An auditor testing wire-transfer approvals interviews the treasury manager, who describes a two-signature rule. The policy manual says one signature above $100,000. The observed process uses a shared token. Three sources, three answers. Knowing which source carries what weight is the whole skill.
Engagement objectives tell you what question to answer. Sources supply the evidence that answers it. Choose the wrong source and you get a plausible answer with no support, which is the defect the exam punishes. The two families you must control are gathering methods (what the auditor actively does) and existing documents (what the organization already produced).
KEY: Evidence generated by the auditor is stronger than evidence supplied by the auditee, and evidence you observe directly is stronger than evidence someone describes to you. Reliability ranks by who created it and how directly you saw it.
Four methods appear across engagement planning and fieldwork. Each has a distinct job.
- Interviews: structured conversations with process owners, staff, and stakeholders. Best for understanding intent, exceptions, informal workarounds, and where the process owner believes risk lives.
- Observations: watching the process happen in real time (a cash count, a physical inventory, a badge-access check).
Common mistakes
- Treating a walk-through as effectiveness testing. Two traced transactions cannot support a conclusion about 1,260 items. Design confirmation only.
- Accepting self-assessment ratings as evidence. In Example 1, 11 of 12 units self-rated effective while 4.3% of items failed. Ratings direct effort; they do not conclude.
- Analyzing an unreconciled extract. A 4.3% rate computed on an incomplete pull is a precise wrong number. Tie the extract to a control total first.
Bottom line
- Methods: interviews, observations, walk-throughs, and data analyses. Documents: policies, checklists, risk and control questionnaires, and self-assessment surveys.
- Auditor-generated evidence (observation, walk-through, data analysis) outranks auditee-supplied evidence (questionnaires, self-assessments, checklists).
- Walk-throughs confirm process design and understanding; they never support an operating-effectiveness conclusion.
- Observation covers a point in time only; data analysis is the only method reaching up to 100% of a population.
Exam shortcut
Read the stem for the assertion, then pick the source that matches it. "What is required" means policy. "Is the process as described" means walk-through. "Is it running right now" means observation. "How often across the year" means data analysis.
The full lesson (about 2,065 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 1
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.