Voice interview
Interview the auditee from inside the audit and keep what was said as evidence a work paper can cite.
Interview · Diego Marín, Head of IT Operations
- The interview is recorded from inside the audit and transcribed as it goes. What the auditee says becomes evidence, not notes written afterwards.
Work paper · CC8.1.8 · compliance test
Citations
No interview evidence cited yet.
Kept with the audit
- Who
- Diego Marín, auditee contact
- When
- 14 Oct 2026, 10:30
- Audit log
- —
Starting…
A concept simulation of a planned product. Watch it play, or pressTry it yourself to click through.
What it is
A planned fieldwork tool that records an interview with an auditee contact and keeps the transcript with the audit as citable evidence.
What you do, as the auditor
- 1Start the interview from the fieldwork hub, naming the auditee contact being interviewed.
- 2Run the interview; the record stays in the audit with who was interviewed and when.
- 3Cite the transcript from the compliance test work paper as an operational record.
- 4Today: see the card on the audit map; the interview tool is not available yet.
On the roadmap
This is on the roadmap. The simulation above is a concept: it shows the intended flow, and screens and behaviour will change.
What it will do
What voice interview will do
Run the interview from inside the audit
The interview is started from the fieldwork hub and stays in the audit as a sibling view. It is never merged into the fieldwork hub, and it is not scheduled or hosted outside the audit.
Who was interviewed and when
One interview names the auditee contact, the time, and the evidence it produced, so the record says whose words these are and when they were given.
Citable evidence for the compliance test
The transcript is an operational record. It serves the compliance test stage, is shown in that stage's workbench inspector, and a work paper cites it like any other document.
An audit log entry, no silent change
Each interview writes evidence and an audit log entry. It changes no control test and concludes on no control; correcting and signing off the work paper stays in the workbench.
Deliberately not in scope
- Replacing written evidence or document review.
- Concluding on a control; that stays in the workbench.
- Scheduling or hosting meetings outside the audit.
Why an interview is evidence
Some of the evidence an IS auditor needs is not in a document. How a control runs in practice is often something an auditee says in an interview: who approves the access request, what happens when the backup fails, how often the review is really done. Today the auditor writes the notes afterwards, and the audit holds a summary of the conversation rather than the conversation itself. The voice interview keeps the interview with the audit as evidence, with the auditee contact and the time recorded, so a work paper can cite what was said in the same way it cites a policy or a log extract. Because the transcript is an operational record, it belongs to the compliance test stage and is shown in that stage’s workbench inspector, never read as evidence of design.
What is settled and what is not
The interview is a sibling view of the fieldwork hub, reached from it and never merged into it. It is captured with one tool, acquire data, which turns the interview into evidence the audit can cite. It writes evidence and an audit log entry and changes no control test; concluding on the control, correcting the work paper, and signing it off stay in the workbench. Two questions are open in the PRD. Whether the interview is transcribed in v1, and by what, is not settled. Whether an interview can answer an evidence request as a supply, the way a document uploaded through the requests portal does, is not settled either. Neither changes what the auditor will see: the interview, the auditee contact, the time, and the evidence it produced, kept with the audit.
Products
The other products
AI document auditing
AvailableUpload the evidence the auditee already keeps, test the controls against it, correct and sign off the work papers, issue the report.
For the auditor
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
Pre-audit planning
PlannedStudy the prior audits, see where risk concentrates, and decide who to talk to and what evidence to request before fieldwork starts.
For the auditor
Cloud configuration review
PlannedConnect a cloud account read-only and test the selected controls against its live configuration, from inside the audit.
For the auditor
- NIST CSF
- ISO 27001
- SOC 2
- PCI DSS
Follow-up on audit
In developmentKeep every work paper with a gap open past report issue, request corrective-action evidence from the auditee, and close only on signed-off evidence.
For the reviewer and audit manager
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
See it on your own evidence
A walkthrough takes forty minutes: one framework, a handful of controls, and the documents an auditee already keeps.