An auditor is assessing IT general controls at a client's data center. Which of the following would provide the most persuasive evidence regarding the operating effectiveness of physical access controls?
- Reviewing the company's written policy on data center access.
- Interviewing the data center manager about procedures for granting access.
- Observing employee and visitor access to the data center and inspecting the access log for proper authorization. (correct answer)
- Examining the invoice for the recently installed biometric scanner at the data center entrance.
Explanation: Audit evidence is most persuasive when it is obtained from multiple sources or is of different types. Combining direct observation of the control in operation with inspection of related documentation (the access log) provides strong evidence of operating effectiveness. Reviewing a policy (A) only addresses control design. Inquiry (B) is not sufficient on its own. Examining an invoice (D) proves a control was purchased but not that it is operating effectively.