The list of questions in Appendix A provided structure to the interviews, however, respondents were allowed to discuss additional issues and topics that they thought important. Interviews lasted from 45 to 90 min and were recorded and subsequently transcribed for further analysis. Participants were informed that the purpose of the study was to better understand the relationship between IT security and Internal
Audit.