Auditors interview your subject matter experts to check one thing: whether the people running the controls describe the same process the documents describe. Preparation for those conversations should build familiarity and honesty, not rehearsed lines. SME prep should line up with the evidence trail in audit working papers and the review cadence in a compliance calendar.
Quick Answer
SME interview preparation should help control owners explain real work from records, not scripts. The best prep walks through the last control occurrence and known exceptions.
What auditors ask in SME interviews and why
Auditors test whether documented controls exist in practice, and interviews are where that test happens. They read the access review policy, then sit with the engineer who runs those reviews and ask what actually happens when one is due.
The questions are usually plain: walk me through the last review. Who approves the results? What happens when someone flags an exception?
The auditor is checking for consistency between the written process and the lived one. Small divergences are normal and usually fine. A policy that says quarterly reviews happen, paired with an SME who describes quarterly reviews in the same terms, is exactly what the auditor needs. Problems start when the SME describes something the policy does not claim, or cannot describe the process at all.
Interviews also let auditors gauge whether a control is a real habit or a performance mounted for the audit. That is why they ask for a recent example rather than a hypothetical. A specific account of the last review, complete with the small messiness of real work, reassures an auditor more than a fluent resource reference of the policy ever could.
Why rehearsed answers create findings
Coached SMEs produce findings that honest ones would not. When an SME recites a script, auditors hear it. Rehearsed answers invite scrutiny: the auditor pushes one level deeper, and an SME who only memorized lines hits a wall.
Scripts also fail on the question auditors ask most often: "what changed since last time?" A prepared answer covers the steady state. Real audits happen over time, and the interesting answer is the delta. The SME who says "we moved this review from spreadsheet to tool in the spring, and the approval step briefly slipped for one cycle before we caught it" gives the auditor a truthful picture. The SME reciting the current policy from memory gives nothing to verify.
There is a subtler cost as well. An SME who has been told exactly what to say stops thinking about their own process. The preparation session was their chance to re-examine it, and the script replaced that reflection. If the auditor asks anything off-script, the SME is meeting their own control for the first time in front of a stranger.
Run the prep session as a working review
The effective prep session walks the actual control, not the policy document. Treat it as a dry run with a colleague, not a briefing. The SME should be able to narrate the process from memory afterward.
| Prep session step | What it covers | What good looks like |
|---|---|---|
| Walk the last occurrence | The most recent real execution of the control | SME opens the actual record and narrates what happened |
| Name the people | Who does what, who approves, who is notified | First names and roles, not "the team" |
| Surface the exceptions | What went sideways and how it was handled | At least one honest irregularity discussed openly |
| Locate the evidence | Where each step leaves a trace | SME can pull the record in under a minute |
| Practice the delta question | What changed since the previous audit | A short, truthful answer about recent changes |
The walk-the-last-occurrence step often matters most. Ask the SME to open the artifact from their most recent control execution and talk through it. This does two things: it confirms the evidence actually exists, and it puts the SME in the habit of answering from records rather than memory. Auditors tend to trust answers that come with a record attached. If your team is still building that habit, our guide on preparing for a compliance audit covers the broader groundwork.
Keep the session short. An hour with a focused SME beats three hours with a rotating cast. Invite the person who will be in the room, not their manager, unless the manager also runs the control.
One practical note for remote audits: run the dry run in the same format the interview will happen in. If the auditor will join by video, the SME should practice sharing their screen and pulling up records live, because fumbling with window tabs mid-answer undermines the calm the prep is meant to build. Teams that keep their evidence in one workspace find this part easy, because the record is a click away rather than spread across drives and inboxes, which is also what makes the evidence-based questionnaire workflow fast when the next request arrives.
Questions SMEs get wrong, and the honest way to answer them
Some of the hardest interview questions are the ones about gaps, and the right answer is the truthful one. SMEs tend to overstate coverage out of pride or nervousness. Auditors would rather hear about a known gap than discover a concealed one.
Common traps and better answers:
- "Does this happen each time?" Manual processes vary, and auditors know it. Answer with the norm and the known deviations: normally yes; there was one instance where it slipped, here is how it was caught.
- "Who else could perform this step?" Saying nobody is a risk signal, not a strength. Name the backup, even if the backup is rarely used.
- "How do you know the result was correct?" Vague confidence loses the auditor. Describe the check: a second person reviews, or the output is reconciled against a source.
- "What happens if you are on leave?" This is a continuity question. If nobody can cover the control during a vacation, that is worth knowing before the auditor finds out on their own.
Notice what these answers have in common: they describe reality, including its imperfections. That posture is what makes an interview go well. It is also the same posture that determines whether an auditor trusts AI-assisted work later — see our piece on whether auditors trust AI-assisted compliance work for how that judgment gets made.
Build a one-page prep brief for each SME
A one-page brief gives an SME what they need without scripting them. It is a reference document, not lines to memorize. Prepare one per SME and send it a few days before the interview.
| Brief section | Contents |
|---|---|
| Control summary | The control in two sentences, in the SME's own words |
| Last occurrence | Date, record location, who approved it |
| Known exceptions | Anything irregular the auditor may reasonably ask about |
| Recent changes | What shifted since the last audit cycle |
| Evidence map | Where each artifact lives, one click deep |
| Honest boundaries | What the SME does not own and should redirect |
That last row is underrated. SMEs get into trouble when they answer outside their area. Knowing the boundary — "that is owned by the infrastructure team, I can tell you what I see from my side" — keeps the interview accurate and keeps the SME credible. Teams that keep this kind of evidence map close also find the map useful beyond audit season, which is the argument our article on turning evidence freshness into a repeatable check makes in more depth.
One more logistical point: brief the SMEs on tone. Short answers, plain language, and no speculation. If an SME does not know, "I don't know, but I can find out" is a complete and safe answer. Auditors do not expect omniscience; they expect reliability.
FAQ
How far in advance should SMEs be prepped? A few days is enough for the brief, with the working session held within the week before the interview window. Earlier than that and the walkthrough goes stale; later and there is no time to fix anything the session surfaces.
Should the compliance team sit in on SME interviews? Usually yes, as a quiet observer. Their presence signals support to the SME and gives them the context to help afterward. They should not answer for the SME, which turns a conversation into a performance.
What if an SME gives a wrong answer during the interview? Correct it promptly and plainly, ideally with the record. A fast, low-drama correction reads as command of the material. Letting a wrong answer stand is how small observations become findings.
Do SMEs need prep for internal audits too? Yes, and the same rules apply. Internal audits are practice for the external ones, and teams that run honest prep sessions internally find external interview season uneventful.
How many SMEs should a mid-size audit program prepare? However many people genuinely run controls, which is usually more than the org chart suggests. If two people share a control, both should be able to describe it, because either one might be interviewed.
How CASK helps between prep sessions
<a href="https://www.truvara.ai/">CASK by Truvara</a> can help organize control records, approvals, and recent examples from the materials your team provides, so a prep brief can start from a reviewable draft rather than a blank page. When an SME asks "where does that live?" the team still checks the underlying record before using it in prep. What CASK will not do is run the interview for anyone. The conversation belongs to the SME and the auditor; the preparation is where organized records earn their keep. Try CASK now.