Use structured, respectful internal audit interviews to reveal how controls actually operate, then corroborate explanations with transactions, observation and system evidence.
Auditors may receive fluent descriptions of policy and still know little about what happens when work is busy, resources are unavailable or an exception occurs. A useful interview moves from general process intent to a recent concrete instance, then from that instance to the observable control. The interview is an evidence gathering method, not a memory test or an adversarial interrogation. Its value depends on psychological safety, careful follow up and independent corroboration.
Stage 1: Establish the Workflow and Role
Start by explaining the audit objective and the role being examined. Ask the employee which activity they perform, what initiates the work and what output signals completion. Open questions make it easier to hear the individual’s operating model before the auditor introduces expected answers. Note where responsibilities change hands and where automated systems influence decisions.
If the employee describes a responsibility outside their authority, ask who actually makes the decision. A person who correctly says “I cannot approve that release” may demonstrate an important segregation of duties, not a weakness in competence. Distinguish a knowledge gap from a legitimate role boundary.
A useful opening also identifies the conditions under which an interview could become uncomfortable. Let the interviewee know that the objective is to understand the work, not evaluate personal performance or allocate blame. If a specialist or supervisor must answer part of a question, arrange that follow up rather than pushing a worker to guess. The auditor can still ask direct questions about a known exception, but those questions should be framed around a transaction and its control rather than moral judgement. A respectful tone often increases the amount of usable factual detail.
Opening interview technique: ask the employee to draw or describe the workflow from the trigger to the output without first showing the audit checklist. Then ask the employee to identify the decision they personally can make and the decision another person must make. This often surfaces segregation of duties and exception authority more accurately than an organizational chart. The auditor can compare the explanation with process maps later, but should preserve the person's original description in the working paper.
Stage 2: Anchor the Discussion in a Recent Instance
Invite the employee to identify the last real example: A rejected delivery, a customer escalation, a non routine maintenance activity or an urgent access request. Recent examples reduce the temptation to recite a procedure and give the auditor a record that can be traced. Ask for dates or identifiers with care, avoiding unnecessary disclosure of personal data.
Use prompts such as “What happened just before you accepted this item?” and “What would have stopped this activity?” A sequence of concrete events is often more informative than a yes/no confirmation that a prescribed control exists.
Do not let a recently remembered example become the entire basis of the conclusion. The chosen instance establishes an audit trail, but there may be a significant difference between an ordinary event and a rare emergency. Ask what usually happens, what happened in the selected case, and how the difference was authorized. If the person cannot retrieve the record, note the reason and whether another custodian is responsible. An inability to recall an identifier is different from an inability of the management system to demonstrate a required decision.
Stage 3: Probe the Decision and Its Boundary
Ask who can approve, reject, override or defer the step, and under which conditions. Explore how the process deals with unavailable approvers, late shifts, manual corrections and incomplete source information. The purpose is to locate the boundary where a control must either act or fail, not to embarrass a worker with an obscure exception.
Where there is a digital workflow, ask for the actual screen or transaction state that indicates review, release or escalation. A manager’s explanation may be accurate at policy level while the deployed user permissions are different. Verify the implemented design rather than equating one person’s recollection with system behavior.
Boundary questions become particularly valuable at interdepartmental handoffs. Consider a maintenance engineer who has completed a machine repair but cannot release equipment into production. Ask who checks the post maintenance condition, who controls re start and where sign off resides. In a digital process, observe the status transitions rather than asking merely whether “the system blocks unauthorized release.” That phrase may conceal different permissions at different times. Document which control the worker can actually operate and which belongs to another role.
When an explanation remains abstract, introduce a concrete time bound prompt: “Tell me what happened with the last urgent delivery you handled.” Follow the answer to the system entry, physical location or authorization record. If no recent instance exists, choose another material control or note that observation was not possible in the audit window. Do not ask a worker to invent an example or alter normal operations to satisfy the auditor's preferred demonstration.
Stage 4: Observe or Reperform a Control Safely
With suitable permission, watch the person complete a normal activity, point out required acceptance criteria or demonstrate where evidence is retained. A safe walkthrough is particularly useful for physical controls, hazardous activities and interfaces where documents are not the main evidence. Do not ask staff to perform unsafe acts or create artificial records merely for the audit.
For complex controls, use a live or historical transaction. The worker explains their judgement, the auditor identifies the specified criterion, and both locate the evidence. When observation is not possible, record the limitation and choose a compensating evidence source.
When observing a process, distinguish normal process variation from an audit created performance. A prepared demonstration using dummy inputs may show knowledge but cannot by itself prove control execution on real work. Where safe and permitted, observe a routine activity in its real operating context and inspect the record arising from that activity. For high risk operations, auditors should not introduce unsafe simulations or interrupt critical work. If observation is restricted, explain the evidence limitation and consider historical traceability, maintenance logs or the organization's own verification records.
Stage 5: Corroborate and Explore Exceptions
Compare interview statements with the selected record, user role, work instruction, error log or system approval. Ask how unusual cases are documented and whether the employee knows the escalation route. Follow contradictions neutrally: “I see a different status here. What does that mean in this process?” is preferable to accusing the person of a bypass.
Where the answer affects a potential finding, obtain independent evidence. Interview testimony can be valuable, but uncorroborated claims about a technical control should not automatically be treated as proof that it operated on the sampled event.
Corroboration should follow the technical nature of the claim. If a person describes a physical lock, observe it and compare the maintenance or access rule. If a person describes automated segregation, check the system roles and the sampled decision. If a person describes escalation by telephone, seek call, ticket or handover evidence as appropriate. The standard of proof is not an arbitrary requirement for signatures; it is sufficient appropriate evidence that the relevant control achieved its intended outcome under the criteria being audited.
A useful follow up question distinguishes prevention from detection. “What stops an unauthorized release?” tests the preventive barrier, while “How would you know if one happened?” tests monitoring. Both may be necessary, but they involve different records and responsibilities. Interview the role who actually operates each mechanism. An operator's lack of access to monitoring logs should not be confused with the organization's failure to monitor; the second role and underlying records must still be tested.
Stage 6: Close With a Factual Playback
Summarize the workflow in the employee’s words and ask whether any essential step was misunderstood. Separate the facts demonstrated from matters requiring later verification. Give an opportunity to identify a missing record or the responsible owner of an unresolved question.
Good closure preserves trust and reduces errors in the report. It should not promise a favorable conclusion or negotiate a finding; the auditor still applies the agreed criteria objectively.
In the closing playback, avoid repeating potentially sensitive details in front of people who do not need to hear them. The auditor can explain that a record remains to be reviewed or a technical exception needs a second source, then agree on the evidence custodian and timing. A useful audit note separates the interviewee's statement from the auditor's observation. That separation prevents later report text from misrepresenting the worker's words as a verified operating fact. It also makes future review of the conclusion substantially easier.
Seven interview prompts to prepare
- Show me the most recent example you handled.
- What initiates this work and what tells you it is complete?
- Who can stop, approve or override this step?
- What happens if a required input is missing?
- Where can we trace the last exception and its resolution?
Illustrative Scenario: An Emergency Material Release
Illustrative scenario: a warehouse operator says rejected materials are never issued. A walkthrough identifies an emergency release function that only senior roles can access. The auditor asks about the latest use and checks the authorization, risk review and subsequent reconciliation. The control is more nuanced than the first answer suggested, and the audit now has a transaction trail to test.
The result may confirm an effective exception process or reveal a gap, depending on the evidence. The interview created a testable question without presuming fault.
For the emergency release example, a mature team would examine the relevant authorization procedure, the user permissions that allow the exceptional transaction, a genuine example of its use and the resulting reconciliation. An operator may understandably answer “never” because normal practice prohibits release of rejected material. The audit should not penalize that simplified explanation until it understands the exception architecture. Any finding should rest on how the authorized process actually operated during the selected event, not on the interview's first wording alone.
At close, record questions whose answers remain unresolved and avoid translating a person's shorthand into a sweeping finding. A statement such as “we never do that” may reflect the normal rule, while a controlled exception exists. Check the exception before treating the statement as proof of misrepresentation. When interview accounts conflict, summarize each factually and investigate the sampled control. This creates a respectful audit record that can support an independent technical review.
Closing Perspective
The best interview reveals the real operating sequence, the points where people exercise judgement and the evidence that a control acted when needed. Start with the employee’s workflow, locate a recent real event, explore authorization and exceptions, then corroborate the account. Keep the inquiry respectful and technically specific. An interview alone may identify where to look, but the resulting finding should rest on sufficient appropriate evidence. When auditors close with a clear playback and unresolved questions, they preserve trust while making the next evidence gathering step much more productive.
Reference basis: ISO 19011:2026, Guidelines for auditing management systems, and ISO 19011:2026 released. The decision aids in this article are editorial implementation guidance, not a verbatim standard requirement.
References & Further Reading
Source documents distinguish normative requirements, professional guidance and certification body rules. Consult the complete applicable publications before assigning findings.