Audit evidence is necessary to support the auditor’s opinion and report. It is cumulative in nature and is primarily obtained from audit procedures performed during the course of the audit. It may, however, also include information obtained from other sources such as previous audits (provided the auditor has evaluated whether such information remains relevant and reliable as audit evidence for the current audit)[9] or through the information obtained by the firm in the acceptance or continuance of the client relationship or engagement. In addition, the entity’s accounting records and other sources internal to the entity are important sources of audit evidence. Information that may be used as audit evidence may have been prepared using the work of a management’s expert or be obtained from an external information source. Audit evidence comprises both information that supports and corroborates management’s assertions, and any information that contradicts such assertions. In addition, in some cases the absence of information (for example, management’s refusal to provide a requested representation) is used by the auditor, and therefore, also constitutes audit evidence.
Most of the auditor’s work in forming the auditor’s opinion consists of obtaining and evaluating audit evidence. Audit procedures to obtain audit evidence can include inspection, observation, confirmation, re‑calculation, re‑performance and analytical procedures, often in some combination, in addition to enquiry. Although enquiry may provide important audit evidence, and may even produce evidence of a misstatement, enquiry alone ordinarily does not provide sufficient audit evidence of the absence of a material misstatement at the assertion level, nor of the operating effectiveness of controls.
As explained in ASA 200,[10] reasonable assurance is obtained when the auditor has obtained sufficient appropriate audit evidence to reduce audit risk (that is, the risk that the auditor expresses an inappropriate opinion when the financial report is materially misstated) to an acceptably low level.
The sufficiency and appropriateness of audit evidence are interrelated. Sufficiency is the measure of the quantity of audit evidence. The quantity of audit evidence needed is affected by the auditor’s assessment of the risks of misstatement (the higher the assessed risks, the more audit evidence is likely to be required) and also by the quality of such audit evidence (the higher the quality, the less may be required). Obtaining more audit evidence, however, may not compensate for its poor quality.
Appropriateness is the measure of the quality of audit evidence; that is, its relevance and its reliability in providing support for the conclusions on which the auditor’s opinion is based. The reliability of evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.
ASA 330 requires the auditor to conclude whether sufficient appropriate audit evidence has been obtained.[11] Whether sufficient appropriate audit evidence has been obtained to reduce audit risk to an acceptably low level, and thereby enable the auditor to draw reasonable conclusions on which to base the auditor’s opinion, is a matter of professional judgement. ASA 200 contains discussion of such matters as the nature of audit procedures, the timeliness of financial reporting, and the balance between benefit and cost, which are relevant factors when the auditor exercises professional judgement regarding whether sufficient appropriate audit evidence has been obtained.
Sources of Audit Evidence
Some audit evidence is obtained by performing audit procedures to test the accounting records, for example, through analysis and review, reperforming procedures followed in the financial reporting process, and reconciling related types and applications of the same information. Through the performance of such audit procedures, the auditor may determine that the accounting records are internally consistent and agree to the financial report.
More assurance is ordinarily obtained from consistent audit evidence obtained from different sources or of a different nature than from items of audit evidence considered individually. For example, corroborating information obtained from a source independent of the entity may increase the assurance the auditor obtains from audit evidence that is generated internally, such as evidence existing within the accounting records, minutes of meetings, or a management representation.
Information from sources independent of the entity that the auditor may use as audit evidence may include confirmations from third parties and information from an external information source, including analysts’ reports, and comparable data about competitors (benchmarking data).
Audit Procedures for Obtaining Audit Evidence
As required by, and explained further in, ASA 315 and ASA 330, audit evidence to draw reasonable conclusions on which to base the auditor’s opinion is obtained by performing:
Risk assessment procedures; and
Further audit procedures, which comprise:
Tests of controls, when required by the Australian Auditing Standards or when the auditor has chosen to do so; and
Substantive procedures, including tests of details and substantive analytical procedures.
The audit procedures described in paragraphs A18‑A29 below may be used as risk assessment procedures, tests of controls or substantive procedures, depending on the context in which they are applied by the auditor. As explained in ASA 330, audit evidence obtained from previous audits may, in certain circumstances, provide appropriate audit evidence where the auditor performs audit procedures to establish its continuing relevance.[12]
The nature and timing of the audit procedures to be used may be affected by the fact that some of the accounting data and other information may be available only in electronic form or only at certain points or periods in time. For example, source documents, such as purchase orders and invoices, may exist only in electronic form when an entity uses electronic commerce, or may be discarded after scanning when an entity uses image processing systems to facilitate storage and reference.
Certain electronic information may not be retrievable after a specified period of time, for example, if files are changed and if backup files do not exist. Accordingly, the auditor may find it necessary as a result of an entity’s data retention policies to request retention of some information for the auditor’s review or to perform audit procedures at a time when the information is available.
Inspection
Inspection involves examining records or documents, whether internal or external, in paper form, electronic form, or other media, or a physical examination of an asset. Inspection of records and documents provides audit evidence of varying degrees of reliability, depending on their nature and source and, in the case of internal records and documents, on the effectiveness of the controls over their production. An example of inspection used as a test of controls is inspection of records for evidence of authorisation.
Some documents represent direct audit evidence of the existence of an asset, for example, a document constituting a financial instrument such as a share or bond. Inspection of such documents may not necessarily provide audit evidence about ownership or value. In addition, inspecting an executed contract may provide audit evidence relevant to the entity’s application of accounting policies, such as revenue recognition.
Inspection of tangible assets may provide reliable audit evidence with respect to their existence, but not necessarily about the entity’s rights and obligations or the valuation of the assets. Inspection of individual inventory items may accompany the observation of inventory counting.
Observation
Observation consists of looking at a process or procedure being performed by others, for example, the auditor’s observation of inventory counting by the entity’s personnel, or of the performance of controls. Observation provides audit evidence about the performance of a process or procedure, but is limited to the point in time at which the observation takes place, and by the fact that the act of being observed may affect how the process or procedure is performed. See ASA 501 for further guidance on observation of the counting of inventory.[13]
External Confirmation
An external confirmation represents audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium. External confirmation procedures frequently are relevant when addressing assertions associated with certain account balances and their elements. However, external confirmations need not be restricted to account balances only. For example, the auditor may request confirmation of the terms of agreements or transactions an entity has with third parties; the confirmation request may be designed to ask if any modifications have been made to the agreement and, if so, what the relevant details are. External confirmation procedures also are used to obtain audit evidence about the absence of certain conditions, for example, the absence of a “side agreement” that may influence revenue recognition. See ASA 505 for further guidance.[14]
Re‑calculation
Re‑calculation consists of checking the mathematical accuracy of documents or records. Re‑calculation may be performed manually or electronically.
Re‑performance
Re‑performance involves the auditor’s independent execution of procedures or controls that were originally performed as part of the entity’s internal control.
Analytical Procedures
Analytical procedures consist of evaluations of financial information through analysis of plausible relationships among both financial and non‑financial data. Analytical procedures also encompass such investigation as is necessary of identified fluctuations or relationships that are inconsistent with other relevant information or that differ from expected values by a significant amount. See ASA 520 for further guidance.
Enquiry
Enquiry consists of seeking information of knowledgeable persons, both financial and non‑financial, within the entity or outside the entity. Enquiry is used extensively throughout the audit in addition to other audit procedures. Enquiries may range from formal written enquiries to informal oral enquiries. Evaluating responses to enquiries is an integral part of the enquiry process.
Responses to enquiries may provide the auditor with information not previously possessed or with corroborative audit evidence. Alternatively, responses might provide information that differs significantly from other information that the auditor has obtained, for example, information regarding the possibility of management override of controls. In some cases, responses to enquiries provide a basis for the auditor to modify or perform additional audit procedures.
Although corroboration of evidence obtained through enquiry is often of particular importance, in the case of enquiries about management intent, the information available to support management’s intent may be limited. In these cases, understanding management’s past history of carrying out its stated intentions, management’s stated reasons for choosing a particular course of action, and management’s ability to pursue a specific course of action may provide relevant information to corroborate the evidence obtained through enquiry.
In respect of some matters, the auditor may consider it necessary to obtain written representations from management and, where appropriate, those charged with governance to confirm responses to oral enquiries. See ASA 580 for further guidance.[15]