So for any interview of course the key is in the preparation. It makes absolute sense as an auditor to make sure you have time in your agenda to define the objectives of the interview. You know what's the purpose here? Is this a technical deep dive into a topic that I really need to understand? Is this meant to just be a high-level demo and overview of something What are the topics I want to cover? Now I don't need to write out my questions rigidly because the you know we have to have some dynamism in the conversation but what is it I want to cover? Let's make sure I have a look at the in put maybe put an interview plan together. Of course I'm going to select interviewees based on what they do. Now usually this happens anyway as part of the audit planning So usually when I put an audit plan together that'll be circulated well in advance and I'll ask people, I'll say, okay, for this slot, I need to speak to the expert on that. uh you you know on your firewall or on this this lot I need to speak to somebody who does security architecture wherever it might be. Of course we'll have an appointment in our plan that should be there already so everybody should know when we're going to meet And preparing the work documents, this is something we'll walk through later in the course, but a work document is where you record the outcome of these activities. you record what interview you did and you record the salient points, the points that might be relevant in terms of evidence. So let's imagine you are doing an interview, you're about to start the interview, the best way to start is from the common courtesy point of view, thanking the person. for being there. If there is more than just yourself doing the auditor introduction, um I was just thinking of an audit I was doing literally the week week before this uh training delivery and I met so many new people um I almost went into robot mode a little bit with my introductions because every person I had to explain I'm uh where I'm from, uh what the audit was about, but it was important to do that each and every time so that every person who came in understood why we were there. comfortable with it. And we explain the scope and purpose. We describe the points about how the interview will be conducted and we ask the auditee or the interviewee have they got any questions about the process before we start? Is there anything they're concerned about that they want to clean And then we can kick the audit off or the interview off by asking that person to describe their role in the ISMS. Now as we've already said, we don't want to use guided questions. I think I've clarified that bit on already what we say is the best type of audit questions are the open-ended ones you know who what where and when or the best one I like is show me or tell me or explain to me Because if I say, you know, please would you explain your approach to conducting backups, I can leave the the uh the interviewee to really give me a description description um and just sit back and listen. In fact actually the less questions I'm asking in a way the better. Whereas if you're asking things like closed-ended questions, it would just be very difficult to conduct an interview. If I said to the auditee instead, do you have a backup policy? Yes. Do you do backups every day? Yes. I'd say you can imagine that's a pretty painful interview. And you probably won't get to the root of the importance content so open-ended policies far better so as I say the the open-ended ones are always the uh you know the best value so to speak A few other important principles to think about. In the end, if we want real evidence, we do need to ask for specifics. The danger is with some of these topics we can talk in a very general sense, you know, if we're taught, especially with technical topics. topics, you know, people talk quite broadly. So when I say ask for specifics, I say, okay, so you've described generally the principles of background So with system X, Y, and Z, which is in scope, can you specifically tell me how you do that here and actually try and dig into some detail? The more specific evidence I've got, the more likely it is to be relevant and useful. I also want to confirm that information. So again, so just to confirm you've told me A, B, C, and D. I want to make sure I've not misunderstood anything. everything. And paying attention to the meaning of words, what we mean by that is, you know, is somebody if somebody says, well we should be doing ABC That's very different to saying we are doing ABC, for example. So I although it might sound a bit pedantic, I do challenge those kind of things. things again I'm not catching people out right and say okay you've told me you should be doing those things so does that mean you are or it's something you plan to do um that's important to find out And there's a mention here of the familiarity or trust threat, which we'll have gone over in the sort of audit principles. It's important of course to be friendly and approachable during these interviews. I'm not certainly against that in any way. But of course there is a threat in an interview if we let's say have very close trust. or you know that person very, very well, that that can be a threat to independence to some degree. So you've always got to remember, you know, no matter how well you may get on or have a good relationship with that individual, to still be asking the right questions. and challenging where need to. Now equally when we bring an interview to an end, it's a good idea before we end it, of course, within the timeframe, that we ensure have we covered all the questions that we wanted to ask. Give a summary back to the interviewee circuit. The main things we discussed were my feeling is this and be honest. If they have told you something which could could potentially be a non-conformity keyword potentially. I will I will explain that. I'll say, look, I'm having a bit of a problem here. I had an interview recently um where the the audity kind of openly said that there were some controls that they didn't have in place and I was just frank enough with them to say okay Okay, I appreciate you've explained this. This could potentially be a non-conformity in this area because. And the reason I did that wasn't to say, haha, I found a problem. So give them the opportunity to respond. Not to frighten anybody, but let them think about have they missed something? Could they refer me to somebody else? Do they have an opinion on that? So I can then think about the bigger picture. So be honest in that case. If you've agreed during the interview for the auditee to provide more information, like they've said to you, well yes, we have a document on that topic, I'll send it to you, or I'll give you this evidence. Let's recap that at the end. So if I understand you rightly, you're going to send me, you know, the backup policy and the procedure document. Also, you allow the interviewee the option to ask you more questions Questions and of course the courtesy thing, thanking them for their time and their cooperation. Now, before we finish on interviews, there can be potential problems that occur during interviews that might to be tackled that you just need to be prepared for and aware of. Some of these are more frequent than others, but let's briefly look at those. You might hear what you call the unusual or unlikely statement What we mean by that is, as an auditor with experience, when you ask a question on a certain topic, you're quite used to the kind of answers you would get. An unusual or unlikely statement is just something that might take you by surprise So I had a case with one audity and this is the honest truth when I tell it. I asked this system administrator about patch management and vulnerability management and I said, you know, can you tell me a little bit about the way you approach patch management and he said to me oh well that's something we look at when we've got nothing else better to do because that's you don't expect that kind of response response and uh the first thing there is to say okay have i have i explained myself properly um you know can i rephrase it i said okay i said so just so i've got you clear i said what i mean here is that you know with the software on your estate, usually you would review every so often and ensure that any vendor software patches are applied. Do you have like a process for that? And he basically reiterated the same answer saying, well, basically in the end he said they didn't have a proper process for doing it. But it was just that the initial sort of almost flippant response caught me by surprise. So let's just make sure you you um you've got that right. If the auditee wants to pick interviewees that can be a problem. Now just to be clear, obviously when I'm planning an audit I don't know the names of all the people in the organization, so you know often I am saying, okay, I need to speak to the firewall engineer or I need to speak to the security architect, etc. So they will often not pick the employees but they'll tell me who those people are But if there's any reason why the RT is restricting who I can speak to, you know, let's say I want to speak to the expert on security testing. but for some reason they're not there and and everybody else they're putting in front of me doesn't have that knowledge, then it is down to me to deal with that. We do need to go back to the RDT and say, look, it's important that aspect speak to this person or somebody in this role. Remember that when an auditee enters into a contract or an audit client enters into a contract with a certification body, they are making a commitment to allow these interviews to take place. place. So I've never really encountered that. I've encountered situations where I've had audities and might not be the right ones because there was a misunderstanding. Well then we can clarify and deal with that. Interference of guides. So a guide is a person usually appointed by the auditee who usually coordinates the audit. especially on site the guide might be there present during interviews they might be there to help you you know move from room to room in the building or if it's an online um interview facilitate discussions and that's what they're there for. What they're not there to do is interfere with the audit process. And what I mean by that is if I'm interviewing somebody and the guide keeps jumping in and answering questions on the person on behalf of the person I'm interviewing or putting pressure on the interviewee, this would be a potential problem. And again, I have to admit that this is not something I've encountered too too much. But if that was to happen, your first thing is to have a pleasant word with that guide. Just to say, look, I appreciate your help. I know you trent help, but I do need to speak to that. the person directs, I need to get their perspective. If it was such a serious problem, you would have the right to ask the guide not to be present As I say, I've never had to go that far before, but remember as a lead auditor you can and should, where necessary, you know, use the terms and conditions of the audit This case. And if an interviewee is unavailable, we've mentioned this previously already, if you turn up when they're not there, for example, then of course it might be an opportunity to watch that person in action, you know, if they're responding to um an emergency or dealing with a problem you might actually see the real world way in which to deal with it but otherwise we've just got to make sure we readjust the plan we can't simply say well because that person wasn't available at 10 o'clock on Tuesday We've just wrote off that interview. It's down to us as lead auditors to readjust. So these are quite a few things that are important about interviews. One of the most important and regularly used information. Collection procedure