Audit Evidence
Audit evidence is the foundation on which every audit opinion rests. The auditor gathers information throughout the engagement to form a reasonable basis for concluding whether the financial statements are free of material misstatement. Understanding what constitutes sufficient and appropriate evidence—and how to obtain it—is essential for CPA exam success and professional practice.
Types of Audit Procedures
Auditors perform three broad categories of procedures during an engagement. Each serves a distinct purpose in the overall audit strategy.
1. Risk Assessment Procedures
These are performed during the planning phase to identify and assess the risks of material misstatement at both the financial statement level and the assertion level. Risk assessment procedures include:
- Inquiries of management and others within the entity
- Analytical procedures applied to preliminary financial data
- Observation and inspection of operations, documents, and internal reports
While planning the audit of Gies Co., the engagement team inquires with the CFO about new revenue streams, reviews interim financial statements for unusual trends, and tours the warehouse to observe inventory controls. These steps help the auditor understand where misstatement risks are highest.
2. Tests of Controls
Tests of controls evaluate the operating effectiveness of internal controls that the auditor intends to rely upon. These tests are performed when:
- The auditor's risk assessment assumes controls are operating effectively
- Substantive procedures alone cannot provide sufficient evidence at the assertion level
Tests of controls answer the question: "Are the client's controls actually working as designed?" If the answer is yes, the auditor may reduce the extent of substantive testing.
3. Substantive Procedures
Substantive procedures are designed to detect material misstatements at the assertion level. They include:
- Tests of details — examining individual transactions and balances
- Substantive analytical procedures — evaluating relationships and trends in financial data
Substantive procedures are always required for significant account balances and transaction classes, regardless of the assessed level of risk.
When Is Audit Evidence Gathered?
Audit evidence is gathered throughout the entire engagement:
| Phase | Key Activities |
|---|---|
| Planning | Risk assessment procedures, understanding internal controls |
| Interim / Fieldwork | Tests of controls, substantive procedures |
| Completion | Subsequent events review, management representations, overall analytical review |
Sufficiency vs. Appropriateness of Evidence
Two critical dimensions define the quality of audit evidence:
Sufficiency (Quantity)
Sufficiency refers to the amount of evidence gathered. The auditor must obtain enough evidence to support the audit opinion. Factors that increase the required quantity include:
- Higher assessed risk of material misstatement
- Lower quality (appropriateness) of individual evidence items
- Greater materiality concerns for a specific account
Appropriateness (Quality)
Appropriateness addresses the relevance and reliability of the evidence. Even a large volume of low-quality evidence may be insufficient. Appropriateness has two components:
- Relevance — Does the evidence relate to the specific assertion being tested?
- Reliability — Can the auditor trust the evidence?
Sufficiency and appropriateness are interrelated. Obtaining more evidence does not compensate for evidence that is irrelevant or unreliable. Both dimensions must be satisfied.
Factors Affecting Reliability of Evidence
Not all evidence is equally trustworthy. The following factors influence how reliable a piece of evidence is:
| Factor | More Reliable | Less Reliable |
|---|---|---|
| Source | External (independent third party) | Internal (prepared by the client) |
| Form | Documentary / written | Oral / verbal |
| Internal controls | Obtained when controls are effective | Obtained when controls are weak |
| Direct knowledge | Obtained directly by the auditor | Obtained indirectly |
| Consistency | Corroborated by other evidence | Contradicted by other evidence |
| Original vs. copy | Original documents | Photocopies or faxes |
A bank confirmation received directly by the auditor from MAS Inc.'s bank is more reliable than a bank statement printed by the client's accounting staff, because it comes from an external source and is obtained directly by the auditor.
Relevance of Audit Evidence
Evidence is relevant when it pertains to the specific assertion being tested. Different procedures yield evidence relevant to different assertions.
If you are testing the existence assertion for accounts receivable at BIF Partners, confirming balances with customers is highly relevant. However, that same confirmation does not effectively test the completeness assertion—a balance that is missing from the books would never appear on a confirmation request.
Documentation Requirements
The auditor must document:
- The overall responses to assessed risks at the financial statement level
- The nature, timing, and extent of further audit procedures performed
- The linkage between procedures and the assessed risks at the assertion level
- The results of procedures performed and the audit evidence obtained
These workpapers serve as the principal support for the auditor's opinion and demonstrate that the audit was conducted in accordance with professional standards.
Standard Auditing Procedures — FIVE CARROT WARS
A helpful mnemonic for remembering the standard audit procedures is FIVE CARROT WARS. Each letter represents a procedure the auditor may employ:
| Letter | Procedure | Description |
|---|---|---|
| F | Footing / Cross-footing / Recalculation | Verifying the mathematical accuracy of documents, schedules, or records |
| I | Inquiry | Asking knowledgeable persons (inside or outside the entity) questions to obtain information |
| V | Vouching | Tracing amounts from the financial statements back to source documents to test existence/occurrence |
| E | Examination / Inspection | Physically examining tangible assets or reviewing documents and records |
| C | Confirmation | Obtaining a direct written response from a third party verifying information |
| A | Analytical procedures | Evaluating financial information by studying plausible relationships among data |
| R | Reperformance | Independently executing procedures or controls originally performed by the client |
| R | Reconciliation | Comparing two independent sets of records and investigating differences |
| O | Observation | Watching a process or procedure being performed by others |
| T | Tracing | Following transactions from source documents forward to the financial statements to test completeness |
| W | Walk-through | Following a single transaction through the entire process from initiation to recording |
| A | Auditing related accounts | Testing accounts related to the primary account under audit for consistency |
| R | Representation letter | Obtaining written assertions from management regarding the financial statements |
| S | Subsequent events review | Evaluating events occurring after the balance sheet date but before the audit report date |
The CPA exam frequently tests your ability to identify which procedure is most appropriate for a given scenario. Practice matching each procedure to the assertion it best addresses.
Detailed Procedure Examples
Confirmation — The auditor sends a letter to Kingfisher Industries' major customers asking them to verify their outstanding receivable balance directly with the audit firm.
Vouching — The auditor selects recorded revenue transactions from Illini Entertainment's general ledger and traces each one back to the shipping document, sales invoice, and customer purchase order.
Observation — During the year-end inventory count at MSA Records, the auditor watches warehouse staff scan and count physical inventory items.
Inquiry — The auditor interviews Illini Security's IT manager about access controls over the financial reporting system.
Reperformance — The auditor independently recalculates the depreciation expense for Gies Co.'s fixed asset schedule using the company's stated method and useful lives.
Walk-through — The auditor follows a single purchase order at BIF Partners from requisition through approval, receipt of goods, invoice matching, and payment to understand the procurement process.
Direction of Testing
The direction in which an auditor traces evidence determines which assertion is being tested. This concept is frequently tested on the CPA exam.
Vouching (Tests Existence / Occurrence)
Vouching moves from the financial statements back to the source documents.
Financial Statements → Journals → Source Documents
The auditor asks: "Is this recorded item real?"
The auditor selects 25 sales transactions from MAS Inc.'s sales journal and traces each one back to the corresponding shipping document and customer order. This tests whether recorded sales actually occurred (existence/occurrence assertion).
Tracing (Tests Completeness)
Tracing moves from source documents forward to the financial statements.
Source Documents → Journals → Financial Statements
The auditor asks: "Has this real event been recorded?"
The auditor selects 25 shipping documents from Kingfisher Industries' shipping dock log and traces each one forward to the sales journal and general ledger. This tests whether all shipments that occurred were properly recorded (completeness assertion).
Summary of Direction
| Direction | Starting Point | Ending Point | Assertion Tested |
|---|---|---|---|
| Vouching | Recorded amounts (ledgers) | Supporting documents | Existence / Occurrence |
| Tracing | Supporting documents | Recorded amounts (ledgers) | Completeness |
Do not confuse the direction. Students often mix up vouching and tracing. Remember: Vouching = Verify what's recorded is real (existence). Tracing = Track what's real to see if it's recorded (completeness).