1. Introduction to the Technique
Surveys and questionnaires are efficient internal audit tools for gathering structured information from a wide audience. They help auditors like Auren at ACME Corp collect standardized responses on perceptions, practices, or compliance across departments, often within a short time frame. These tools are especially useful during the planning or fieldwork stages when the auditor needs to assess risk awareness, control effectiveness, or culture-related factors across teams. While not a substitute for deeper techniques like interviews or walkthroughs, they provide a broad base of evidence and flag areas for further review.
2. Template for Applying the Survey/Questionnaire Technique
To design and use surveys effectively, follow this structure:
Define Objective: What insight is needed (e.g., control awareness, compliance, ethical culture)?
Select Audience: Choose relevant respondents (e.g., process owners, staff, management).
Develop Questions: Use a mix of closed (multiple choice, Likert scale) and open-ended questions.
Pilot the Survey: Test with a small group to ensure clarity and usability.
Distribute & Monitor: Send via email or survey platform; track responses and send reminders.
Analyze Results: Identify trends, gaps, and inconsistencies.
Follow Up: Use results to guide interviews, walkthroughs, or deeper testing.
3. Practical Example: ACME’s Data Privacy Awareness Survey
After a recent system upgrade, CEO Liora is keen to ensure that all employees at ACME Corp understand and follow proper data privacy practices. She assigns Auren, the internal auditor, to assess company-wide awareness and compliance. Auren decides that a survey is the best way to get broad input quickly.
Objective: Assess employee understanding of ACME’s data privacy policies and actual practices.
Audience: All employees handling customer data across Sales, IT, HR, and Customer Support.
Survey Development: Auren works with Project Manager Aven and the Compliance Officer to design a 15-question survey covering areas like:
Whether staff received privacy training,
How often they access or share personal data,
Familiarity with reporting breaches,
Confidence in data protection procedures.
Auren pilots the survey with a few team leads, adjusts unclear wording, and then launches it company-wide. He achieves an 82% response rate in one week.
The results reveal that while most employees know the policy exists, only 48% feel confident about what steps to take if they suspect a data breach. Open-text responses highlight a need for real-world training scenarios.
Based on the findings, Auren reports that while formal policies are in place, practical knowledge is weak. He recommends mandatory refresher training and simplified guidance tools like checklists or job aids. Liora appreciates the proactive insight and greenlights a training update campaign.
Surveys like this give internal auditors both measurable results and directional insight—making them a powerful technique to quickly capture the voice of the organization and direct further audit work.