11.1 Interviews, Observations, and Walk-Throughs

Why Section B starts with methods, not conclusions

Quick Answer: CIA Part 2 2025 Section B — Information Gathering, Analysis, and Evaluation is 40% of the exam. B1a asks you to determine suitable methods for obtaining information, including interviews, observations, and walk-throughs (data analyses are the next section). In a preliminary survey, those methods confirm how the activity actually works and where later tests should go. They do not, by themselves, prove operating effectiveness for the whole period.

Section A built objectives, scope, criteria, a risk ranking, and a work program. You now have to get information that can support those objectives and procedures. Global Internal Audit Standards (GIAS) Principle 14, Conduct Engagement Work, and Standard 14.1, Gathering Information for Analyses and Evaluation, require internal auditors to gather information in order to analyze and evaluate. This chapter is the source-and-method decision. Whether the information is relevant, sufficient, and reliable enough to support a finding is Chapter 12. Stay here on how you obtain it.

The 2025 syllabus language is identify sources of information to support engagement objectives and procedures. Older 2019 Domain II language called the same early work a preliminary survey of the engagement area. The live exam still tests the idea: you gather a first, structured picture of the activity so the work program is aimed at the right risks. You do not treat the survey as the entire engagement, and you do not treat 2019 sampling bullets as if they still sat inside B1a.

Determine suitable is the exam verb. Matching the method to the purpose is the skill. Interview when you need process knowledge from people. Observe when the control is visible in real time. Walk through when you need the end-to-end path of one item. Analyze data (Section 11.2) when the population can be scanned to aim tests. Using all four on every control is not professionalism; it is an unfocused work program.

Preliminary survey versus later testing

A preliminary survey (also called a survey, orientation, or kickoff fieldwork) is the short, high-leverage pass at the start of the engagement. You talk to people who perform the work, watch a control happen, and follow one transaction end to end. The output is understanding, confirmed design, and a tighter list of where hours should go. You may also adjust the work program (GIAS Standard 13.6) when the live path is not the path last year's narrative described.

Later testing is the pass that evaluates conditions against criteria for the period and the population that matter to the objectives. The same toolkit can reappear — you may interview again, observe an exception, or walk a path you missed — but the purpose has changed from "how does this work?" to "did it work as designed, for the period, with evidence?"

If the survey shows the three-way-match flag can be switched off by the process owner, you change the work program. Chapter 9 already taught you not to sample a control that cannot work. You do not write "operating effective" because Tuesday's invoice matched.

Chapter 9 used the walk-through as a design procedure (A6a). B1a uses the same technique as a method of obtaining information. Same steps, different syllabus job: here you are choosing a source, not yet writing the design-adequacy conclusion as the engagement product.

Interviews: structured versus unstructured

An interview is inquiry with a person who knows the activity: process owner, control performer, system administrator, customer of the process, or last year's auditor. It is how you learn the alleged flow, the workarounds, the overrides, and the names of reports people actually use.

Structured interviews use a prepared question list, often aligned to risks in the work program. Everyone in a role gets comparable questions. Answers are easier to compare across plants, shifts, or shared-service pods. Use structured interviews when you need coverage (all five accounts-payable supervisors), when the topic is technical and easy to skip (who can change vendor bank details), or when more than one auditor will interview the same role.

Unstructured interviews start from an objective ("show me how an unmatched invoice gets paid") and follow the answer. They surface informal controls, shadow spreadsheets, and "we only do that at year-end." Use them with a knowledgeable performer when documentation is stale, when you are still mapping the process, or when a structured list would train the interviewee to give policy language instead of practice.

Most survey interviews are semi-structured: a short prepared core (who initiates, which system, which control, what evidence, what exception path) plus permission to chase surprises.

Leading questions are a survey and exam trap. "You always three-way match before you pay, right?" invites a yes. "Walk me through the last invoice you processed that did not match" invites a path. Open questions, a request for a recent example, and "what happens when it fails" beat yes/no confirmation of the policy you already read. Document who, when, role, the questions that matter, and the answers that change procedures. An interview note that says "AP manager says controls are strong" is not a method well used.

Observation versus inquiry

Inquiry is asking. Observation is watching the control or process occur. Inquiry tells you the story people want to tell. Observation tells you what they do while you are in the room.

Watch a receiving clerk count against a purchase order, a treasurer release a wire in the bank portal, a supervisor clear a time-clock exception, or a warehouse complete a cycle count. Observation is strong for physical and real-time steps and weak as the sole method for a year-long detective review. Staff may perform better while watched. One Tuesday is a snapshot, not the period.

Pair them: inquire how match works, then observe an unmatched invoice being blocked — or posted. If inquiry and observation disagree, treat the live path as the working hypothesis until documents and data say otherwise, and put that disagreement in the survey file as a focus area. Inquiry alone never lets you conclude a control operated; even in the survey, it is how you know what to look at next, not how you close the objective.

Walk-through: one item, end to end, to confirm understanding and design

A walk-through follows one transaction or event from initiation through processing to recording, and to reporting if reporting is in scope. You combine inquiry, observation, and inspection of the documents that item actually produced. The unit is one path, often two if you also take the exception path (hold, override, return, match failure).

The survey walk-through answers: Do I understand this process? Is the control designed and implemented on the live path? Where should later tests go?

It does not answer: Did this control operate as designed on every day of the period, by the right people, with complete evidence? That is operating-effectiveness testing (Section 9.2). Watching one invoice match on Tuesday does not prove the match ran in March during the ERP cutover.

Pick the item on purpose. A $200 fully matched invoice will never show you that invoices over $5,000 bypass match. Walk through something that should hit the control, and walk the override if override is how risk gets through. Ask the performer to use the live system, not a training screen. Inspect the user ID that approved, not only the printed name. If the item dies in a parking lot you did not know existed, that parking lot is now in scope for later tests.

Matching method to purpose

Worked example: procure-to-pay survey

You are on a procure-to-pay engagement. Survey plan:

1. Structured interviews with the AP supervisor and the buyer using a six-question core: initiation, systems, match rule, override, vendor-master changes, evidence retained.
2. Unstructured follow-up with a senior clerk after she mentions "the weekend upload."
3. Observation of Friday's payment-proposal review.
4. Walk-through of one unmatched invoice that still paid, from purchase order through goods receipt through invoice through override through the payment file.

Survey result: match is on; the same user ID can override; weekend uploads skip the proposal review. Those are focus areas for later tests and a possible design issue on override. They are not yet findings that "payments are unauthorized" for the year. The next section will add data scans (duplicates, round-dollar, weekend postings) to aim those tests. Chapter 12 will judge whether the evidence you then gather is good enough to support a conclusion.

Exam traps

• Treating a walk-through of one item as a test of operating effectiveness for the whole period.
• Asking leading questions that confirm the policy instead of eliciting the live path.
• Relying on inquiry alone ("the manager said they review it") and calling the control understood.
• Walking through only the happy path when the risk lives in the override.
• Confusing this B1a method choice with Chapter 12's evidence-quality criteria, or with Chapter 14's process-mapping and analytics catalog.

Survey methods are complete when a reviewer can see how the activity works, which paths are designed, and which later procedures just became non-negotiable. One watched invoice is a beginning, not a year.