Audit Evidence: Sufficient and Appropriate

The auditor must get sufficient appropriate audit evidence to reduce audit risk to an acceptably low level. Every opinion rests on that requirement. The standards are AU-C 500 (private companies), ISA 500 and CAS 500, and AS 1105 for public companies.

Sufficient and appropriate

• Sufficient is about quantity. More risk means you need more evidence. Better evidence means you may need less of it.
• Appropriate is about quality, and has two parts:
  • Relevance: does the evidence address the assertion you are testing? Vouching recorded sales to invoices is relevant to occurrence, and tells you nothing about completeness. See vouching vs tracing.
  • Reliability: can you trust it?

Lots of weak evidence does not make up for poor quality. Fifty emails from the client's sales team do not replace one confirmation from the customer.

Judging reliability

The standards give general rules, each with exceptions:

More reliable	Less reliable
From an independent source outside the entity	Produced by the entity
Obtained directly by the auditor (recalculation, observation)	Obtained indirectly or by inquiry
Documentary, on paper or electronic	Oral
Original documents	Copies, scans, or documents converted from another format
Produced by the entity when its controls are effective	Produced by the entity when controls are weak

Information produced by the entity

Much of the evidence in an audit is a report from the client's system: an AR aging, a GL detail, a list of fixed asset additions. Before you rely on one, check that it is:

• Complete: it includes everything it should. Agree its total to the GL or trial balance.
• Accurate: its details are right. Test a few items back to source documents, or rely on tested controls over the report.

If you sample from an incomplete listing, your sample can never find what is missing.

When evidence conflicts

If two pieces of evidence disagree, or you doubt a document is genuine, do more work before relying on either. Investigate the difference, get corroboration from another source, and consider whether it points to fraud.

Evidence produced with AI tools

The same rules apply to evidence and working papers produced with AI. An inspector looks at whether the documentation shows what was compared, against which source, and why the conclusion follows. Evidence an AI tool extracted from a document is as reliable as the link back to that document. See our guide to audit working papers.

Where Warp Accounting fits

Warp Accounting links every result to the page in the source document it came from, with the fields compared and the reasoning shown, so a reviewer can check the evidence behind each conclusion. See AI audit workpapers and our guide to audit procedures.