Most control owners have never been interviewed by an auditor. They know their work well. They do not know what the auditor is listening for, how much to say, or what to do with a question they cannot answer. Left to guess, people tend to over-explain, describe the policy instead of the practice, or freeze.
Preparation fixes most of this, and it is not the same as coaching. This article covers who gets interviewed, what they are asked, how to brief each person, and where preparation stops.
Who auditors interview
The list is longer than the control owners, and it differs by audit type.
Control owners. The people who perform or are accountable for each control. They are asked how the control works, and often demonstrate it in a walkthrough.
Leadership. In a SOC 2 engagement, auditors commonly speak with senior management about the control environment, risk assessment and oversight, the areas of the common criteria that deal with governance. Many firms also ask leadership whether they know of any fraud, security incidents, or significant changes to the system during the period. The answers feed the auditor's understanding of risk, and they need to be accurate.
Staff outside the compliance program. ISO 27001 auditors routinely talk to people chosen during the audit, not only the ones you put forward. Clause 7.3 requires that people working under the organization's control are aware of the information security policy, their contribution to the ISMS, and the implications of not conforming. The auditor tests that by asking an engineer or a support agent directly. SOC 2 auditors do this less, though some firms include it.
What control owners are asked
The questions are predictable, which is what makes preparation possible.
What the control is. "Describe how a new employee gets access to production."
Who performs it and who approves it. Including who covers when the usual person is away.
How often, and what triggers it. A schedule, an event, or a request.
Where the record lives. Which system holds the evidence, and how the owner would find a given instance.
What happens when it goes wrong. An urgent request, a missed deadline, a rejected approval.
What changed during the period. New tools, new people, reorganizations.
How the owner knows it worked. Any check, report or alert that shows the control operated.
The last two questions catch people out most. A tool migration halfway through the period is a change the auditor needs to know about, because it may mean two populations and two sets of evidence. An owner who has not thought about it may not mention it, and the auditor finds it later in a sample.
A one-page briefing for each owner
The most useful preparation is a single page per owner, written by the compliance lead and read together in a short meeting. It holds:
The control description, word for word, as it appears in the system description or your control set. The auditor tests against this text.
The policy statement it supports, with the relevant line quoted.
The evidence for the period: where it is, what it looks like, and one example the owner can find quickly.
Known exceptions, if any, and how each was handled and recorded.
Changes during the period that affect the control.
The name of the audit coordinator, and how to route follow-up requests.
Reading the description aloud with the owner usually surfaces at least one mismatch with how the work is done. That mismatch is the point of the meeting. Resolve it before the interview by correcting the description, or by recording the gap with the coordinator so it can be discussed with the auditor.
How to answer well
Give each owner four rules. They hold for SOC 2 and ISO audits alike.
Answer the question asked. A clear, short answer, then stop. If the auditor wants more, they will ask. Volunteered detail about neighboring processes generates follow-up questions and sometimes widens scope.
Describe what you do. Not what the policy says, and not what you would do in an ideal week. If practice differs from the document, the auditor will find out from the sample, and an owner who described the ideal looks unreliable.
Say "I don't know" when you don't. Then say who would know, or that you will follow up. A guess has to be corrected later, and a correction damages trust more than an honest gap.
Show rather than tell where you can. An answer that ends with "here is the ticket" is stronger evidence than one that ends with "that's how we do it". As covered in types of audit evidence, inquiry alone does not support a conclusion.
Where preparation stops
There is a clear line, and every owner should hear it said aloud.
Preparation means helping someone describe their real work clearly and find their evidence quickly. Coaching means telling someone what to say regardless of what is true. The first makes the audit faster. The second is a misrepresentation to an independent auditor, and it can end the engagement and damage the report's credibility with every customer who reads it.
In practice, that means:
Never script answers. Give owners the questions, not the answers.
Never ask anyone to omit a known exception or a change.
Never brief staff for ISO awareness interviews with memorized phrases. An auditor can tell, and a recited policy statement does not demonstrate awareness. If staff cannot explain the policy in their own words, the fix is better training, not better rehearsal.
Never sit in on an interview to answer for the person being interviewed. If you attend, stay quiet unless asked.
The last interview: leadership and written representations
Interviews do not only happen at the start. At the end of a SOC 2 engagement, the auditor asks management for written representations: a signed letter confirming, among other things, that management has provided all relevant information and has disclosed known deviations, incidents and other matters that affect the report. Auditors also ask about events between the end of the period and the report date, because a significant change or incident in that window may need to be disclosed.
Brief the people who will sign. They need to know what the letter says before it arrives, and they need confidence it is true. That confidence comes from the same discipline as everything above: known exceptions recorded, changes disclosed, and owners who described their work as it is. A leader who learns about an exception for the first time when reading the representation letter has been badly served by the preparation.
Handling the interview logistics
Small things keep interviews short.
Schedule interviews in blocks, with the auditor's agenda sent to each owner the day before.
Ask whether the auditor wants a coordinator present. Firms differ.
Have one person take notes on every commitment made: "I'll send the export", "I'll confirm who approved that". Each becomes a tracked request.
Send follow-ups through the coordinator, not directly from the owner, so the record of what was provided stays in one place.
For a first SOC 2 audit, the difference between the two report types decides how much the interviews carry. In a Type I, inquiry and walkthroughs are a large share of the testing. In a Type II they set up the sampling. The comparison of SOC 2 Type I and Type II covers that distinction, and the ISO 27001 framework page covers the clauses that ISO interviews tend to test.
How TrustLynce helps
The auditor portal records each interview's follow-up requests against the control they concern, with an owner and a due date. Control descriptions, evidence and known exceptions sit in the same place, which makes the one-page briefing quick to assemble.