{
  "title": "Business Unit Risk & Control Interview",
  "description": "A structured interview with a business unit or functional lead — surfaces control gaps, segregation-of-duties issues, and undocumented exceptions before they show up as findings.",
  "language": "en",
  "questions": [
    {
      "text": "Walk me through a control or process in your area that relies on a manual override or exception step. How often is that override used, and who approves it?",
      "type": "text",
      "order": 1,
      "required": true
    },
    {
      "text": "Is there a task or system access in your area where one person can both initiate and approve the same transaction, without a second set of eyes?",
      "type": "text",
      "order": 2,
      "required": true
    },
    {
      "text": "What's one control that exists on paper but isn't consistently followed in practice? Why does the gap exist?",
      "type": "text",
      "order": 3,
      "required": true
    },
    {
      "text": "Describe how your team handles a case that falls outside the standard process. Is that exception path documented anywhere, or is it tribal knowledge?",
      "type": "text",
      "order": 4,
      "required": true
    },
    {
      "text": "Has a control gap or near-miss happened in the last 12 months that wasn't escalated through a formal incident process?",
      "type": "text",
      "order": 5,
      "required": true
    },
    {
      "text": "How confident are you that the controls in this area would hold up under a surprise external audit?",
      "type": "rating_scale",
      "order": 6,
      "options": {
        "max": 5,
        "min": 1,
        "maxLabel": "Very confident",
        "minLabel": "Not confident"
      },
      "required": true
    },
    {
      "text": "Is there anything about how this business unit operates that hasn't come up in a previous audit but you think matters?",
      "type": "text",
      "order": 7,
      "required": false
    }
  ]
}