Questionnaire or interview - which is more effective for IT audits

Most IT audits, whether internal or external, or self-assessment, require the auditor to develop an audit plan and use it in order to obtain evidence of the achievement of set goals.

In general, it can be said that there are three methods for gathering information: interviews, questioning, and documentation analysis. If we consider interviews and questionnaires as an opportunity to get information directly from interested parties, then both can find exceptional advantages and disadvantages.

An interview has several advantages over a survey. For example, in interviews, an auditor can often visually understand the truthfulness of a person’s words. Studies show that people who are under stress can be identified by their body language, speech intonation, and other signs in human behavior. Therefore, communicating with a person, you can immediately determine about his desire to come in contact with you and disclose the information he has.
')
The next advantage of the interview is the ability to use open-ended questions. In addition, a dialogue arises between the auditor and the respondent, during which it is possible to effectively ask “point-like” questions, thereby obtaining more detailed and understandable information from the respondent. When using questionnaires and checklists, this approach is impossible. An interview is a more effective way, because the respondent understands the essence of the question and cannot have an ambiguity effect or uncertainty in understanding, so he (the respondent) will be able to give a more detailed answer that can be used to assess the state of the object being audited.

The disadvantages of the interview are the physical ability of the respondents to attend the meeting. This is often due to the time constraints of the respondent, and as usually happens, the higher the position of the interviewee, the less time he can spend on the auditor. There are also a number of distractions that may occur during the interview, such as constant calls, urgent tasks, questions from colleagues, etc.

The survey also has several advantages that characterize it as an effective method. The audit process using questionnaires and checklists can be carried out fairly quickly, thereby limiting and shortening the time frame that respondents should allocate for the survey. Questionnaires can be used as a standard with professionally designed questions that have passed the analysis stage and are effective and sufficient to obtain a complete picture of the object being audited.

If we are talking, for example, about financial auditing, then in this area there are already a number of tools developed, including questionnaires for each aspect of the audit, allowing us to collect only the information necessary for the analysis. Thus, the auditor can even reduce their own time for the preparation of questionnaires, while not losing the quality of the information obtained through the means of questionnaires. In fact, in IT auditing there are already a large number of templates associated with various types of audits.

One major advantage of questionnaires is precisely the essence of the questions. If an IT auditor is interested in information about systems, applications or technologies that is based on evidence, then applying a questionnaire in this case would be more appropriate.

The disadvantages of questionnaires are the loss of the benefits of the interview; for example, the information collected in the interview is more extensive and detailed. There are many qualities that make the work of an auditor professional and valuable, but none of them will be more important and significant than the analytical thinking of an auditor. Considering questionnaires to be meaningless and not analyzing them before use means losing this valuable asset. Therefore, IT auditors should resist the temptation to copy the questionnaire from the supplier of the methodology, because the conceived one proposed by the author of the methodology may not be suitable for current realities in a rapidly developing world. Another disadvantage is when the auditor cannot complete the questionnaire due to such problems as the respondents do not understand the nature of the questions, which causes them to provide incomplete or incorrect information. In the interview, the auditor would probably see such situations immediately and immediately correct them. Thus, the questionnaire survey is less informative due to possible informational errors.

In conclusion, I will say that there is no better way to collect information. Attention when performing audits should be paid to all approaches, and if a questionnaire / check list is used, the essence of his questions should be clear to the respondent so that the information that the interviewee will give us will be sufficient to perform the analysis.