A good audit interview is planned around an objective, built from open questions that narrow to specific ones, and won or lost on the follow-up: the second question, asked after the first answer, is where auditors learn how a process really works rather than how it is supposed to. The interviewer talks for a fraction of the time, listens for the gap between what people say they do and what they actually do, writes the key answers down, and then corroborates them, because an interview on its own never proves that a control works. Auditing standards say so directly: inquiry alone is not enough evidence of a control’s effectiveness.
This guide covers the craft from end to end: the kinds of audit interview and what each is worth as evidence, planning, how to design questions from open to closed, the follow-up questions that do most of the work, listening techniques borrowed from investigative interviewing research, how to read hesitation and deflection without pretending to be a lie detector, note-taking and the interview memo, a ready-to-use interview guide, remote, group and executive interviews, turning what you heard into evidence, and a worked example from a manufacturer’s procurement audit. The site’s guide to being interviewed by internal audit covers the same conversation from the other chair, and is worth reading for what it tells auditees to expect.
In this guide
- What an audit interview is for, and what it is worth
- Planning the interview
- The funnel: designing questions from open to closed
- The second question matters most
- Listening techniques that surface the real process
- Reading hesitation and deflection
- Taking notes without killing rapport
- Go-to questions by audit area
- The interview guide template
- Remote, group and executive interviews
- From interview to evidence: corroboration
- Mistakes that cost the evidence
- Worked example: Brightwater’s contracts just under the tender threshold
- Questions about audit interviews
- Related guides
What an audit interview is for, and what it is worth
Internal auditors interview people at almost every stage of an engagement, and the purpose changes what a good interview looks like. The Global Internal Audit Standards list interviewing and surveying the people involved in an activity among the procedures for gathering information, in Standard 14.1. The same standard requires information to be relevant, reliable and sufficient, and says reliability is stronger when information is obtained directly or from an independent source, corroborated, or drawn from a well-controlled system. What someone tells you about their own work meets none of those conditions on its own, which is why interviews start the evidence trail rather than end it.
External auditing standards make the same point more bluntly. The PCAOB’s standard on audits of internal control ranks the tests of a control from the least to the most persuasive: inquiry, then observation, then inspection of documents, then re-performance, and adds a note that inquiry alone does not give enough evidence that a control is effective. Its standard on audit evidence says the same about inquiry of company personnel generally. The site’s guide to audit evidence covers the hierarchy in detail.
| Interview type | Purpose | Typical interviewee | Evidence value on its own | What must follow |
|---|---|---|---|---|
| Planning and risk interview | Understand objectives, changes and where management sees risk | Executives, process owners | Low; it shapes the plan | The engagement risk assessment |
| Process or walkthrough interview | Learn how the process actually runs, step by step | Process owner and the people who do the work | Low to moderate when paired with observation | Documents and a traced transaction; see the guide to walkthroughs |
| Control interview | Understand how a control operates, its evidence and its exceptions | Control owner and performer | Low | Inspection or re-performance of the control’s evidence |
| Cause interview | Find out why a finding happened | The people closest to the failure | Moderate, for the cause; not for the facts | Documents that support the explanation |
| Investigative interview | Establish facts in a suspected fraud or misconduct matter | Witnesses and subjects | Specialized; governed by protocol and law | Handled by trained investigators under the organization’s protocol |
The last row sets a boundary. Fieldwork interviews are fact-finding conversations with people who are, almost always, doing their jobs honestly. Investigative interviews, and in particular interviews meant to obtain an admission, are a different discipline with legal consequences, and belong to people trained for them. When a fieldwork interview starts to suggest fraud, the auditor stops probing and escalates, as the guide to the first 48 hours after internal audit finds fraud explains.
Planning the interview
The quality of an interview is mostly decided before it starts. Ten minutes of planning for a routine interview, and an hour for an important one, pays for itself many times over.
| Planning step | What to decide | Why it matters |
|---|---|---|
| Objective | The one or two things you need to know by the end | An interview without an objective drifts into a pleasant conversation that produces nothing |
| Interviewee | Who knows the answer, as opposed to who is most senior | The manager knows the policy; the clerk knows the process |
| Sequence | Whom to interview first | Usually the process owner first for the overview, then the people who do the work, then back to the owner with what you learned |
| Reading | What to read beforehand: procedures, prior reports, data | Asking for what you could have read wastes their time and signals you did not prepare |
| Hypotheses | What you expect to hear, and what would surprise you | Writing them down makes you notice when the answer differs, rather than hearing what you expected |
| Team | One interviewer and one note-taker for anything important | The interviewer can listen; the note-taker can capture the words |
| Setting | Their desk, a meeting room, or a video call; 30 to 60 minutes | People explain processes better at the place where they do the work |
| Notice | What you will tell them about the purpose in advance | “I’d like to understand how invoices get matched” sets a helpful frame; a bare calendar invitation from internal audit does not |
The step most often skipped is writing down hypotheses. Auditors who arrive expecting to hear that a control works tend to hear that it works; auditors who have written “if the matching is really automated, there should be no manual override queue” notice when someone mentions the override queue in passing.
The funnel: designing questions from open to closed
The standard structure for fact-finding interviews is a funnel: start with open questions that let the person describe things in their own words, narrow to focused questions about specific steps, and finish with closed questions that confirm specific facts. The order matters because open questions produce information you did not know to ask about, and closed questions asked too early shut that door.
| Stage | Purpose | Examples |
|---|---|---|
| Opening | Explain the purpose, put the person at ease, establish their role | “Thanks for making the time. We’re looking at how supplier invoices get from receipt to payment. Could you start by telling me what your role is in that?” |
| Open | Let them describe the process as they see it | “Walk me through what happens when an invoice arrives.” “What does a normal week look like for your team?” |
| Focused | Explore specific steps, exceptions and controls | “What happens when the invoice doesn’t match the order?” “Who can release a payment that’s on hold?” |
| Closed | Confirm specific facts | “So the tolerance is two percent or 150 dollars, whichever is lower?” “Is that approval recorded in the system?” |
| Closing | Check for gaps and set up the follow-up | “Is there anything I should have asked about but didn’t?” “Who else should I speak to?” “Could you send me the override report you mentioned?” |
The Association of Certified Fraud Examiners, whose manual is the standard reference for interviews in fraud work, organizes interview questions in a similar sequence: introductory, informational, assessment and closing questions, with admission-seeking questions treated as a separate, specialized kind of interview. The first four map closely onto a well-run audit interview. The fifth is the one that auditors outside an investigation should leave alone.
Two question forms deserve to be avoided at every stage. Leading questions (“You review these every month, don’t you?”) produce the answer the question suggests, and tell you nothing. Double questions (“How are invoices matched and who approves the exceptions?”) get an answer to whichever half the person prefers. Ask one thing at a time.
The second question matters most
The first answer to any question about a process is the official version: what the procedure says, what the person believes should happen, or what they think the auditor wants to hear. It is rarely false, but it is often incomplete. The second question, asked immediately after the first answer, is where the real process appears. Experienced auditors develop a small set of follow-ups they use almost automatically.
| Follow-up | What it uncovers |
|---|---|
| “What happens when that doesn’t work?” | The exception path, which is where most control failures live |
| “Can you show me?” | Whether the process described exists on screen and on paper |
| “When was the last time that happened?” | Whether a control that “always” operates has operated recently |
| “Who else can do that?” | Backups, shared logins and access nobody mentioned |
| “What do you do when you’re on leave?” | Whether the control depends on one person |
| “How would you know if it went wrong?” | Whether there is any detective control at all |
| “What changed in the last year?” | New systems, people, volumes and workarounds |
| “Is that written down anywhere?” | The gap between the documented and the actual process |
| “What would your manager say about that?” | A second perspective, and sometimes a disagreement |
| “You said ‘usually’. What happens the other times?” | The exceptions hiding behind soft words |
| “How long does that take?” | Whether a review described as thorough is physically possible in the time |
| “What’s the most frustrating part of this process?” | Workarounds, pain points and, often, control weaknesses |
The phrase to listen for most closely is any version of “should”. “The supervisor should review these” describes a design. “The supervisor reviews these every Friday and initials the report” describes an operation. The follow-up that separates them is always the same: “And does she? Can I see last Friday’s?”
Listening techniques that surface the real process
Most auditors talk too much in interviews. A useful target is for the interviewee to speak for at least three quarters of the time. The techniques below make that easier.
Silence. After an answer, wait. Count to five if you need to. People fill silence, and what they add after a pause is often the most useful part of the answer: the qualification, the exception, the thing they were not sure whether to mention.
Paraphrasing. Summarize what you heard in your own words and ask whether you have it right. It shows you are listening, corrects misunderstandings on the spot, and often prompts a correction that reveals more: “Not quite. The matching is automatic, but anything over tolerance goes to Sarah’s queue, and she can release it.”
Research-backed memory techniques. Psychologists Ronald Fisher and Edward Geiselman and their colleagues developed the cognitive interview in the mid-1980s to help witnesses remember events more completely, and set it out in their 1992 book on memory-enhancing techniques for investigative interviewing. Four of its techniques adapt well to process interviews.
| Technique | In the original | Adapted for an audit interview |
|---|---|---|
| Context reinstatement | Mentally return to the scene of the event | “Take me back to the last month-end close. What happened first, on the first morning?” |
| Report everything | Mention every detail, even ones that seem unimportant | “Don’t worry about whether it matters to us. Tell me everything you do, including the bits that seem trivial.” |
| Change the order | Recall events in reverse | “Let’s start from the payment and work backwards to the invoice.” |
| Change the perspective | Describe events from someone else’s viewpoint | “If the new clerk had to do your job tomorrow, what would they get wrong?” |
The reverse-order question is particularly useful for auditors, because people describe processes in the order the procedure presents them, and working backwards from an outcome, such as a payment or a journal entry, bypasses the procedure and forces the actual steps.
A structure from investigative interviewing. Police forces in England and Wales adopted the PEACE model in the early 1990s as a framework for ethical, non-coercive interviewing: Planning and preparation, Engage and explain, Account, Closure, and Evaluation. Its core idea, that an interview is an exercise in gathering an account rather than extracting a confession, is exactly right for audit work. The last stage, evaluation, is the one auditors skip: after the interview, ask what you learned, what contradicts what you knew, and what you now need to corroborate.
Reading hesitation and deflection
Auditors are sometimes told to watch for signs of deception in body language. It is poor advice. Research on lie detection, including a large meta-analysis by Charles Bond and Bella DePaulo published in 2006, found that people judging whether others are lying from their behavior do only slightly better than chance. Nervousness in an audit interview usually means the person is nervous about being audited, which is almost everyone. What auditors can do usefully is notice verbal signals that an answer is incomplete, and follow them up with questions rather than conclusions.
| Signal | What it may mean | What to do |
|---|---|---|
| Soft frequency words: “usually”, “normally”, “generally” | There are exceptions | Ask about the exceptions directly |
| A shift from “I” to “we” or “they” | The person does not do this step themselves, or does not want to own it | Ask who specifically does it |
| An answer to a different question | The question was unclear, or uncomfortable | Ask again, more simply |
| A long pause before a simple factual answer | Uncertainty, or a decision about how much to say | Wait; then ask what they are unsure about |
| “You’d have to ask IT” for everything | A process the person does not understand, or does not want to discuss | Ask what they see on their own screen |
| Detailed answers everywhere except one area | The area where the process does not work as described | Return to it later in the interview, from a different angle |
| Strong emotion about a colleague or another team | A real control problem, or a workplace conflict, or both | Note it, stay neutral, and corroborate before relying on it |
None of these signals is evidence of anything. Each is a reason to ask another question or to look for a document. The finding, if there is one, will come from the documents.
Taking notes without killing rapport
Notes are the raw material of the interview’s evidence value, and taking them badly can wreck the conversation. A few rules help.
- Tell the person you will take notes, and why: “I’ll jot things down so I don’t have to ask you twice.”
- For anything important, bring a colleague to take notes, so the interviewer can keep eye contact and listen.
- Write down key phrases in the person’s own words, in quotation marks, especially about how often something happens and who does it.
- Do not type loudly on a laptop between you and the interviewee. A notebook is less intrusive.
- Avoid recording audit interviews unless your function’s methodology provides for it and the person agrees. A recorder changes what people say, and it creates a record that has to be managed.
- Write the interview memo within 24 hours, while your memory can still fill the gaps in your notes.
The Standards list summaries of interviews among the common workpapers of an engagement. The memo is that summary, and it should be written so that someone who was not in the room can see what was said, by whom, when, and what the auditor plans to do to corroborate it.
Go-to questions by audit area
Every area has a handful of questions that reliably take an interview past the official version. The ones below are starting points for a first process interview; each is designed to be followed by “can you show me?”
| Area | Questions that open the real process |
|---|---|
| Payables | “What happens to an invoice that doesn’t match?” “Who can change a supplier’s bank details, and what do they check first?” “When did you last pay something without a purchase order?” |
| Payroll | “How do you find out someone has left?” “Who can change a pay rate, and who sees the change?” “What does the pre-payroll check actually compare?” |
| User access | “When someone changes jobs, what happens to their old access?” “Who reviews the access list, and what have they removed in the last review?” “Which accounts are shared?” |
| Inventory | “What happens when a count doesn’t agree to the system?” “Who can adjust stock, and what is the largest adjustment this year?” “Where is stock that isn’t in the system?” |
| Revenue and credit | “Who can issue a credit note, and who approves it?” “What happens when a customer goes over their limit?” “How do you know every delivery was invoiced?” |
| Financial close | “Which tasks are always late, and why?” “What gets booked after the close?” “Which reconciliations carry the same items every month?” |
| Treasury and payments | “What does a payment need before it leaves?” “Who can approve a payment they also entered?” “What would you do if the CFO emailed you an urgent payment request?” |
| IT change | “How does a change get into production in an emergency?” “Who can deploy without a ticket?” “When was a change last rolled back, and why?” |
The last question in the treasury row is worth asking in every payments interview, because the honest answer tells you more about the control over business email compromise than any procedure document. The site’s how-to-audit guides, including accounts payable, payroll and the financial close, each list the risks these questions are designed to reach.
The interview guide template
The template below is a one-page guide for a control or process interview. Filling it in beforehand takes fifteen minutes; completing the right-hand column during the interview turns it into the first draft of the memo.
Engagement and reference. Payables audit, workpaper B-2.
Interviewee, role and date. Payables supervisor; 30-minute interview; interviewer and note-taker named.
Objective. Understand how unmatched invoices are resolved and who can release them for payment.
What we already know. Procedure AP-04 (2023); the tolerance setting in the system; 130 overrides in the year from the data.
Hypotheses. Overrides are released by supervisors without a second review; the procedure predates the new matching tool.
Opening. Purpose of the audit and of this interview; how the notes will be used.
Open questions. Walk me through what happens when an invoice arrives. What does your team do with an invoice that doesn’t match?
Focused questions. Who can release an unmatched invoice? What do they check first? What’s recorded when they do?
Follow-ups to use. What happens when that doesn’t work? Can you show me the last one? Who covers when you’re away?
Closed questions to confirm. The tolerance; who has release rights; whether a reason code is required.
Documents to request. The override report for March; the list of users with release rights; the latest version of AP-04.
Closing. Anything we should have asked? Who else should we speak to?
Corroboration plan. Each key statement, and the document, data or observation that will confirm it.
Remote, group and executive interviews
| Situation | What changes |
|---|---|
| Video call | Ask the person to share their screen and show the process live; it is often better evidence than an in-person description. Keep cameras on for the conversation. Send the questions you will cover beforehand |
| Group interview | Useful for mapping a process that spans teams, poor for probing any one person’s role. Watch who answers for whom, and follow up individually with anyone who deferred |
| Executive | Shorter, higher-level, and planned more tightly: two or three questions about objectives, risks and concerns. Executives respond well to being asked where they would look |
| Interviewee who is anxious | Explain the purpose again, start with easy factual questions about their role, and make clear the audit is about the process. The guide to audit anxiety explains what they may be feeling |
| Interpreter or second language | Use short questions, allow more time, check key facts in writing afterwards |
| Former employee or contractor | Check with your manager and, if appropriate, legal before contacting them |
| Second interview with the same person | Bring back the specific points to clarify; show them what you found in the documents and ask them to explain differences |
From interview to evidence: corroboration
Every important statement in an interview needs a corroboration plan: the document, data or observation that will confirm or contradict it. The Standards describe corroboration, comparing information against more than one source, as one of the ways to make information reliable, and auditing standards treat uncorroborated inquiry as insufficient for any conclusion about a control. In practice, the corroboration plan is a column added to the interview memo.
| What the interviewee said | How to corroborate it | What contradicts it |
|---|---|---|
| “Every override is approved by a supervisor.” | The override report with approver IDs | Overrides approved by the person who raised them |
| “We review the report every Friday.” | The dated reports with reviewer annotations | Reports with no marks, or reviews dated weeks later |
| “Only three people can release payments.” | The system access list | Additional users, shared accounts, or IT administrators with release rights |
| “We never pay without a purchase order.” | Full population of payments joined to orders | Payments with no order, or orders raised after the invoice |
| “That hasn’t happened since we fixed it.” | The data after the fix date | Recurrences after the fix |
When corroboration contradicts the interview, go back to the interviewee before writing anything up. There is often an explanation: a report run with the wrong parameters, a manual workaround nobody thought to mention, or a misunderstanding of the question. And sometimes the interview was simply the official version. Either way, the finding rests on the documents, and the interviewee should hear about the difference from you. The site’s guide to walkthrough versus test of controls explains where interview evidence ends and testing begins.
Mistakes that cost the evidence
| Mistake | What it costs | The fix |
|---|---|---|
| Interviewing without reading the procedure first | Twenty minutes spent on what you could have read | Read everything available beforehand |
| Talking more than listening | You hear your own understanding reflected back | Aim for the interviewee to speak three quarters of the time |
| Leading questions | Answers that confirm your assumption | Open questions first, closed questions last |
| Stopping at the first answer | The official process, not the real one | Always ask the second question |
| No note-taker for an important interview | Notes that miss the exact words that mattered | Two auditors for anything that could become a finding |
| No memo, or a memo written a week later | Nothing reliable to cite, and nothing to corroborate against | Memo within 24 hours |
| Treating the interview as evidence the control works | A conclusion that will not survive review | Corroborate every key statement |
| Probing a fraud suspicion in the interview | A compromised investigation | Stop, and escalate under the protocol |
Worked example: Brightwater’s contracts just under the tender threshold
Brightwater Foods, the 180-million-dollar food manufacturer with three plants used across this site, ran its second integrated procure-to-pay audit a year after the first. The data analysis found seven contracts between 90,000 and 99,900 dollars, just below the 100,000-dollar threshold above which a competitive tender was required, and four of them had gone to the same vendor for work that read, on the purchase orders, like parts of one project. The full engagement is in the site’s guide to auditing procure-to-pay end to end. The interviews are what turned four suspicious-looking contracts into a finding with a cause.
Planning. The audit lead wrote down two hypotheses: that the work had been deliberately divided to avoid the tender, or that it had been genuinely separate work that happened to go to the same vendor. The interview objective was to find out which, and why. The sequence was the plant’s procurement buyer first, then the maintenance engineering manager who had raised the requisitions, then the plant’s finance controller. The team read the four purchase orders, the requisitions and the tender policy beforehand.
The buyer. The open question, “Walk me through how these four orders came to you”, produced the official version: four requisitions arrived, each within the buyer’s approval limit, each with a quote attached, and each was processed correctly. The second question was the useful one: “Did anything about them strike you as unusual at the time?” After a pause, the buyer said the four had arrived within a fortnight, and that she had asked the engineering team whether they should be combined. She had been told they were separate jobs.
The engineering manager. The lead used a reverse-order question, starting from the finished work: “Tell me about the line upgrade in March. What was done, from the last job backwards?” The manager described one continuous piece of work, a conveyor and filler upgrade on a single line, done during a planned shutdown. Asked how it came to be four orders, he explained without much hesitation that the tender process took about ten weeks and the shutdown window was fixed, so the work had been split into four packages that could each be ordered without a tender. He added that he had assumed that was acceptable because each order had its own quote.
The finance controller. Asked what would show whether this had happened elsewhere, the controller pointed to the capital project codes, which grouped spend by project regardless of how many orders it took. That became the corroboration route.
Corroboration. The project code showed the four orders, 380,000 dollars in total, against a single project, with invoices paid in full at contract price. The shutdown dates in the maintenance system matched the manager’s account. No other project in the year showed the same pattern. The manager’s explanation was consistent with every document the team found, and nothing suggested a personal benefit to anyone.
The finding. The report rated it Medium and called it displaced circumvention: the fix to the previous year’s splitting under the plant’s 10,000-dollar limit had moved the pressure up to the tender threshold. The cause came almost word for word from the engineering interview, a tender process too slow for planned shutdowns with no approved route for urgent work, and so did the action: a pre-approved route for shutdown work, with tender waivers approved above plant level and reported to procurement. None of it would have appeared in the data alone.
Questions about audit interviews
How long should an audit interview be?
Thirty to sixty minutes for most fieldwork interviews. Longer interviews tire both sides, and anything that needs more time is better split into two conversations with document review in between.
Should the interviewee’s manager attend?
Usually not. People describe their work more candidly without their manager in the room. If the manager insists, accept it, and consider a short follow-up conversation later on the points that matter.
Can an interview be the only evidence for a finding?
For the facts of a finding, no. Interviews can support a finding’s cause and context, but the condition should rest on documents, data or observation. Auditing standards treat inquiry alone as insufficient for a conclusion about a control.
Should audit interviews be recorded?
Generally not, unless the function’s methodology provides for it and the interviewee agrees. Careful notes and a prompt memo are the usual record.
What if the interviewee refuses to answer?
Ask why, calmly. Often the concern is about something specific, such as confidentiality or a colleague, that can be addressed. If refusal continues, it is an access issue for your manager and the chief audit executive, and the site’s guide to what internal audit can and cannot do covers the authority behind it.
What if an interview suggests fraud?
Stop probing. Finish the interview normally, without signaling suspicion, write the memo, and escalate to your manager or the chief audit executive the same day under the organization’s protocol.
Related guides
- When internal audit interviews you — the same conversation from the auditee’s chair.
- Mastering process walkthroughs — where interviews and observation meet.
- The walkthrough documentation template — recording what the interviews found.
- Walkthrough vs test of controls — where interview evidence ends and testing begins.
- Audit evidence — the evidence hierarchy, and why inquiry sits at the bottom.
- Professional skepticism — the discipline behind every follow-up question.
- The audit opening meeting — the first conversation of the engagement.
- Difficult conversations in audit — when an interview turns tense.
- Root cause analysis for audit findings — turning what people tell you into a cause.
- Fraud red flags — what to do with a signal before you escalate it.
- When internal audit finds fraud: the first 48 hours — the protocol that takes over from the interview.
- How to audit procure-to-pay end to end — the engagement behind the worked example.
- Audit anxiety — what the person across the table may be feeling.
Leave a Reply