Audit procedures and obtaining evidence: formula sheet

Key formulas

Sufficiency

Sufficiency = quantity of evidence

Affected by assessed risk of material misstatement (more risk, more evidence) and by quality (better quality, less needed).

Appropriateness

Appropriateness = relevance + reliability

Quality of evidence. Relevance links to the assertion tested. Reliability depends on source, nature and circumstances.

Reliability guide

External > internal; controls effective > weak; direct > indirect; documents > oral; original > copy

General guidance only. Always apply it to the facts in the scenario.

Audit procedures

Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, inquiry

Inquiry alone does not give sufficient evidence for an assertion.

Procedure types (ISA 500)

Inspection | Observation | External confirmation | Recalculation | Reperformance | Analytical procedures | Inquiry

Inquiry alone is not sufficient to test a control or to support a material balance; combine it with other procedures.

Direction of testing

Overstatement of assets or income (existence, occurrence): start with the recorded item → agree to source document or physical item. Understatement (completeness): start with an independent source → trace to the ledger.

The source for completeness must be independent of the ledger. For liabilities the main risk is understatement, so completeness of liabilities is the key test: start from independent sources such as supplier statements and post-year-end payments. Choosing the wrong starting point is the most common reason a procedure fails to address the assertion.

Tests of controls versus substantive procedures

Controls: did the control operate? Substantive: is the figure or disclosure materially misstated?

Tests of controls are required when you rely on controls or when substantive procedures alone cannot give sufficient appropriate evidence.

Writing a procedure

Action verb + document or item + sample or source + purpose (assertion)

Use this pattern to make each procedure specific and markable.

Gross profit margin

Gross profit ÷ Revenue × 100

Unexpected change suggests pricing, cost, cut-off or inventory problems.

Operating profit margin

Operating profit ÷ Revenue × 100

Use to spot unusual expense movements.

Receivables days

Trade receivables ÷ Credit revenue × 365

Longer days may indicate irrecoverable debts, or revenue cut-off or fictitious sales.

Payables days

Trade payables ÷ Cost of sales (or credit purchases) × 365

Longer days may suggest cash flow problems or unrecorded liabilities; shorter days may suggest early settlement or purchases cut-off errors.

Inventory days

Inventory ÷ Cost of sales × 365

Longer days may indicate obsolete inventory needing write-down.

Current ratio

Current assets ÷ Current liabilities

Relevant to going concern and classification.

Gearing

Debt ÷ Equity (or Debt ÷ (Debt + Equity))

State which version you use. Link to covenants and going concern.

Interest cover

Profit before interest and tax ÷ Finance costs

Low cover signals going concern risk.

Expectation test (ISA 520)

Expected value vs recorded value; investigate if difference > threshold

Before you start, set the acceptable difference having regard to materiality and tolerable misstatement, and the level of assurance you need. The threshold should be below tolerable misstatement. Investigate anything above it.

Positive vs negative confirmation

Positive = reply needed in all cases; Negative = reply only if the recipient disagrees

Positive gives stronger evidence. Negative is suitable only in limited low-risk circumstances where many small balances exist.

Control of the confirmation

Auditor selects items + sends request + receives reply directly

If the reply goes via the client, reliability falls sharply.

Count testing directions

Floor to sheets = completeness; Sheets to floor = existence

State both directions in any inventory count answer.

Count date not at year end

Year-end inventory = count-date inventory + receipts − issues in the roll-forward period

The auditor tests the movements between the count date and the year end.

Non-response or impracticable attendance

Alternative procedures; if still insufficient, modify the opinion

Opinion modification depends on materiality and pervasiveness (ISA 705).

ISA 540 risk factors

Estimation uncertainty + complexity + subjectivity (and bias) → inherent risk

Assess inherent risk and control risk separately. Higher inherent risk calls for more persuasive evidence.

Three response approaches

Test management's process | Develop auditor's point estimate or range | Use events up to the auditor's report date

You can combine them. Choose based on risk, available data and timing.

What to test in management's process

Method + significant assumptions + data

Check suitability and consistency of the method, reasonableness of assumptions, and relevance and reliability of data.

IFRS 13 hierarchy

Level 1: quoted prices | Level 2: observable inputs | Level 3: unobservable inputs

Level 3 has the greatest estimation uncertainty and needs the strongest evidence.

Related party audit cycle

Identify → assess risk → obtain evidence → evaluate disclosure → obtain representations

Remain alert for undisclosed related parties throughout the audit.

Bias evaluation

Indicators of management bias in estimates = possible misstatement; consider the effect on the financial statements as a whole

Bias is not always a misstatement in itself, but you must evaluate it, including its effect on audit risk.

Expert evaluation (ISA 620)

Reliance = competence + capabilities + objectivity + agreed scope + adequate work

Assess these before relying. Then evaluate whether the expert's findings, assumptions and source data are appropriate.

Auditor's responsibility

Opinion responsibility = auditor only

Using an expert never reduces your responsibility. Do not refer to the auditor's expert in an unmodified report unless law or regulation requires it.

Management's expert

Evaluate competence, capabilities, objectivity, understand their work, then evaluate appropriateness as evidence

Engaged by the client, so objectivity may be threatened.

Mandatory representations (ISA 580)

Responsibility for preparing the financial statements in accordance with the framework (including a fair presentation where relevant) + responsibility for providing all relevant information and access and for recording all transactions

If concerns about management's integrity make representations unreliable, determine the effect on the reliability of representations in general and on other evidence, and disclaim where required. Date the letter as near as practicable to, but not after, the date of the auditor's report.

Representations as evidence

Written representations ≠ sufficient appropriate evidence on their own

They corroborate other evidence and never replace it.

Documentation test (ISA 230)

File must let an experienced auditor with no prior connection understand the work

Cover the work done, who did and reviewed it, evidence, results and significant judgements.

Final file assembly

Assemble on a timely basis after the date of the auditor's report; the time limit is set by firm policy

ISA 230 sets no fixed day limit. Firm policy under ISQM 1 sets it, and 60 days is commonly used. After assembly, do not delete documentation before the end of its retention period.

Evidence quality rule

Evidence from a tool = relevant + reliable data + properly performed procedure + investigated exceptions

ISA 500 still applies. The auditor must test that the data fed into the tool is complete and accurate.

Test data logic

Expected result (prepared in advance) vs actual system result

Differences show control or processing weaknesses. Test data must be removed from live records afterwards.

Population coverage

Analytics can test 100% of items; sampling tests a selected subset

Full coverage reduces sampling risk but does not remove other audit risk.

Quick revision

• Sufficiency is the quantity of evidence. Appropriateness is its relevance and reliability.
• Evidence from external, independent sources is generally more reliable than internal evidence.
• Evidence obtained directly by the auditor is more reliable than evidence obtained indirectly or by inference.
• Original documents are more reliable than photocopies or scanned copies.
• Match every procedure to an assertion, such as existence, completeness, valuation or cut-off.
• Analytical procedures are required at risk assessment and the overall review. They can also be used as substantive procedures.
• With analytical procedures, compare to an expectation, define a threshold, and investigate significant differences.
• Sampling gives a conclusion about a population from part of it. Sampling risk and non-sampling risk both matter.
• Test inventory by observing the count, testing count procedures, and checking cut-off and valuation.
• For estimates, consider management bias, test the method and assumptions, and check subsequent events.
• For related parties, stay alert for undisclosed ones and for transactions not at arm's length.
• Using an expert does not remove the auditor's responsibility for the opinion. Evaluate their competence, capability and objectivity.
• Written representations support other evidence but cannot replace it.
• Data analytics can test whole populations, but the auditor must still assess data reliability and follow up exceptions.

Common mistakes

• Treating sufficiency and appropriateness as the same thing. Fix: Sufficiency is quantity. Appropriateness is quality, made up of relevance and reliability. Name each separately.
• Saying all external evidence is reliable. Fix: Check whether the external source is independent, knowledgeable and has seen the right information. Apply the hierarchy as a guide only.
• Writing vague procedures such as 'check the sales' or 'review the file'. Fix: Name the document, the sample and the purpose, for example 'Agree a sample of receivables balances to year-end confirmations received directly from customers'.
• Testing in the wrong direction, such as tracing ledger to invoice to test completeness. Fix: For completeness start from an independent source, like goods received notes or supplier statements, and trace to the ledger. For existence or occurrence start with the recorded item in the ledger and go to the item or document. For liabilities, remember the main risk is understatement, so completeness is usually the key assertion.
• Only calculating ratios and not interpreting them. Fix: For each ratio, state the change, the possible cause, the risk and the response. Interpretation earns the marks.
• Accepting management's explanation for a fluctuation. Fix: Treat explanations as claims. Corroborate them with independent evidence such as contracts, correspondence or post year-end events.
• Saying a receivables confirmation proves the balance is recoverable. Fix: Say confirmations mainly support existence and rights. Test valuation through after-date receipts, ageing review and credit control information.
• Letting the client post or collect the confirmation requests. Fix: State that the auditor sends the requests and receives replies directly, to protect reliability.
• Listing generic audit procedures that could apply to any balance. Fix: Anchor each procedure to a specific risk from the scenario, such as an unobservable input or a director's loan on unusual terms.
• Only reperforming management's calculation for an estimate. Fix: Recalculation checks arithmetic only. Also challenge the assumptions and test the data, and compare with actual outcomes and subsequent events.

Exam tips

• Always give a scenario-based reason for reliability. A bare statement such as 'it is external' earns little.
• Link each procedure to an assertion and a risk. Examiners reward targeted procedures over lists.
• Show professional scepticism: question conflicting or inconsistent evidence and say what you would do next.
• Use the professional skills marks by ranking evidence clearly and giving a reasoned conclusion, not just a list.
• Remember that inquiry alone is not enough, and that information from the entity needs testing before use.
• Always state the assertion at risk. AAA markers look for the link between procedure and assertion.
• Use the scenario. Mention the named entity, the date, the system or the amount in your procedures.
• Write each procedure on its own line, starting with an action verb, so it is easy to credit and quick to write.