Category: Internal Audit and Assurance
Audit Evidence
Also known as: Auditing Evidence
Simply put
Audit evidence is the information an auditor collects and evaluates to support the conclusions and opinion reached during an audit. It can come from the auditor's own procedures or from other sources, and it is meant to give a reasonable basis for the findings an auditor reports.
Formal definition
Audit evidence is all the information, whether obtained from audit procedures or other sources, that is used by the auditor in arriving at the conclusions on which the auditor's opinion is based. To support an audit opinion, evidence is generally expected to be both sufficient (a measure of quantity) and appropriate (a measure of quality, encompassing relevance and reliability). The specific requirements governing the nature, timing, and extent of evidence depend on the applicable auditing standards, engagement type, and jurisdiction; for example, under PCAOB standards such as AS 1105, evidence supports the auditor's conclusions in the audit of financial statements. This entry is educational and not audit, legal, or compliance advice.
Why it matters
Audit evidence is the foundation on which an audit opinion rests. Without sufficient and appropriate evidence, an auditor's conclusions are unsupported, and the assurance an audit is meant to provide loses its value. Because stakeholders, investors, boards, audit committees, regulators, and lenders, rely on audit opinions to make decisions, the quality and quantity of the underlying evidence directly affect the credibility of financial reporting and the trust placed in the reporting entity.
The distinction between sufficiency (a measure of quantity) and appropriateness (a measure of quality, encompassing relevance and reliability) matters because more evidence does not compensate for evidence that is unreliable or irrelevant, and highly reliable evidence does not excuse gathering too little. Auditors exercise professional judgment to determine what combination of evidence provides a reasonable basis for their conclusions, and that judgment depends on the applicable auditing standards, the engagement type, and the jurisdiction.
Audit evidence also functions as the documentary record of what the auditor did and why. When the adequacy of an audit is later questioned, by an audit committee, an inspection, or a regulator, the evidence gathered and how it was evaluated becomes central to demonstrating whether the auditor had a reasonable basis for the opinion expressed. This entry is educational and not audit, legal, or compliance advice; the specific requirements that apply to any engagement should be assessed against the relevant standards and professional judgment.
Who it's relevant to
External and Internal Auditors
Auditors are the primary parties responsible for gathering and evaluating audit evidence. They apply professional judgment to determine whether the evidence obtained is sufficient and appropriate to support the conclusions and opinion they express, working within the applicable standards for their engagement type and jurisdiction.
Audit Committees and Boards
Audit committees oversee the external audit process and rely on the auditor's opinion, which is only as strong as the evidence supporting it. Understanding what constitutes sufficient and appropriate evidence helps directors ask informed questions about the basis for the auditor's conclusions, without themselves performing the auditor's procedures.
Chief Financial Officers and Finance Teams
Management prepares the financial information that auditors examine and provides much of the underlying documentation. Because audit evidence is used to test compliance with financial reporting standards such as GAAP, finance teams have a direct interest in maintaining records that can serve as reliable, relevant evidence during an audit.
Regulators and Standard Setters
Bodies that set and enforce auditing standards, such as the PCAOB in the context of AS 1105, define the requirements for the nature, timing, and extent of audit evidence. They also assess whether auditors accumulated a reasonable basis for their opinions, making audit evidence central to inspection and oversight activity.
Inside Audit Evidence
Sufficiency
Sufficiency refers to the quantity of audit evidence obtained. The amount needed is typically influenced by the auditor's assessment of the risk of material misstatement and the quality of the evidence; higher assessed risk generally calls for more evidence, while higher-quality evidence may reduce the quantity required. Sufficiency is a matter of professional judgment.
Appropriateness
Appropriateness is the measure of the quality of audit evidence, encompassing its relevance and reliability in supporting the conclusions on which the auditor's opinion is based. Sufficiency and appropriateness are interrelated but distinct attributes of evidence.
Relevance
Relevance concerns the logical connection between the evidence and the assertion or objective being tested. Evidence relevant to one assertion (for example, existence) is not necessarily relevant to another (for example, valuation or completeness).
Reliability
Reliability relates to the trustworthiness of evidence, which is generally influenced by its source and nature. Evidence obtained from independent external sources, generated under effective controls, or observed directly by the auditor is typically considered more reliable, though this depends on the specific circumstances.
Sources and procedures
Audit evidence is gathered through procedures such as inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, and inquiry. Inquiry alone generally does not provide sufficient appropriate evidence and is typically corroborated with other procedures.
Relationship to assertions and conclusions
Audit evidence supports the assurance function's conclusions and, ultimately, the auditor's opinion. It is accumulated to reduce audit risk to an acceptably low level rather than to provide absolute certainty.
Common questions
Answers to the questions practitioners most commonly ask about Audit Evidence.
Does more audit evidence always mean a stronger audit conclusion?
Not necessarily. The persuasiveness of audit evidence depends on both its sufficiency (quantity) and its appropriateness (quality, comprising relevance and reliability), and these two dimensions work together rather than being substitutable in a simple way. A large volume of evidence that is not relevant to the assertion being tested, or that comes from a source of questionable reliability, generally does not strengthen a conclusion. Conversely, a smaller amount of highly reliable and relevant evidence may be persuasive. Auditors typically exercise professional judgment to determine when sufficient appropriate evidence has been obtained; accumulating more of the same weak evidence does not cure a deficiency in quality. The specific standards and judgments involved vary by engagement type and applicable auditing framework, and this entry is educational rather than audit advice.
Is audit evidence generated by an entity's own internal controls just as reliable as evidence obtained directly by the auditor?
Generally not, though the distinction depends on the circumstances. Reliability of audit evidence is typically affected by its source and nature. Evidence obtained directly by the auditor, such as through direct observation or independent recalculation, is generally considered more reliable than evidence provided solely by the entity. Similarly, evidence from independent external sources is often regarded as more reliable than internally generated evidence. That said, internally generated evidence can be more reliable when the related internal controls are well designed and operating effectively. The relative reliability is a matter of professional judgment applied to the facts, and the weight given to any single source is generally considered alongside other corroborating or contradictory evidence rather than in isolation.
How does an auditor decide how much audit evidence is enough?
The determination of sufficiency is generally a matter of professional judgment rather than a fixed formula. Auditors typically consider factors such as the assessed risk of material misstatement for the relevant assertion, the quality (appropriateness) of the evidence available, and the materiality of the item. Higher assessed risk and lower-quality evidence generally call for a greater quantity of evidence, while higher-quality evidence may reduce the quantity needed. The specific approach depends on the applicable auditing standards, the nature of the engagement, and the auditor's own judgment. This is a general description and not a substitute for engagement-specific audit guidance.
What distinguishes evidence used to test control design from evidence used to test operating effectiveness?
These address different questions and generally call for different evidence. Testing control design typically seeks evidence about whether a control, as designed, is capable of preventing or detecting and correcting a misstatement. Testing operating effectiveness typically seeks evidence about whether a control actually operated as designed over the relevant period. Evidence for design might include inspecting policies, procedures, and the configuration of a control, while evidence for operating effectiveness often involves observing the control in operation, inspecting evidence of its performance across the period, or reperformance. Because a well-designed control can still fail to operate consistently, evidence supporting one does not automatically support the other. The precise expectations depend on the applicable framework and the auditor's judgment.
How should documentation of audit evidence be approached during an engagement?
As a general matter, audit documentation is intended to provide a sufficient and appropriate record of the evidence obtained and the basis for the conclusions reached, such that an experienced practitioner with no prior connection to the engagement could understand the work performed. Practically, this typically means recording the nature, timing, and extent of procedures performed, the evidence examined, and the conclusions drawn, along with the source and reliability considerations for that evidence. Documentation practices are governed by applicable auditing standards, which vary by jurisdiction and engagement type. This description is educational and does not set out the specific documentation requirements of any particular standard.
When contradictory audit evidence arises, how is it generally handled?
When an auditor identifies evidence that is inconsistent with, or contradicts, other evidence or the conclusions being formed, that inconsistency generally is not disregarded. Common practice is to investigate the contradiction, obtain additional or corroborating evidence as needed, and evaluate whether it affects the assessment of risk or the reliability of related evidence. The resolution and the reasoning are typically documented. How this is carried out depends on the applicable standards and the auditor's professional judgment applied to the specific facts, and it may require reconsideration of earlier conclusions. This is a general description rather than audit advice.
Common misconceptions
More audit evidence always produces a stronger conclusion.
Quantity (sufficiency) and quality (appropriateness) are distinct and interrelated. A large volume of low-quality or irrelevant evidence does not necessarily support a conclusion better than a smaller amount of highly relevant and reliable evidence; the two attributes must be considered together using professional judgment.
Audit evidence provides absolute assurance that the financial statements are free from misstatement.
Audit evidence is generally accumulated to reduce audit risk to an acceptably low level, not to eliminate it. Assurance engagements typically provide reasonable, not absolute, assurance, reflecting inherent limitations of an audit.
Inquiry of management is enough to substantiate an audit conclusion.
Inquiry alone generally does not constitute sufficient appropriate evidence. Responses to inquiry are typically corroborated with evidence obtained through other procedures, particularly evidence from independent or external sources.
Best practices
Evaluate both sufficiency and appropriateness together, recognizing that higher-quality evidence may reduce the quantity needed while higher assessed risk generally increases it.
Link each piece of evidence to the specific assertion or objective it addresses, since evidence relevant to one assertion may not be relevant to another.
Prioritize evidence from independent external sources or generated under effective controls where reliability is important, while assessing reliability in the context of the specific engagement.
Use a combination of procedures, such as inspection, observation, confirmation, recalculation, reperformance, and analytical procedures, rather than relying on inquiry alone, and corroborate inquiry responses with other evidence.
Document the nature, timing, and extent of procedures performed and the judgments made about sufficiency and appropriateness so conclusions can be traced back to supporting evidence.
Calibrate the evidence-gathering effort to the assessed risk of material misstatement, aiming to reduce audit risk to an acceptably low level rather than seeking absolute certainty.