Prepare for an auditor interview by re-reading the control description, knowing what you actually do, and answering with facts and examples. Describe the real process, including its rough edges. Never recite what the policy says if the practice differs. Auditors trust consistent answers.
Why the interviews matter
Documents show what you intended. Interviews show whether the people running the controls know about them. If the policy says two reviewers approve changes and the engineer says one, the auditor will test both and write up the difference.
Before the interview
Read the control description and the evidence you provided for it. Know the tool names, who approves what and where records live. If you own a control, be ready to walk through a recent real example from start to finish.
Brief the team on the format. Tell them it is a conversation about how work is done, not a quiz.
During the interview
Answer the question asked. Short and accurate beats long and defensive. Use examples such as "On 12 September we onboarded two engineers, and here is the ticket."
If you do not know, say so and offer to find out. Guessing is the fastest way to create a finding. Do not describe a plan as if it were an operating control. "We plan to start quarterly reviews next month" is honest and fine.
When practice and policy differ
This happens in nearly every organization. Raise it with the audit lead before the interview, not during it. Then you can either fix the practice, update the policy or agree how to describe the gap. Hiding it rarely works because the evidence samples will show it.
After the interview
Send any follow up evidence promptly and keep notes of what was asked. If an answer was wrong, correct it in writing as soon as you notice.
Questions you can expect
For access: how do you grant, review and remove access? For change management: walk me through the last production change. For incidents: tell me about the last time you responded to an alert. For vendors: how do you decide whether a new tool is safe to use? For people: what happens in a new hire's first week?
Practice answering each in two minutes using a real example. You will notice quickly where your own understanding has gaps.
Tone
Be friendly and straightforward. Auditors are not opponents. They are trying to form an opinion from evidence, and clear answers help them do that. Short pauses to think are fine. Offering to show the system live is often the best answer to a hard question.
Remote interviews
Many interviews now happen on video. Test your connection and screen share ahead of time. Keep the relevant system open in another window so you can show a live example. Close chat and email so that nothing sensitive appears on screen by accident.
Quick check
Should the compliance lead sit in every interview?
It helps to have someone note questions and follow ups, but let the control owner answer. The auditor wants to hear from the person who does the work.
Last reviewed: 19 October 2026.
