Evidence: Types & Procedures

Why this topic matters

Audit evidence is the information the auditor uses to reach conclusions. Statement on Auditing Standards (SAS) No. 142 updated the evidence standard to focus on the attributes of information — relevance and reliability — whatever its source, including data used in automated tools. Auditing and Attestation (AUD) Area III tests procedure types, direction of testing, confirmations, inventory observation, and cycle-specific procedures.

Sufficient appropriate evidence

• Sufficiency is the quantity of evidence, driven by the assessed risk and the quality of the evidence.
• Appropriateness is the quality: relevance (relates to the assertion being tested) and reliability (accuracy, completeness, authenticity, and susceptibility to bias).
• More evidence cannot compensate for poor-quality evidence.
• The auditor considers information that contradicts management's assertions as well as corroborating information, and applies professional skepticism throughout.

Reliability hierarchy

More reliable	Less reliable
From independent sources outside the entity	From inside the entity
Obtained directly by the auditor (observation, recalculation)	Obtained indirectly or by inference (inquiry)
Generated under effective internal controls	Generated under weak controls
Documentary (paper or electronic)	Oral
Original documents	Photocopies, scans, or faxes

When using information produced by the entity (IPE), the auditor must evaluate whether it is sufficiently precise and detailed and obtain evidence about its accuracy and completeness.

Types of audit procedures

Procedure	Description	Example
Inspection of records or documents	Examining internal or external records	Reading contracts, vouching invoices
Inspection of tangible assets	Physical examination	Examining equipment additions
Observation	Watching a process being performed	Observing the inventory count
Inquiry	Seeking information from knowledgeable people	Asking about obsolete inventory — never sufficient alone
External confirmation	A direct written response from a third party	Bank and receivable confirmations
Recalculation	Checking mathematical accuracy	Recomputing depreciation
Reperformance	Independently executing a control	Redoing a bank reconciliation
Analytical procedures	Evaluating plausible relationships	Comparing gross margin to expectations

Direction of testing

Direction	From → To	Assertion tested
Vouching	Recorded entry → supporting document	Existence / occurrence (was the recorded item real?)
Tracing	Source document → recorded entry	Completeness (was everything recorded?)

External confirmations

• The auditor must maintain control over requests and responses — selecting the parties, designing the request, and sending and receiving responses directly.
• Positive confirmations ask for a response in all cases (blank form — asks the recipient to fill in the balance — is more reliable than one that shows the amount). A non-response requires alternative procedures (for receivables: examine subsequent cash receipts, shipping documents, and sales invoices).
• Negative confirmations ask for a response only if the recipient disagrees. They may be the sole substantive procedure only if: risk of material misstatement is low and controls over the assertion are effective; the population consists of a large number of small, homogeneous balances; a very low exception rate is expected; and there is no reason to believe recipients will disregard requests.
• Consider reliability issues: responses by email or through intermediaries, restrictive disclaimers, and indications of fraud.
• Management refuses to allow a confirmation: inquire about the reasons, evaluate their validity and the implications for fraud risk, and perform alternative procedures. If unreasonable, communicate with those charged with governance and consider a scope limitation.
• Accounts receivable should be confirmed unless they are immaterial, confirmation would be ineffective, or the risk of material misstatement is low and other substantive procedures address it. Document the reason if not confirmed.

Inventory

• When inventory is material, the auditor must attend the physical count (unless impracticable) to evaluate management's instructions, observe procedures, inspect inventory, and perform test counts.
• Test counts in both directions: from the count tags to the floor (existence) and from the floor to the tags (completeness).
• Obtain cutoff information (last receiving and shipping documents).
• If the count is not at year-end, test the roll-forward of changes.
• If attendance is impracticable, perform alternative procedures (for example, inspecting documentation of subsequent sales); if none are possible, modify the opinion for a scope limitation.
• Inventory held by third parties: confirm and/or inspect, and consider the third party's integrity.

Litigation, claims, and assessments

• Inquire of management, review minutes and legal expense accounts, and send a letter of audit inquiry to the entity's external lawyers (requested by management, returned directly to the auditor).
• A lawyer's refusal to respond is a scope limitation, possibly leading to a qualified opinion or disclaimer.

Procedures by cycle — quick reference

Account	Key procedures
Cash	Bank confirmation, bank reconciliation, cutoff bank statement, bank transfer schedule (to detect kiting)
Receivables and revenue	Confirmation, aging and allowance review, sales cutoff testing, subsequent cash receipts, review of credit memos after year-end
Inventory	Observation, test counts, cutoff, pricing tests, lower-of-cost-or-net-realizable-value testing
Property, plant, and equipment	Vouch additions, inspect assets, review repairs and maintenance for items that should be capitalized, recalculate depreciation
Payables	Search for unrecorded liabilities: examine cash disbursements and unpaid invoices after year-end; vendor statement reconciliations
Debt and equity	Confirm with lenders and the transfer agent, read agreements and covenants, review board minutes

Audit documentation

• Documentation must allow an experienced auditor with no prior connection to the engagement to understand the procedures, evidence, and conclusions.
• Record who performed and reviewed the work and when, and identifying characteristics of items tested.
• Assemble the final file within 60 days after the report release date; retain for at least 5 years (issuers under Public Company Accounting Oversight Board (PCAOB) standards: assemble within 45 days, retain 7 years).
• Documentation belongs to the auditor.

How it is tested

• Rank evidence by reliability.
• Match a procedure to the assertion it tests (vouching vs tracing).
• Apply confirmation rules, including negative confirmations and non-responses.
• Choose the best procedure for a specific account risk.