You are an information system auditor of HDA Inc. You are currently evaluating the effectiveness of controls in the company's information system. In this context, which of the following options would be the MOST effective method for you to employ in order to assess the adequacy of controls?