Questionnaires or interviews - which is more effective for conducting IT audits
Most IT audits, whether internal or external, or self-assessment, require the auditor to develop an audit plan and use it in order to obtain evidence of achievement of the set goals.
In general, we can say that there are three methods of collecting information: interviews, questionnaires and analysis of documentation. If we consider interviews and questionnaires as an opportunity to get information directly from interested parties, then in both you can find exceptional advantages and disadvantages.
Interviews have several advantages over questionnaires. For example, in an interview, the auditor can often visually understand the truthfulness of a person’s words. Studies show that people who are under stress can be identified by their body language, speech intonation, and other signs in human behavior. Therefore, communicating with a person, you can immediately determine about his desire to contact you and disclose information he has.
The next benefit of the interview is the ability to use open-ended questions. In addition, a dialogue arises between the auditor and the respondent, during which you can effectively ask "point-blank" questions, thereby receiving more detailed and understandable information from the respondent. When using questionnaires and checklists, this approach is not possible. Interviews are a more effective way, because the respondent understands the essence of the question and there can be no effect of ambiguity or ambiguity in understanding, therefore he (the respondent) can give a more detailed answer that can be used to assess the state of the audited object.
The disadvantages of the interview are the physical ability of the respondents to attend the meeting. This is often due to the time constraints of the respondent, and as usual, the higher the position of the interviewee, the less time he can devote to the auditor. There are also a number of distractions that may occur already during the interview, such as constant calls, urgent tasks, questions from colleagues, etc.
The questionnaire also has a number of advantages that characterize it as an effective method. The audit process using questionnaires and checklists can be carried out quickly enough, thereby limiting and shortening the time frame that respondents should allocate for the survey. Questionnaires can be used as a standard with professionally developed questions that have passed the analysis stage and are effective and sufficient to obtain a holistic picture of the audited object.
If we are talking, for example, about financial auditing, then in this area there are already a number of developed tools, including questionnaires for each aspect of the audit, allowing you to collect only the information necessary for analysis. Thus, the auditor can even reduce his own time for compiling questionnaires, without losing the quality of the information received through questionnaires. In fact, in IT auditing, there are already a large number of templates related to various types of audits.
One major advantage of questionnaires concerns the essence of the questions. If the IT auditor is interested in information about systems, applications or technologies, which is based on evidence, then applying a questionnaire in this case will be more appropriate.
The disadvantages of questionnaires are the loss of interview benefits; for example, the information collected in an interview is more voluminous and detailed. There are many qualities that make the work of the auditor professional and valuable, but none of them will be more important and more significant than the analytical thinking of the auditor. To consider questionnaires as meaningless and not to analyze them before use means losing this valuable asset. Therefore, IT auditors should not give in to the temptation to copy a questionnaire from a methodology provider, because the conception survey proposed by the author of the methodology may not be suitable for current realities in a rapidly developing world. Another drawback is when the auditor cannot complete the questionnaire due to problems such as lack of understanding among respondents of the essence of the issues, which forces them to provide incomplete or incorrect information. In an interview, the auditor would probably see such situations immediately and immediately correct them. Thus, a questionnaire survey is less informative due to possible information errors.
In conclusion, I will say that there is no better way to collect information. Attention when performing audits should be given to all approaches, and if a questionnaire / checklist is used, then the essence of his questions should be clear to the respondent so that the information that the interviewer will give us is enough to perform the analysis.