Audit Evidence: Sufficiency, Appropriateness and Reliability
By SimplyCPA · 11 October 2026
On this page (8)
- Sufficiency: The quantity of evidence — driven by the assessed risk of material misstatement and the quality of the evidence.
- Appropriateness: The quality of evidence — its relevance to the assertion and its reliability.
- Reliability rules of thumb: External beats internal; the auditor's own direct knowledge beats indirect; documents beat oral; originals beat copies; effective controls make internal evidence more reliable.
- Procedures: Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry — inquiry alone is never enough.
- Information produced by the entity: Before relying on reports and data from the client's systems, the auditor must evaluate whether they are accurate and complete.
The standard
The auditor's objective is to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low level and support the opinion. For private-company audits the requirements are in AU-C 500 (as amended by SAS No. 142, effective for periods ending on or after December 15, 2022); for public companies, PCAOB AS 1105.
Sufficiency and appropriateness
- Sufficiency is quantity. More evidence is needed when the risk of material misstatement is higher, and less when the evidence is of higher quality. But more evidence can't compensate for poor quality.
- Appropriateness is quality, made up of relevance (does it address the assertion being tested?) and reliability (can it be trusted?).
Relevance trap: Confirming receivables tests existence, not valuation — a customer can confirm a balance it will never pay. Testing for unrecorded liabilities needs evidence that starts outside the ledger (later payments, supplier statements), because testing recorded items can't reveal what's missing.
The reliability hierarchy
| More reliable | Less reliable |
|---|---|
| Obtained from independent sources outside the entity | Generated internally |
| Internal evidence produced under effective controls | Internal evidence produced under weak controls |
| Obtained directly by the auditor (observation, recalculation) | Obtained indirectly or by inference (inquiry) |
| Documentary, paper or electronic | Oral |
| Original documents | Photocopies, scans, faxes |
SAS No. 142 adds that the auditor considers attributes such as the source, accuracy, completeness, authenticity and susceptibility to management bias — and that evidence can be obtained using automated tools and techniques.
The seven types of audit procedure
- Inspection of records, documents or tangible assets.
- Observation of a process being performed (such as an inventory count).
- External confirmation — a direct written response from a third party (AU-C 505).
- Recalculation — checking mathematical accuracy.
- Reperformance — independently executing a control or procedure.
- Analytical procedures — evaluating plausible relationships among data.
- Inquiry — seeking information from knowledgeable people. It must be corroborated by other procedures.
Information produced by the entity (IPE)
When the auditor uses client-generated reports — an aged receivables listing, a sales report, a system-generated journal — it must obtain evidence about the information's accuracy and completeness and evaluate whether it is precise and detailed enough for the purpose. That might mean testing the controls over the report, or agreeing samples to and from source data. See testing automated controls and system-generated reports.
Specialists
- Management's specialist (such as an actuary or valuer the client hired): the auditor evaluates their competence, capabilities and objectivity, understands their work, and evaluates it as evidence.
- Auditor's specialist (AU-C 620): the auditor remains fully responsible for the opinion and does not refer to the specialist in an unmodified report.
Inconsistent evidence
If evidence from one source conflicts with another, or the auditor doubts the reliability of information, it must determine what changes or additions to procedures are needed and consider the effect on other aspects of the audit.
Continue with AUD evidence types and procedures and audit assertions.