ISO ARTICLES GAP ANALYSIS & RISK-BASED DECISIONS

Using Process Interviews to Challenge Existing Controls

Evidence-led guidance for prioritizing gaps and operational risks.

Strong process interviews test decisions, exceptions and actual work. Learn how to turn an interview into targeted evidence without treating testimony as conclusive proof.

ISO Toolkits Editorial Team Evidence led implementation insights Approx. 7 min read

A process interview should not feel like a memory test on ISO clause numbers. The interviewer is trying to understand how people make decisions under normal and exceptional conditions, how controls are embedded in work and where the actual evidence is produced. People may repeat official procedures sincerely while operating around them. Others may describe an informal practice that is effective but inadequately controlled. The interviewer’s value lies in designing questions that distinguish these possibilities.

Editorial illustration of operational evidence discussion related to using process interviews to challenge existing controls
Editorial illustration: Operational evidence discussion in an ISO management system context.

01Begin with the person’s work and the intended result

“How do you comply with ISO?” often invites prepared answers. “Take me through the last customer change you approved” grounds the conversation in an actual result. Clarify the process purpose, customer or legal constraints, inputs, outputs and points where an error would matter.

Ask the operator to choose a recent ordinary case, then obtain the associated record or system screen. Note what they personally decide and what requires authorization elsewhere.

Decision test: Ask what record would contradict this statement.

02Move from description to demonstrated transaction

A process owner can describe a control that exists on paper but rarely influences decisions. Requesting a specific event moves beyond intention into observed execution. The goal is not to embarrass a respondent; it is to examine the gap between design and practice.

Use neutral prompts: “Show the most recent case,” “Who released it?” and “What happened when the result failed?” Trace the sequence with timestamps and evidence while respecting data access permissions.

03Probe exceptions without leading the witness

Leading questions invite agreement and may hide unusual pathways. Instead of asking “Do you always approve late changes?” ask “Tell me about the last urgent change and what made it different.” Exception stories reveal local workarounds and authority limits.

Follow with “What would stop a release?” “Who can override that rule?” and “How would you know the override occurred?” Test the answers against logs, approvals and subsequent outcomes.

Editorial illustration of process verification and decision review related to using process interviews to challenge existing controls
Editorial illustration: Process verification and decision review in an ISO management system context.

04Compare roles at handoffs rather than seeking consensus

Purchasing, engineering and operations may each believe another function owns final acceptance. A group interview can create an artificial shared narrative dominated by the most senior participant. Independent accounts often expose the real interface.

Ask each role separately who decides, who performs, who is informed and what evidence travels with the handoff. Reconcile discrepancies using actual transactions and documented authorities.

Operating test: Check the latest routine case and one abnormal event.

Decision Matrix: Evidence and Consequence

Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.

Question styleLess usefulBetter evidence led prompt
General assuranceAre controls followed?Walk through the latest completed case
Exception handlingDo you ever bypass approval?What happened during the last urgent exception?
AccountabilityWho is responsible?Who authorized this specific decision?
EffectivenessDoes training work?Show how a trained person completes the task

05Distinguish competence gaps from system design defects

A staff member may fail to explain a control because training was inadequate, the user interface is confusing or authority rules conflict. These causes demand different corrections. An interviewer should not equate poor verbal recall with operational failure without corroboration.

Observe a representative work task and ask the employee to explain choices during the task. Confirm current training, role expectations, tool availability and supervisory support before assigning a cause.

  1. Begin with the person’s work and the intended result
  2. Move from description to demonstrated transaction
  3. Probe exceptions without leading the witness
  4. Compare roles at handoffs rather than seeking consensus
  5. Distinguish competence gaps from system design defects

06Use sampling to challenge the convenient example

Employees understandably offer a successful recent case. That can be a starting point, not the limit of review. Work varies across shifts, sites, workload peaks and product families; those variations may change control effectiveness.

Select additional samples independently from the business system, including a material exception and an alternate team or location where warranted. Record selection rationale and the boundary of conclusions.

07Close the interview with a testable control hypothesis

An interview that ends with “staff are aware” gives little assurance. The stronger output states a proposed explanation, the confirming or disconfirming evidence and any residual uncertainty. This creates a fair path from conversation to finding.

Summarize observations back to the interviewee for factual accuracy without seeking permission to suppress contrary evidence. Separate what was said from what was observed and identify the next sample needed for a decision.

Closure check: Confirm the result in subsequent normal work.

Practical Decision Method: Applying the Assessment

Prepare a purposeful interview map

Before meeting personnel, identify the process outcome and the consequential decisions that support it. Review one transaction and known exceptions so questions connect with actual business work. Plan who can explain upstream inputs, who makes the decision and who receives the result. Interview operators without forcing them to interpret clause language and reserve enough time to observe or retrieve records. A useful interview plan is a guide to evidence, not a script demanding a particular answer.

Handle inconsistent answers fairly

Differences between accounts can arise from job roles, shift practices, recent changes or genuine misunderstandings. Do not assume deception. Ask each person to describe the last actual case, identify its record and explain how exceptions are handled. Confirm whether written instructions and systems support the same decision logic. When statements conflict, record what is known, what is uncertain and how a subsequent sample can resolve the discrepancy without turning the interview into a blame exercise.

Convert learning into a control verification plan

After the interview, draft a testable statement: For example, urgent customer changes receive competent approval before release and affected teams are notified. Determine what records, timestamps and participants would prove or contradict it. Decide whether to extend sampling to other periods or sites and who is authorized to act if a serious failure is discovered. This approach makes the interview an efficient gateway to an evidence led finding rather than a stand alone opinion survey.

Four follow up probes after every important answer

“Can you show the most recent example?” moves from opinion to an identifiable record. “What happened when it went wrong?” exposes detection and recovery. “Who could authorize a different outcome?” clarifies decision rights. “How would someone on another shift know?” tests consistency and accessible guidance. These prompts are useful because they focus on the control’s actual mechanism rather than eliciting rehearsed assurances.

Do not over interview when the evidence is already sufficient. Record the sample, source and limitations, then use professional judgement to decide whether another role or exception should be examined. Keep interviews respectful: A process owner may reveal an unapproved workaround precisely because the environment encourages factual explanation rather than blame.

Illustrative Case: From Observation to Decision

Illustrative scenario: A quality manager said all emergency customer specification changes required technical approval. A service representative explained that weekend changes were handled by an informal messaging channel, while an operator could not identify where those decisions were stored. Sampling three weekend changes showed inconsistent sign off and one missing downstream notification. Interviews were useful because they identified the population and control hypothesis; the transaction records established the bounded finding.

Good interviews produce better evidence choices

The goal of an interview is not to collect a flawless recital of policy wording. It is to locate the actual decisions, exceptions and records through which a management system operates. Neutral questions, respectful challenge and independent transaction selection make it easier to uncover both capable practice and genuine weakness.

Summarize what was said separately from what the records and observations show. Follow unresolved contradictions with targeted samples, not speculation. In this way, interviews help assessors build credible findings while giving process owners a fair opportunity to explain the context of their work.

What changes in practice

  • Clearer evidence
  • More defensible classification
  • Proportionate actions
  • Verified effectiveness

References & Further Reading

  1. ISO: ISO 19011:2026 Guidelines for auditing management systems
  2. ISO: ISO 9001:2026 Quality management systems: Requirements
  3. ISO: ISO 31000:2018 Risk management: Guidelines
  4. ISO: ISO 9004:2018 Guidance to achieve sustained success