In security assessment interviews, ask about specific work staff have performed. Separate their observations, explanations and assumptions before using the answers. An interview can reveal how a control operates, but a confident answer is not automatically verified evidence.
Start with one assessment question. Perhaps you need to understand how an unusual delivery is approved or how a fault reaches the person who can resolve it. Tell the participant what you are examining and why their practical experience matters.
The output should be a small set of attributable findings and follow-up actions. A long transcript with no distinction between fact and opinion creates more work for the reviewer and can make an unsupported conclusion appear authoritative.
Prepare around the task, not a preferred conclusion
Identify the roles and operating conditions relevant to the question. Include people who perform, supervise and receive the work where their perspectives differ. Interviewing only the policy owner will mainly tell you how the process is intended to operate.
Write a short discussion guide with a normal task, a recent exception and the evidence you may need to inspect. Use it to maintain coverage, while allowing a participant to explain something you had not anticipated.
The UK Government's guidance on in-depth interviews recommends open, neutral questions and discussion of real examples. Although written for user research, that interviewing discipline is useful when examining security work.
Avoid building the answer into the question. “Why do people ignore the procedure?” assumes both that non-compliance occurred and that the explanation lies with the people. “Talk me through the last time the normal process could not be followed” leaves room to discover what actually happened.
Explain the boundaries before taking notes
Explain the assessment purpose, how notes will be used and who will receive the findings. Do not promise confidentiality that the organisation cannot provide.
Agree any recording through the organisation's applicable rules and the participant's informed agreement where required. Recording every interview is not a universal requirement. Well-kept notes may be sufficient, and unnecessary recordings can create an avoidable information-handling burden.
Choose a setting where the person can speak without disrupting work or exposing sensitive information. Do not ask someone to demonstrate a task while they are operating hazardous equipment or attending to an urgent service.
If the discussion identifies an immediate concern or an allegation about a person, follow the organisation's appropriate reporting process. A routine assessment interview should not drift into an unauthorised investigation.
Ask for the last concrete occasion
Begin with an event the person remembers well. Ask what started the task, what information they received, what they did and how they knew it was complete.
Use neutral follow-up questions to establish sequence and limits. “What happened next?” and “How did you know that was approved?” usually produce more useful material than asking whether the process is robust.
Clarify whether the person saw the event, performed the task, read a record or heard about it from someone else. Those are different sources of knowledge. None should be silently rewritten as direct observation by the assessor.
Ask what was unusual about the occasion. The example may reflect a temporary arrangement, a particular shift or a previous version of the procedure. Keep those conditions attached to the answer.
Worked example: three statements, three evidence treatments
A fictional assessor interviews a dispatch supervisor about changed collection requests. The supervisor makes three statements:
| Interview statement | What it supports now | Useful follow-up |
|---|---|---|
| “I approved Tuesday's carrier change after calling our customer contact.” | A first-person account of one decision | Inspect the relevant authorised record and confirm the contact route |
| “Everyone does it that way.” | The supervisor's view of common practice | Check other relevant roles or operating conditions |
| “The new software will stop unapproved changes.” | An expectation about a planned control | Ask the system owner for the design and acceptance evidence |
The assessor does not discard the second and third statements. They are useful leads. However, they do not establish current organisation-wide performance.
A defensible note might read: “The supervisor described one recent approved change. Wider consistency and the proposed system restriction require separate verification.” The report can now describe what is known without stretching the evidence.
Keep observation, interpretation and action separate
Use separate fields in your notes for the account, the source, the conditions and the assessor's interpretation. Add a follow-up owner and evidence reference when the issue matters to a decision.
For example, “staff member reports that support is unavailable after closing” is different from “no support exists after closing”. The first may justify checking the roster and escalation arrangement. The second needs supporting evidence.
Avoid converting memorable language into a numerical likelihood. A participant saying that a problem happens constantly has given you a reason to investigate frequency, not a measured rate.
Do not treat a person's inability to recall an event as proof that it did not happen. Preserve disagreement. If two people describe different processes, first check whether they perform different roles or work under different conditions. Their accounts may both be accurate within their experience.
Confirm meaning without asking for endorsement
At the end, summarise the important points in plain language and invite correction. Confirm any promised document or follow-up, including who can authorise access to it.
A participant can confirm that you understood their account without approving your risk rating or treatment recommendation. Keep those decisions with the appropriate assessment and management roles.
Where a material statement is later contradicted, return to the evidence question. Explain the discrepancy neutrally and seek the relevant clarification. Do not delete an inconvenient account simply because it complicates the report.
Limit personal attribution in the distributed report to what the purpose requires. Retain necessary provenance in the controlled evidence record so the reviewer can trace a finding without circulating unnecessary employee details.
Decide when another interview is worthwhile
Further interviews should answer a material unresolved question. They should not continue indefinitely until someone repeats the assessor's preferred view.
Check whether a record, observation or authorised demonstration would now provide stronger evidence. Interviewing more people about the existence of a test report is less useful than obtaining the report and checking its scope.
Use the assessment scope to decide whom to interview, and place the resulting evidence within the wider assessment process.
Your next action is to rewrite three leading questions in your interview guide into neutral questions about actual work. Add the evidence you would seek before relying on each answer.
The paid SRMBOK 30-Day Risk Assessment Delivery Kit includes an editable assessment guide and workshop material. Use its assessment structure to plan participation and follow-up, adapting interview and recording arrangements to the actual engagement rather than assuming every conversation should be recorded.