Types and Reliability of Audit Evidence

What counts as proof?

An auditor’s conclusion is only as good as the proof behind it. “The IT manager told me it’s fine” isn’t proof. “I pulled the data myself and checked every case” is.

ITAF says evidence must be sufficient and appropriate. That sounds dry, but it boils down to three simple questions.

• Sufficient: is there enough? How much depends on risk and materiality. Bigger risk, more evidence.
• Relevant: does it answer the question? Evidence that a control is well designed doesn’t prove it worked all year.
• Reliable: can it be trusted? That depends on where it came from, how it was obtained, and its form.

The two are linked: very reliable evidence means you need less of it. But piling up weak evidence never makes it strong.

Ranking evidence

The exam often lists four pieces of evidence and asks which is most reliable. Use these rules:

More reliable	Less reliable
From an independent outside source	From inside the auditee
Obtained directly by the auditor	Handed over by the auditee
Written or system-generated	Spoken
Original documents	Copies, printouts, scans
Produced where controls are strong	Produced where controls are weak
From someone qualified and independent	From someone with a stake in the result
Covers the whole period	A single moment

Example. To check that leavers lost their system access, the auditor could (a) ask the IT manager, (b) read IT’s own monthly reconciliation report, or (c) extract the HR leavers list and the active user list and match them personally. Option (c) is the most reliable: obtained directly, from the system, covering everyone.

Ways to gather evidence

Technique	Good for	Watch out for
Inquiry (interviews, questionnaires)	Understanding how things work	Must be backed up by other evidence
Observation	Seeing a process or physical control in action	Only proves what happened while you watched
Inspection	Approvals, settings, logs, equipment	Documents can be incomplete or altered
Confirmation	Balances, contracts, facts held by outsiders	Depends on getting a reply
Re-performance	Proving a control or calculation actually works	Can take time without automation
Analytical procedures	Spotting odd trends	Points where to look; doesn’t prove a specific error
Data analytics (CAATs)	Testing every transaction	Data must be complete and accurate first

Electronic evidence

Most IS audit evidence is electronic. Two cautions:

• It can disappear. Logs are often kept only for days or weeks before being overwritten. Ask for them early.
• Check it’s complete. Before analysing extracted data, reconcile record counts and totals to the source system, and confirm the extract covers the whole period.

Work papers

Work papers record what was planned, what was done, what evidence was found and what was concluded. They:

• support every finding in the report
• show the work was supervised and met the standards
• belong to the audit function, are kept as long as policy and law require, and are protected from unauthorised access or changes

How the exam asks about it

If the question asks…	The answer is usually…
The most reliable evidence	Independent outside confirmation, or evidence the auditor obtained directly
A manager’s verbal assurance	Weak on its own; corroborate it
The auditee provides a printout of user access	Less reliable than the auditor extracting the data
Evidence that a control worked throughout the year	Testing a sample across the period, not one observation
The auditor can’t get sufficient evidence	It’s a scope limitation; report it

In short

• Evidence must be sufficient (enough of it) and appropriate (relevant to the question and reliable).
• Evidence from an independent outside source beats evidence from inside the auditee.
• Evidence the auditor gets directly (observing, re-performing, extracting data) beats evidence handed over by the auditee.
• Written or system-generated evidence beats what people say; spoken answers need backing up.
• Evidence produced where controls are strong is more reliable than where they're weak.
• Before analysing system data, check it's complete: record counts and totals should match the source.
• Work papers record the evidence and link it to the conclusions; they're retained and protected.

Exam traps

• A management representation letter is evidence, but weak. It never replaces testing.
• A printout given by the auditee is less reliable than data the auditor extracts directly.
• More of a weak kind of evidence doesn't make it strong.
• Interviewing staff alone never proves a control works.
• Logs and electronic records may be overwritten; request them early.

Slides

Click the slide and use the arrow keys. F toggles full screen.