--- question: "What are the 4 types of tests of controls?" title: "What Are the 4 Types of Tests of Controls" seoTitle: "4 Types of Tests of Controls in an Audit" summary: "The four types of tests of controls are inquiry, observation, inspection, and reperformance. Inquiry means asking the people who run a control how it works. Observation means watching the control being performed. Inspection means examining documents, records, or system configurations that show the control operated. Reperformance means the auditor independently executes the control to confirm it produces the same result. Auditing standards treat inquiry alone as insufficient, so auditors combine it with at least one of the other three, and the strength of the evidence rises roughly in that order." publishedAt: "2026-09-14" keywords: - "4 types of tests of controls" - "inquiry observation inspection reperformance" - "SOC 2 testing methods" - "audit test of controls" pillar: "SOC 2 Evidence Collection" faqs: - question: "what are the 4 types of test of control?" answer: "Inquiry, observation, inspection, and reperformance. Inquiry is asking how the control works, observation is watching it performed, inspection is examining the records or configuration it leaves behind, and reperformance is the auditor running the control again independently. Most SOC 2 and SOX testing combines inquiry with inspection." - question: "Is inquiry alone enough to test a control?" answer: "No. Auditing standards state that inquiry alone does not provide sufficient evidence that a control operated effectively. An auditor who asks your engineer how access reviews work will still ask for the completed reviews, the tickets, or a system export before concluding the control operated." - question: "What is the difference between inspection and reperformance?" answer: "Inspection examines evidence that a control was performed, such as a signed access review or a pull request approval. Reperformance has the auditor execute the control independently, for example recomputing a user list from the source system and comparing it with the one your team reviewed. Reperformance is stronger because it does not rely on your records being complete." --- ## What are the 4 types of tests of controls? The four types of tests of controls are **inquiry, observation, inspection, and reperformance**. They are the procedures an auditor uses to decide whether a control was designed properly and operated effectively, in SOC 2 examinations, SOX audits, and internal audit alike. Inquiry alone is never enough under auditing standards, so every conclusion rests on inquiry combined with at least one of the other three. ## The four tests, with SOC 2 examples | Test | What the auditor does | SOC 2 example | Evidence strength | |---|---|---|---| | Inquiry | Asks the control owner how the control works | Interviews the CTO about how production access is granted | Lowest; never sufficient alone | | Observation | Watches the control being performed | Watches an engineer request and receive production access | Point in time only | | Inspection | Examines records, documents, or configurations | Reviews access request tickets, approvals, and the IAM configuration | Strong, if the population is complete | | Reperformance | Independently executes the control | Pulls the user list from the identity provider and compares it with the reviewed list | Strongest | Observation has a known limit: it proves the control operated while the auditor was watching. For a Type II report covering a 3 to 12 month window, auditors lean on inspection of samples drawn across the whole period, because observation cannot reach backward in time. ## How auditors choose which test to use The choice depends on how the control operates. A manual control that leaves no record, such as a physical walkthrough, pushes the auditor toward observation. A control that produces tickets, approvals, or logs is tested by inspection of a sample. An automated control, such as a password configuration, is often tested once by inspection or reperformance, because a system setting behaves the same way every time it runs. Sample sizes follow frequency. A control that runs daily yields a larger sample than one that runs quarterly, and the auditor draws the sample from the full population your team provides. That is why the population itself gets scrutiny: a sample drawn from an incomplete list proves nothing about the missing items. ## What this means for the evidence you collect Every test type maps to an artifact you can prepare. Inquiry needs a named control owner who can explain the process. Inspection needs complete, timestamped records for the whole period. Reperformance needs the auditor to be able to reach the source data, or an export whose provenance they can trust. The weak point in most programs is inspection evidence assembled after the fact: screenshots taken the week before fieldwork, or exports with no record of when or how they were produced. Evidence captured at the time the control ran, with a timestamp and a record of the source, holds up under inspection and makes reperformance easier. For how auditors treat different evidence formats, see [why auditors reject CSV exports as evidence](/resources/answers/why-do-auditors-reject-csv-exports-as-evidence).