The answer is inquiry of personnel, observation of processes being performed, and inspection of documentation. These three are acceptable methods for gathering audit evidence because they represent the core techniques auditors use to obtain sufficient, appropriate evidence: inquiry involves asking personnel for explanations, observation provides direct visual confirmation of a control in action, and inspection examines physical records or documents for authenticity and accuracy. On the Certified Information Systems Auditor CISA exam, this concept tests your understanding of the four primary evidence-gathering methods—inquiry, observation, inspection, and reperformance—with the common trap being that reperformance is often confused with observation, but reperformance requires the auditor to independently execute the control, not just watch it. A useful memory tip is the acronym IOIR: Inquiry, Observation, Inspection, Reperformance, remembering that observation is for seeing, not doing.
CISA Information System Auditing Process Practice Question
This CISA practice question tests your understanding of information system auditing process. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Observation of processes being performed
Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Accepting management's assertions without corroboration
Why it's wrong here
Assertions must be supported by evidence.
✓
Observation of processes being performed
Why this is correct
Observation provides direct evidence of control performance.
Related concept
Read the scenario before looking for a memorised answer.
✓
Reperformance of control procedures
Why this is correct
Reperformance is a strong form of evidence.
Related concept
Read the scenario before looking for a memorised answer.
✓
Inquiry of personnel
Why this is correct
Inquiry is a valid technique, but corroboration is needed.
Related concept
Read the scenario before looking for a memorised answer.
✗
Obtaining hearsay from third parties
Why it's wrong here
Hearsay is not reliable or objective evidence.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may mistakenly believe that inquiry alone (Option D) is insufficient, but inquiry is a valid evidence-gathering method when combined with other procedures, while accepting unsupported assertions (Option A) and hearsay (Option E) are never acceptable as primary evidence.
Detailed technical explanation
How to think about this question
Observation as an audit technique is often used for controls that are not automated or where system logs may not capture the full context, such as reviewing physical access to a data center or observing a user's password change procedure. However, observation provides evidence only for the specific moment it occurs and may not reflect consistent performance over time, so it is often supplemented with reperformance or inspection of logs to confirm ongoing compliance.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information System Auditing Process — This question tests Information System Auditing Process — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Observation of processes being performed — Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.