auditor-interview-prep
Use this one to three weeks before an audit, once the audit plan or agenda is known. You get a new folder, ./auditor-interview-prep/, holding a one-to-two-page briefing note for each person the auditor will interview, with the likely questions, the records they should open and how to answer (briefs/<role>.md, one per role), and a timetable of the interview sessions with topics, backups and the coordinator (schedule.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The aim is people who can show what they do, not people who recite policy.
Inputs to gather
Read the audit plan or agenda, the control list or applicability statement with owners, the policies and procedures each role is named in, the last audit report and its findings, and the evidence folder. Ask the reader in one message: which roles the auditor has asked to meet, who is new in their role, which areas had findings before, and who coordinates on the audit day.
Step 1: map roles to what the auditor will test
For each interviewee role, list the processes they own or operate, the controls mapped to them, the risks they own, and any open finding in their area. Leadership gets questions on direction, resources, risk decisions and management review, and each executive should be able to name one decision from the last review and what changed because of it; process owners on how their process runs and how they know it works; engineers and operators on the real steps, the last time they did them and where the record is.
Step 2: write the likely questions
Write 8 to 12 questions per role, in the auditor's style: open, about the last real occurrence, and followed by "show me". Put the audit period at the top of every brief; the last occurrence the person names must fall inside the window the auditor samples from, or they should know why there was none. Examples: "Walk me through the last person who left. Show me when their access was removed." "How do you decide whether a change needs approval? Show me an emergency change from this period." "What did leadership decide at the last review, and what happened next?" For framework-specific topics a role must speak to, run a framework lookup on what the auditor is likely to probe rather than inventing it.
Step 3: list the records each person opens
For each question, name the record that answers it and where it lives, and have the person open it once before the audit. An interviewee who can open the right ticket in thirty seconds needs fewer words than one who describes the process from memory.