CISA Information System Auditing Process Practice Question
Which TWO of the following are types of audit evidence recognized in IS audit practice?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Observation
In IS audit practice, evidence is classified by how it is obtained and its reliability, and two recognized types here are Observation (B) and Re-performance (D). Observation (B) is valid because auditors directly witness processes, controls, or personnel performing activities, yielding first-hand evidence about how a control actually operates. Re-performance (D) is valid because the auditor independently executes the control or procedure (for example, recalculating a depreciation schedule or re-running an access review) and compares the result to the client's output, producing highly reliable evidence. The remaining options do not belong: Assumption (A), Conjecture (C), and Hypothesis (E) are speculative or unverified propositions, not evidence types, since audit evidence must be based on actual observation, inspection, inquiry, confirmation, recalculation, or re-performance rather than supposition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assumption
Why it's wrong here
An assumption is an accepted premise without verification, not audit evidence; evidence must be sufficient, reliable and relevant, drawn from physical, documentary, testimonial or analytical sources. It is tempting because assumptions underpin audit scoping, and would be correct if the question concerned planning constraints rather than evidence types.
- ✓
Observation
Why this is correct
Observation involves the auditor watching a process or control being performed, such as witnessing a backup or physical access procedure. ISACA recognises observation alongside inspection, inquiry, re-performance and analytics as a distinct audit evidence type.
- ✗
Conjecture
Why it's wrong here
Conjecture is an opinion formed without sufficient proof, so it cannot constitute audit evidence; recognised types are physical, documentary, testimonial and analytical. It is tempting because auditors reason about possible causes during planning, and would be correct if the question asked about forming preliminary theories rather than evidence classification.
- ✓
Re-performance
Why this is correct
Re-performance involves the auditor independently executing a control or procedure and comparing the result with the auditee's outcome. ISACA recognises it as a distinct evidence type, and it provides stronger assurance than inquiry or observation alone.
- ✗
Hypothesis
Why it's wrong here
A hypothesis is a proposed explanation awaiting testing, not evidence; IS audit evidence comprises physical, documentary, testimonial and analytical types. It is tempting because auditors do form hypotheses during enquiry, and would be correct if the question asked about an analytical technique used to direct testing rather than a category of evidence.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.