CA Final · Advanced Auditing, Assurance and Professional Ethics

Audit Evidence: formula sheet

Full chapter guide

Key formulas

Sufficiency: Sufficiency = quantity of audit evidence; Affected by the assessed risk of material misstatement and by the quality of the evidence.
Appropriateness: Appropriateness = relevance + reliability; It is the quality of evidence. Evidence must be both relevant and reliable to be appropriate.
Risk and quantity link: Higher assessed risk → more evidence needed; higher quality → less evidence needed; Quality does not fully replace quantity, and quantity cannot cure poor quality.
Reliability indicators: External > internal; effective controls > weak controls; direct > indirect; documentary > oral; original > copy; These are generalisations, not absolute rules. Circumstances can change the ranking.
Information from the entity: Test accuracy and completeness of information used as evidence; When using information produced by the entity, evaluate whether it is sufficiently reliable for the auditor's purposes.
Appropriateness of audit evidence: Appropriateness = Relevance + Reliability; It is a measure of the quality of evidence. Relevance means it bears on the assertion tested; reliability means it can be depended on.
Factors of reliability: Reliability depends on: source + nature + circumstances; Use these three words as headings in every answer.
Generalisation 1: external source: External sources (independent of the entity) are more reliable than internal sources; Holds when the external source is independent and knowledgeable. Not if it is a related party or lacks competence.
Generalisation 2: effective controls: Evidence generated internally is more reliable when the related controls, including those over its preparation and maintenance, are effective; If controls are weak, internal evidence loses reliability.
Generalisation 3: direct knowledge: Evidence obtained directly by the auditor is more reliable than evidence obtained indirectly or by inference; Example: observing a control is more reliable than inquiring about it.
Generalisation 4: documentary form: Evidence in documentary form (paper, electronic or other) is more reliable than evidence obtained orally; A written record made at the time of events is more reliable than later oral recollection.
Generalisation 5: originals: Original documents are more reliable than photocopies, facsimiles, or documents that are filmed, digitised or otherwise transformed into electronic form; The reliability of the transformed document may depend on the controls over its preparation and maintenance.
Information used as evidence: Information produced by the entity: test accuracy + completeness; evaluate whether precise and detailed enough for the purpose; Applies before you rely on a report to select a sample, run a test or form an expectation.
The seven procedures: Inspection, Observation, External confirmation, Recalculation, Reperformance, Analytical procedures, Inquiry; Remember as IO-ERRAI. Be ready to define each in one line.
Purposes of use: Risk assessment procedures | Tests of controls | Substantive procedures (tests of details + substantive analytical procedures); Procedures are chosen for the purpose; the same procedure can serve more than one.
Recalculation vs reperformance: Recalculation = checking arithmetic accuracy | Reperformance = independently executing a procedure or control the entity performed; Recalculation is about numbers. Reperformance is about a process or control.
Inquiry rule: Inquiry alone ordinarily does not give sufficient evidence of absence of material misstatement or of operating effectiveness of controls; Corroborate inquiry with other procedures.
Inspection of assets: Inspection of tangible asset gives reliable evidence of existence, but not necessarily rights and obligations or valuation; Link the procedure to the assertion it supports.
Management refuses to allow a confirmation request: Inquire reasons → seek audit evidence on validity → evaluate effect on risk assessment → perform alternative procedures; If the refusal is unreasonable, or alternative procedures cannot give relevant and reliable evidence, communicate with those charged with governance (SA 260) and consider the implications for the audit opinion under SA 705.
Design of a request: Assertions + Information to be confirmed + Form (positive/negative) + Prior experience + Confirming party's ability to respond; Also consider the client's name, the address, and the response method, and that replies come directly to the auditor.
Control over requests: Auditor selects, sends and receives directly; Management must not intercept or handle the request or the reply.
Negative confirmation use: Use alone only if ALL conditions are met; Risk of material misstatement is low; a large number of small homogeneous balances; a very low expected exception rate; no reason to believe recipients will disregard the requests.
Non-response: Perform alternative audit procedures to obtain relevant, reliable evidence; Where a positive confirmation is essential to sufficient appropriate evidence, alternative procedures will not provide it.
Evaluating results: Reliability + Non-responses + Exceptions → sufficient appropriate evidence?; Investigate exceptions to see whether they indicate a misstatement, including fraud.
Response necessary: Positive confirmation judged necessary + no reply ⇒ alternative procedures will not give the evidence ⇒ assess the implications for the audit and the opinion under SA 705; Decide this at planning. It depends on the risk and the evidence available from other sources.
Non-response (other cases): No reply to a positive request ⇒ perform alternative audit procedures for each non-response to get relevant and reliable evidence; Examples: for receivables, subsequent cash receipts and shipping documents. For payables, subsequent payments and goods received records.
Unreliable response: Doubt about reliability ⇒ obtain further audit evidence to resolve it ⇒ if unresolved, evaluate the effect on risk of material misstatement (including fraud risk) and on the nature, timing and extent of other procedures; Doubts arise over source, authority, mode of delivery or an oral reply.
Exception: Reply disagrees with the books ⇒ investigate whether it indicates a misstatement; The cause may be a timing difference, an error on either side, fraud or a control deficiency.
Management refusal: Inquire into reasons ⇒ evaluate risk implications ⇒ perform alternative procedures; If the refusal is unreasonable, or alternative procedures give no sufficient evidence, communicate with those charged with governance and assess the effect under SA 705.
Negative confirmation use: Use alone only if ALL hold: risk of material misstatement assessed as low and evidence on operating effectiveness of controls obtained; many small homogeneous items; very low expected exception rate; no reason to think recipients will ignore the request; Even then it is weak evidence. Use it with other procedures, not as the only source for a significant assertion.

Quick revision

Audit evidence includes information in accounting records and other information, such as from external sources.
Sufficiency measures the quantity of evidence; appropriateness measures its quality.
Appropriateness has two parts: relevance and reliability.
A higher risk of misstatement means more evidence is needed; better quality evidence can reduce the quantity needed, but not remove the need for quality.
Evidence from independent external sources is generally more reliable than evidence from within the entity.
Evidence obtained directly by the auditor is more reliable than evidence obtained indirectly or by inference.
Documentary evidence in original form is more reliable than photocopies or scanned copies.
Inquiry alone is not enough to support an assertion or the operating effectiveness of controls.
The procedures are inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry.
Under SA 505, the auditor controls the confirmation request, its sending and the receipt of the response.
If management refuses to allow a confirmation, the auditor asks why, seeks evidence on whether the reasons are valid, and considers the effect on the audit.
Treat a non-response to a positive confirmation as a prompt for alternative procedures, and treat an exception as something to investigate.

Common mistakes

Treating sufficiency and appropriateness as the same thing. Fix: Remember: sufficiency is quantity, appropriateness is quality (relevance and reliability).
Saying more evidence can make up for poor quality evidence. Fix: State that quantity needed depends on risk and quality, but a large quantity of unreliable evidence does not become appropriate.
Writing that external evidence is always more reliable. Fix: Say 'generally more reliable, if independent and competent'. Check the case for related parties or doubtful competence.
Treating a system-generated report as reliable because it comes from software. Fix: State that you must test the accuracy and completeness of the report logic and data, and evaluate whether it is detailed enough for the purpose.
Using recalculation and reperformance as the same thing. Fix: Recalculation checks arithmetic accuracy. Reperformance means independently executing a procedure or control, such as redoing a bank reconciliation process.
Treating inspection and observation as the same. Fix: Inspection examines records, documents or assets. Observation watches a process being carried out by others, at a point in time.
Allowing management to send the requests or collect the replies. Fix: Write that the auditor must keep control. Replies must come directly to the auditor, or reliability is lost.
Using negative confirmations as the only evidence for high-risk balances. Fix: Learn the conditions for sole use of negatives and say that negatives give less reliable evidence than positives.
Saying alternative procedures are always enough when a positive confirmation is not received. Fix: Ask first whether the reply was necessary. If yes, alternative procedures will not give the evidence, so assess the effect on the opinion under SA 705.
Accepting management's refusal without further work. Fix: Inquire into the reasons, test their validity, assess fraud and other risk implications, then perform alternative procedures. Go to those charged with governance if the refusal is unreasonable.

Exam tips

Write the definition of sufficiency and appropriateness in one line each at the start of the answer.
Always mention both relevance and reliability when asked about appropriateness.
In case scenarios, name the assertion before judging the evidence.
Qualify reliability indicators with 'generally' and note that circumstances matter.
Close with the effect on the opinion when the evidence is lacking.
In case-scenario MCQs, look for the one fact that removes a generalisation's condition, such as a related-party confirmation or a weak control environment.
In written answers, use the headings Source, Nature, Circumstances. Then give accuracy and completeness if entity-produced information is used.
Write 'generally' or 'is more reliable if...' when stating generalisations. Never write 'always'.