Evidence must be reliable

Exam

CISA

What it means

Evidence obtained directly by the auditor beats evidence provided by the auditee, and documents from independent sources beat internal ones. Statements alone are never enough.

The trap answer looks like

A statement from the administrator, a screenshot emailed by IT, or the policy that requires the setting.

The winning answer looks like

Evidence the auditor obtains directly, from independent sources, or by reperforming the control.

Worked example

Which provides the MOST reliable evidence that a setting is configured?

✅ The setting observed and captured directly by the auditor

The closer the auditor is to the source, the stronger the evidence.