Audit evidence

Audit evidence is the information the auditor uses to reach the conclusions on which the opinion rests. ISA 500 asks for evidence that is sufficient (enough of it) and appropriate (good enough). Appropriateness has two parts:

• Relevance — does the evidence address the assertion being tested? Confirming a receivable with the customer is relevant to existence, but says little about valuation (a customer can agree it owes 50,000 and still be unable to pay). Direction matters too: vouching from the ledger tests existence; tracing into it tests completeness.
• Reliability — can the evidence be trusted? ISA 500's generalisations (each with exceptions) are that evidence is more reliable when it comes from independent external sources; when internally generated evidence comes from a system with effective controls; when it is obtained directly by the auditor rather than indirectly or by inference; when it is documentary rather than oral; and when it is an original rather than a copy or scan.

Sufficiency and appropriateness interact: higher-quality evidence means less may be needed, but more evidence doesn't make up for poor quality. Ten photocopies of an unreliable document are still unreliable.

Evidence comes from seven kinds of procedure: inspection (of records or assets), observation (watching a process), external confirmation (a written reply from a third party direct to the auditor, ISA 505), recalculation, reperformance, analytical procedures (ISA 520) and inquiry. Inquiry is used throughout the audit, but on its own it rarely provides sufficient appropriate evidence.

When the auditor uses information produced by the entity — an aged receivables report, an inventory listing — ISA 500 requires evidence about its accuracy and completeness, and that it is precise and detailed enough for the purpose. A beautifully tested provision based on a wrong aging report is worthless.

If evidence from one source is inconsistent with another, or the auditor doubts its reliability, ISA 500.11 requires the auditor to decide what further procedures are needed and to consider the effect on the rest of the audit. That's professional scepticism at work.