Act obligations and timelines, required
Classify a specific AI system under the EU AI Act and name the obligations that follow, including what applies now and what is deferred.
A strong answer shows: Classifies a system by role and risk tier, knows which obligations bind on which date after the Digital Omnibus, and what evidence conformity needs.
- 6. US federal and state AI regulation, required
A US company operates in several states. How do you track which state AI laws apply to which systems, and what changes when a new one passes?
A strong answer shows: Tracks executive orders, OMB guidance, agency rules and the state patchwork, and knows which state laws reach hiring, insurance and consumer decisions.
- 7. Working AI fluency, required
Walk me through a task you now do with an AI tool. Where did you stop trusting its output, and how did you know?
A strong answer shows: Uses generative AI tools daily, knows what a model can and cannot do, and can say where an output should not be trusted.
- 8. AI policy and standards writing, preferred
Show me how you turn a principle like human oversight into a policy clause an engineer can implement and an auditor can test.
A strong answer shows: Writes policies with scope, responsibilities, requirements, exceptions and evidence, so people can follow them and auditors can test them.
Where the answers come from
Each question is graded on GAGE before any interviewer asks it: every topic is passed by explaining it back, and a passed explanation can be defended out loud. That record is the case you bring into the room. Check which of these 8 you can already answer from proof.