SOC 2 Evidence Collection
What are the 4 types of tests of controls?
What are the 4 types of tests of controls?
The four types of tests of controls are inquiry, observation, inspection, and reperformance. They are the procedures an auditor uses to decide whether a control was designed properly and operated effectively, in SOC 2 examinations, SOX audits, and internal audit alike. Inquiry alone is never enough under auditing standards, so every conclusion rests on inquiry combined with at least one of the other three.
The four tests, with SOC 2 examples
| Test | What the auditor does | SOC 2 example | Evidence strength |
|---|---|---|---|
| Inquiry | Asks the control owner how the control works | Interviews the CTO about how production access is granted | Lowest; never sufficient alone |
| Observation | Watches the control being performed | Watches an engineer request and receive production access | Point in time only |
| Inspection | Examines records, documents, or configurations | Reviews access request tickets, approvals, and the IAM configuration | Strong, if the population is complete |
| Reperformance | Independently executes the control | Pulls the user list from the identity provider and compares it with the reviewed list | Strongest |
Observation has a known limit: it proves the control operated while the auditor was watching. For a Type II report covering a 3 to 12 month window, auditors lean on inspection of samples drawn across the whole period, because observation cannot reach backward in time.
How auditors choose which test to use
The choice depends on how the control operates. A manual control that leaves no record, such as a physical walkthrough, pushes the auditor toward observation. A control that produces tickets, approvals, or logs is tested by inspection of a sample. An automated control, such as a password configuration, is often tested once by inspection or reperformance, because a system setting behaves the same way every time it runs.
Sample sizes follow frequency. A control that runs daily yields a larger sample than one that runs quarterly, and the auditor draws the sample from the full population your team provides. That is why the population itself gets scrutiny: a sample drawn from an incomplete list proves nothing about the missing items.
What this means for the evidence you collect
Every test type maps to an artifact you can prepare. Inquiry needs a named control owner who can explain the process. Inspection needs complete, timestamped records for the whole period. Reperformance needs the auditor to be able to reach the source data, or an export whose provenance they can trust.
The weak point in most programs is inspection evidence assembled after the fact: screenshots taken the week before fieldwork, or exports with no record of when or how they were produced. Evidence captured at the time the control ran, with a timestamp and a record of the source, holds up under inspection and makes reperformance easier. For how auditors treat different evidence formats, see why auditors reject CSV exports as evidence.