What does the 'auditor as questioner' approach emphasize?

• A. Asking 'why' to expose hidden assumptions.
• B. Relying solely on checklists.
• C. Performing only technical testing.
• D. Producing reports without inquiry.

Answer: (A)

Auditor-as-questioner is about inquiry and professional skepticism. It focuses on asking why things are done a certain way, not just accepting what’s documented. By probing with open-ended questions, the auditor reveals hidden assumptions, connects controls to actual risks, and seeks evidence that explains how processes are supposed to work in practice. This approach drives deeper understanding and ensures findings are grounded in real operations, supported by details like who performed which action, when, and why.

In cybersecurity contexts, this means not just checking that a control exists, but exploring the rationale behind it, how it’s implemented, and whether it functions as intended under real conditions. That kind of questioning uncovers gaps, design flaws, or deviations that a pure checklist or technical pass might miss, leading to more meaningful assurance.

Relying solely on checklists can miss context and important nuances of how controls operate in the real environment. Performing only technical testing may overlook governance, process design, and user behavior aspects that influence effectiveness. Producing reports without inquiry would deliver surface-level assurance without validating that controls actually work as claimed.