ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Gap assessment interviews are conversations with the people who run, use and oversee controls, held to find out what actually happens compared with what a standard or regulation requires. Documents show intent, and systems show configuration, but only people can explain how work is really done, where the process breaks and what is done differently from the procedure. Good interviews find gaps that document reviews never reveal. Poor ones collect reassurance. This guide explains how to plan and run gap assessment interviews: choosing interviewees, designing questions, conducting sessions, probing for evidence, recording notes and verifying what you are told.
A gap assessment compares your current state with a target. Evidence comes in several forms: documents, records, system outputs, samples and testimony. Guidance for management system audits, such as ISO 19011, recognizes interviews as one way of collecting information, to be verified against other sources. You can find the official listing at ISO 19011:2018 on iso.org. Interviews are especially useful for understanding how procedures work in practice, how people make judgments, what they do when something goes wrong and where the informal workarounds are. They are weak as sole evidence, so combine them with records and observation, as explained in our guide to gap assessment evidence.
Select people by the requirements you need to examine, not by seniority alone. For each area, talk to the person who owns the control, the person who performs it day to day and, where possible, someone who relies on its output. Include a mix of levels: executives for governance and resourcing, managers for process design and people who carry out the work for the truth of daily practice. Ask the scope statement, prepared during gap assessment scoping, to determine who is in and out.
| Role | What they can tell you |
|---|---|
| Senior leader or sponsor | Objectives, priorities, resourcing, risk appetite, how governance really works |
| Control owner | Design of the control, responsibilities, known weaknesses |
| Operator or practitioner | What is done in practice, exceptions and workarounds |
| Internal audit or compliance | Past findings, testing history, unresolved issues |
| IT and security staff | System configuration, tooling, incident history |
| Recipients or users of the control | Whether the control works from their side |
Build an interview guide from the requirements in scope. For each requirement, note what you want to learn, the questions that might get you there and the evidence you will ask to see. Keep the guide short enough to use flexibly, and share the topics, but not every question, in advance so that people can bring records.
A question such as do you review access every quarter invites yes. A question such as walk me through the last access review invites detail: who did it, what they looked at, what they found and what happened next. Follow with requests for the record. The difference in what you learn is large.
Start by explaining the purpose: the aim is to understand how things work and where they could be improved, not to blame anyone. Explain how notes will be used and who will see them. People speak more freely when they trust that candid answers will not be turned against them. Keep sessions to an hour or so, and try to hold them in a private space. Let the interviewee do most of the talking, and use silence, since people often add the important detail after a pause.
Use a consistent structure: opening, walk-through of the process, exceptions and failures, evidence, and closing. In closing, ask two useful questions: what would you change if you could, and what should I have asked that I did not?
Treat answers as claims to be verified. Ask for a specific example, the most recent one, and for the record that shows it. Compare what different people say about the same process. Ask what would happen if the control were skipped, and whether anyone would notice. Look for signals that a procedure exists only on paper: hesitation, references to a person who left, a description that differs from the document or the phrase we usually do that. Note them without accusation, and follow up with records.
Take notes during the session, in a template that links each point to a requirement. Record facts and quotes separately from your own interpretation. After the session, write up within a day while memory is fresh, and note what needs verification. When you score a requirement, cite the sources that support the rating: interview, document, record or observation. Our guide to gap assessment scoring explains how to translate the findings into ratings, and the guide to gap assessment prioritization shows how to rank what you find.
Do not rely on one interview for an important finding. Corroborate with a second person, a record or a system check. When accounts conflict, resolve the difference by looking at the source. Return to interviewees with your understanding of what they said to confirm it, and give them a chance to correct the record before it enters the report. This step prevents misunderstandings and improves the fairness of the assessment.
Some interviewees are defensive, some vague, some overly eager to please and some dominant. Adjust your approach. With defensive people, emphasize the improvement purpose and ask about the process, not their performance. With vague answers, ask for a concrete recent example. With those eager to please, ask for counterexamples and records. With dominant people in group interviews, address questions to others by name. Where senior managers dismiss concerns raised by staff, protect the source and take the issue to the sponsor in a way that does not identify the individual.
Interview findings should never stand alone. Feed them into your remediation plan and compare them with the framework you are measuring against, whether that is an ISO 27001 gap assessment or a GDPR gap analysis. Well-run gap assessment interviews shorten the document review that follows, because you already know where to look and which claims need proof.
An assessor examines supplier due diligence against a security framework. The policy says all critical suppliers are assessed annually. The procurement manager describes the process and provides the register. In an interview, the practitioner who runs the reviews explains that they are done for new suppliers but that renewals are rarely reviewed unless the contract lapses. The assessor asks for the last three renewals and finds no assessment on file for two. A second interview with the business owner of one supplier confirms that no one had asked for updated information. The finding is recorded with the sources: policy, register, records and two interviews. The rating reflects partial implementation, and the recommended action is to link renewals to a review trigger.
Assessors interview only managers, ask leading or yes or no questions, accept statements without evidence, take poor notes, fail to explain the purpose, interview one person per topic, forget to verify and never feed back. Another mistake is turning interviews into audits by confrontation. The point is to understand the truth of practice, and that requires trust. Prepare well, listen closely and treat every claim as something to be checked.
If you want a structure to hold questions, notes, evidence and ratings together, the Gap Assessment Report and Workbook provides a structured report and working register that link each requirement to its sources. Whichever tool you use, run gap assessment interviews with a plan, capture what people say and check it against records.
Documents show what is intended. Interviews reveal how work is actually done, where workarounds exist and whether people understand and follow the process.
At least two sources per important requirement, typically the control owner and someone who performs or relies on the control, plus records to verify what they say.
Usually about an hour. Longer sessions tire both sides, so split large topics into more than one meeting.
Share the topics and the records you would like to see, so that people can prepare, but keep detailed questions for the session so that answers are spontaneous.
Ask for the most recent example and its record, compare accounts from several people and check system outputs or samples. Confirm your notes with the interviewee before finalizing.
September 30, 2026
