Reviewing the system and gathering evidence can be achieved by using three basic techniques:

Interviewing staff

Ask questions about the system and its implementation.

Six questions which will provide information effectively and efficiently are: who, what, when, how, where and why. These questions will produce answers of substance and keep dialogue flowing between the auditor and auditee.