The auditor interviews two groups. The first is the control owners: the people responsible for access management, HR security, incident handling, suppliers, backups and development. The second is a few employees picked on the day, to see whether the processes work as described. A recent joiner, for example, can confirm whether they really received security training in their first week.
The interviews follow a pattern. The auditor asks how a process works, then asks to see the record that proves it. An IT lead might be asked how access is granted, then asked to open the ticket for a specific new joiner.
Preparing your people helps up to a point. Tell them that the audit is happening, what it is for, and that findings are expected and useful to the company. Make sure each control owner knows where their records are.
Avoid rehearsed answers. They are easy to spot, because they stop matching the records as soon as the auditor picks a sample, and they hide the gaps the audit is meant to find. If a process is skipped in practice, it is better to hear it now from your own auditor than in a few weeks from the certification auditor.