| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
Audit Evidence Collection Techniques
This episode of the ISACA Certified Information Systems Auditor (CISA) exam prep series focuses on the evidence-gathering skills that underpin every audit opinion. It covers what counts as audit evidence, the four factors that determine reliability, the main collection techniques, and the practical skills of interviewing and observation that determine whether findings are defensible.
What this episode covers
- Audit evidence defined — any information used to judge against audit criteria, which must be sufficient, relevant, and competent.
- Reliability factors — the source, the provider’s qualifications, the degree of objectivity, and the timing of the evidence all affect how much weight it carries.
- Appropriate vs. sufficient — quality versus quantity, and how professional judgment decides when both thresholds are met.
- Collection techniques — reviewing organisation structure, policies, procedures, standards, and documentation as core approaches.
- Interviewing — how to arrange, conduct, and document interviews in a discovery mindset that encourages sharing rather than accusation.
- Observation — what watching people can reveal about functions, processes, security awareness, and separation of duties, and the Hawthorne-effect limitation.
- Reperformance and walk-throughs — when actually performing a control yourself provides the strongest evidence, and how a walk-through confirms shared understanding.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What makes audit evidence reliable?
Four factors determine reliability: who provided the evidence (external sources are more reliable than internal ones), how qualified the provider is (including the auditor’s own technical competence in the area), how objective the evidence is (direct and observable evidence beats opinion or casual conversation), and timing (whether the data will still be available and unchanged when needed).
What is the difference between appropriate and sufficient evidence?
Appropriate refers to the quality of evidence — it must be reliable and relevant to the audit objective. Sufficient refers to the quantity — there must be enough of it to support the conclusion. For evidence to be competent it must satisfy both dimensions, and the auditor uses professional judgment to decide when that threshold is reached.
Why is reperformance considered the strongest evidence-gathering technique?
Reperformance means the auditor actually performs the control themselves in real time, which removes reliance on someone else’s account of what happened. It generally gives the strongest evidence because it is direct, objective, and difficult to dispute, and is used when inquiry and observation alone are not sufficient.
What are the key things observation can reveal, and what is its main limitation?
Observation can reveal the actual functions being performed, whether processes and procedures are followed in practice, the level of security awareness among staff, and whether reporting relationships and separation of duties hold. Its main limitation is that people who know they are being watched may change their behaviour, so observation should be paired with interviews to confirm normal practice.
📚 Master the ISACA CISA Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISACA CISA certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in Audit Evidence Collection Techniques.