Audit Techniques: Interviewing, Sampling, and Evidence Collection

Lesson 5 covered how on-site activities unfold. This lesson covers the specific techniques auditors actually use during those activities to collect evidence that's genuinely credible — not just convenient to write down.

Interview technique: open, closed, and leading questions

Three question types serve different purposes, and mixing them up produces weak evidence:

• Open questions ("Walk me through what happens when an employee leaves the company") invite the interviewee to describe a process in their own words — good for discovering how something actually works, including details the auditor didn't know to ask about directly.
• Closed questions ("Is the departing employee's account disabled the same day?") confirm a specific fact efficiently, once the auditor already knows roughly what they're checking for.
• Leading questions ("You disable accounts immediately, right?") suggest the desired answer within the question itself — and should generally be avoided, because they risk simply confirming what the auditor expected rather than surfacing what's actually true. An interviewee under mild social pressure may agree with a leading question's framing even if the real practice is less consistent.

A skilled interview typically opens with open questions to understand the real process, then narrows to closed questions to confirm specific details against the checklist (Lesson 4) — rarely the reverse.

Sampling: size and selection method both matter

Auditors virtually never review every record — they sample. Two decisions determine whether a sample produces a credible conclusion:

• Sample size — large enough to give reasonable confidence, proportionate to the risk and volume involved (a high-risk, high-volume control like access reviews across hundreds of employees needs more samples than a low-volume, low-risk one).
• Selection method — samples should be selected to avoid bias, not simply the records the auditee happens to hand over first. A sample entirely composed of auditee-selected "best examples" produces a conclusion about the best cases, not about typical practice.

A common credibility problem: an auditor accepts 3 pre-selected access review records the IT manager hands over, without asking to see the full population the sample should have been drawn from. This doesn't necessarily mean those 3 records are fake — but it means the auditor has no way of knowing whether they're representative, which undermines the evidence-based approach principle just as surely as no sample at all.

Triangulation: interview, document, and observation

The most credible evidence combines multiple independent sources rather than relying on just one:

• Interview — what people say happens
• Document review — what written records and logs show
• Observation — what the auditor directly sees happening (e.g., watching an actual access request go through the approval workflow, rather than being told it does)

When all three agree, confidence in the finding is high. When they disagree — an interviewee describes a process that the documented records don't actually support, for instance — that discrepancy is itself often the most important finding of the audit, more revealing than any single source alone. An auditor who only interviews, without checking documents or observing directly, has produced evidence that rests entirely on self-report — exactly the weak, unverifiable pattern flagged back in Lesson 1.

Putting it together

These techniques work together, not in isolation: an open interview question surfaces how a process is claimed to work, a closed question confirms a specific detail, a properly selected sample of records checks whether that detail holds across a representative set of cases, and direct observation (where practical) verifies it's not just a paper exercise. Skipping any one of these narrows the evidence base the eventual finding can actually stand on.