CIA-2 - Information Gathering, Analysis, and Evaluation (40% of the exam) - Section B.1
Identify sources of information to support engagement objectives and procedures, including interviews, observations, walk-throughs, data analyses, and documentary sources.
Determine suitable methods for obtaining engagement information, including interviews, direct observation, walk-throughs, and data analyses, choosing the method that best fits the information sought. Identify suitable documentary sources such as policies, checklists, risk and control questionnaires, and self-assessment surveys to corroborate or supplement what is learned through fieldwork.
Information gathering methodsWalk-throughSelf-assessment survey
Practice question for this objective
lock_openFree sampleInformation Gathering, Analysis, and Evaluationeasy
An internal auditor wants staff in a business unit to evaluate how well the controls in their own area are working by completing a structured questionnaire themselves. Which information-gathering method is being described?
AA walk-through, in which the auditor traces one transaction through the process from start to finish.
BDirect observation, in which the auditor watches the control being performed in real time.
CA control self-assessment survey, in which staff evaluate the controls in their own area.check_circle Correct
DReperformance, in which the auditor independently re-executes the control to test it.
A control self-assessment survey gathers information by having staff evaluate the controls in their own area through a structured questionnaire. A control self-assessment survey collects information by having the people who perform the controls assess them via a structured questionnaire. That self-reported source is distinct from the auditor observing, tracing, or reperforming the control, which are all performed by the auditor rather than the process staff.
Why A is wrong: A walk-through has the auditor trace a transaction personally, not the staff completing a questionnaire about their own controls, so it does not fit the description.
Why B is wrong: Observation means the auditor watches the control happen; here the staff themselves report on their controls, so the method described is not observation.
Why C is correct: Correct: a control self-assessment survey gathers information by having the people who operate the controls evaluate them through a structured questionnaire.
Why D is wrong: Reperformance has the auditor re-execute the control independently; it is not staff completing a survey about their own area, so this label is wrong.
Exam traps in Information Gathering, Analysis, and Evaluation
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
The conclusion is a detailed list of every control tested, whereas observations summarise the auditor's opinion on the whole
errorWhy it is wrong: Reversed: a list of controls tested is working-paper detail, not a conclusion, and observations are the specific facts rather than the summary opinion.
As conclusive assurance that the controls are effective, requiring no further audit testing
errorWhy it is wrong: Treating self-ratings as conclusive removes the auditor's independent judgement; it is tempting for efficiency but self-assessment is a starting input, not final assurance.
That the process has operated effectively throughout the entire period under review.
errorWhy it is wrong: Tempting because effectiveness matters, but a walk-through covers a single transaction at one point, so it cannot evidence how the process operated across the whole period.