CISA Information System Auditing Process Practice Question
An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?
⚠ Common exam trap
CISA often tests whether candidates can distinguish observation from inspection and re-performance from inquiry, causing them to pick a combination that does not match the described auditor actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Observation and re-performance
The auditor observed the control being performed (observation) and then independently performed the same control to confirm the result (re-performance). This combination of observation and re-performance provides strong evidence of control effectiveness because the auditor both witnesses and independently verifies the control. Inquiry and inspection are not the primary techniques used here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inquiry and inspection
Why it's wrong here
Inquiry means asking personnel questions, and inspection means examining records or assets; neither involves watching the control execute or reperforming it. This pairing is tempting because auditors routinely open with interviews and document reviews, but the stem describes observation and reperformance, which yield different evidence.
- ✗
Inspection and observation
Why it's wrong here
Inspection examines records or assets, not the live execution of a control, so it cannot describe watching the control run. Observation alone matches the first half, but the independent reperformance is missing. The pairing tempts because observation and inspection are commonly combined in walkthroughs.
- ✗
Analytical procedures and inquiry
Why it's wrong here
Analytical procedures are data analysis.
- ✓
Observation and re-performance
Why this is correct
Observation supplies evidence that the control operates as described, while re-performance independently reproduces the same result, testing operating effectiveness rather than design alone. Together they satisfy the stem's requirement to confirm the control's effectiveness through direct auditor execution, not merely inquiry or inspection of documentation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.