Audit and Assurance · Assertions and audit evidence

Sufficient Appropriate Audit Evidence for ACCA AA

Updated 11 October 2026 · Fact-checked

Audit evidence is the information the auditor uses to reach conclusions for the opinion. It must be sufficient (enough in quantity) and appropriate (good in quality). Appropriateness has two parts: relevance to the assertion tested and reliability of the source. Weak quality cannot be fixed by collecting more of it.

Understand Sufficient Appropriate Audit Evidence

Audit evidence is all the information the auditor uses to support the audit opinion. It includes accounting records and other information, such as confirmations, inspection reports and management explanations. ISA 500 requires the auditor to design and perform procedures that obtain sufficient appropriate evidence.

Sufficiency is about quantity. It asks: have I tested enough? The amount needed rises with the assessed risk of material misstatement. It falls as the quality of the evidence rises. A larger sample or more items tested increases sufficiency.

Appropriateness is about quality. It has two parts. Relevance means the evidence relates to the assertion or objective you are testing. Reliability means you can trust the source and nature of the evidence. Evidence can be reliable but irrelevant. For example, a reliable bank confirmation proves existence of cash. It does not prove the cash is correctly classified.

Sufficiency and appropriateness are linked. Poor quality evidence needs more of it, but quantity cannot make up for poor quality. A hundred unreliable documents still prove little.

Auditors cannot be certain, so they work to reasonable assurance. They use judgement on whether evidence is enough. They also stay sceptical: if evidence from one source conflicts with another, or if its reliability is doubtful, they must do more work.

Key rules to remember

Sufficient appropriate evidence: Sufficient (quantity) + Appropriate (quality = relevance + reliability); Both are needed. Say both words in every answer.
Link to risk: Higher assessed risk → more evidence needed; better quality evidence → less needed; Quantity needed depends on risk and quality. Quality cannot be replaced by quantity.
Reliability of evidence: general guide: More reliable: external > internal; direct > indirect; documents > oral; originals > copies; internal evidence from strong controls > from weak controls; These are general guides, not absolute rules. Exceptions exist, for example an external document of doubtful origin.

How to solve Sufficient Appropriate Audit Evidence questions

Use this method for any question on sufficiency, appropriateness or reliability of evidence.

1Identify the assertion or balance being tested, because relevance depends on it.
2Identify the evidence given or the procedure proposed and where it comes from.
3Judge relevance: does it actually address the assertion, such as existence versus valuation?
4Judge reliability: source (external or internal), how obtained (directly or indirectly), form (document or oral), original or copy, and strength of the client's controls.
5Judge sufficiency: how much has been obtained, relative to the risk and materiality of the item.
6Conclude: say whether the evidence is sufficient, appropriate or both, and name the weakness.
7Recommend a better or additional procedure if needed, linking it to the weakness you named.

Quickest way: Source, Form, Control: a quick reliability check

When to use it: Use in Section A and OT case questions that ask which evidence is most reliable, and as a checklist for Section B written answers.

Ask who produced it: outside the client (more reliable) or inside it (less).
Ask how you got it: you obtained it directly (more reliable) or the client gave it to you (less).
Ask what form it takes: written document (more reliable) or oral statement (less); original (more) or photocopy or scan (less).
Ask whether the client's controls over it are strong. Strong controls make internal evidence more reliable.
Pick the option that scores best on most of these, then check it is relevant to the assertion.

Common mistakes in Sufficient Appropriate Audit Evidence

Using sufficient and appropriate as if they mean the same thing.
They are used together so often that they blur.
Fix: Sufficient is quantity. Appropriate is quality. Define each in one line in your answer.
Saying that more evidence can make up for unreliable evidence.
Students think the amount of evidence is what counts.
Fix: State that quantity cannot compensate for poor quality. The auditor needs better evidence, not just more.
Treating appropriateness as only reliability.
Reliability gets most of the attention in notes.
Fix: Appropriateness is relevance plus reliability. Always check the evidence matches the assertion being tested.
Stating reliability rules as always true, such as external evidence is always reliable.
The hierarchy is learned as a fixed list.
Fix: Treat the rules as general guides. Mention exceptions, such as external evidence from a source you cannot verify.
Listing procedures without saying why the evidence is weak or strong.
Students rush to recall procedures from memory.
Fix: Name the specific reliability factor, such as copy rather than original, then give your recommendation.
Ignoring the client's controls when judging internal evidence.
Controls feel like a separate topic.
Fix: Internal records produced under effective controls are more reliable. Where controls are weak, treat internal evidence with caution.

Worked examples

Example 1

During the audit of Kiran Co you obtain these items about the existence of receivables: (1) a customer's direct written reply to a confirmation request sent by you; (2) a photocopy of a sales invoice provided by the finance manager; (3) the sales director's verbal assurance that the customer will pay. Rank them from most to least reliable and explain.

Show the solution

Item 1: external source, obtained directly by the auditor, in writing. This scores highest on all three factors.
Item 2: the invoice is an internal document, supplied by the client, and it is a photocopy rather than an original. It is less reliable, though it is written.
Item 3: an oral statement from an internal source with an interest in the outcome. This is the least reliable.
Relevance: all three relate to receivables, but item 1 addresses existence directly.

Answer: Most reliable is the customer confirmation, then the photocopied invoice, then the verbal assurance. The confirmation is external, direct and written. The invoice is internal and a copy. The verbal assurance is oral and from an interested party.

Example 2

For Meera Ltd, the auditor tested 5 items from a population of 400 purchase invoices. All 5 were fine. The auditor assessed the risk of material misstatement as high. The auditor concluded the evidence was sufficient and appropriate. Comment on whether this conclusion is justified.

Show the solution

Define the test: sufficient means enough quantity, appropriate means relevant and reliable quality.
Sufficiency: 5 items out of 400 is a very small amount of testing. The risk is assessed as high, so the auditor needs more evidence, not less.
Appropriateness: the invoices are likely to be internal documents, though external in origin as supplier documents. We are not told they were checked to the goods received notes or supplier statements, so relevance to the assertion is not shown.
Nothing suggests the quality of the evidence is so high that it justifies a small sample.
Recommendation: increase the sample size, select items so they are representative, and add procedures such as agreeing to goods received notes and supplier statements.

Answer: The conclusion is not justified. The evidence is not sufficient because five items is too few for a high-risk area. Appropriateness is also unproven because relevance and reliability were not assessed. The auditor should extend testing and add corroborating procedures.

Exam tips

In written answers, always use both words: say whether evidence is sufficient and whether it is appropriate, and explain each.
For reliability questions, name the exact factor, such as external versus internal or original versus copy, rather than just saying it is more reliable.
In OT questions, check relevance to the assertion before choosing the most reliable source. The most reliable evidence may not address the assertion.
Link the amount of evidence to risk. Higher risk means more evidence. This earns marks in evaluation questions.
Treat reliability rules as general guides. Mention an exception if the scenario hints at one.

Sufficient Appropriate Audit Evidence in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Sufficient Appropriate Audit Evidence: frequently asked questions

What is the difference between sufficient and appropriate audit evidence?

Sufficient measures the quantity of evidence. Appropriate measures its quality, which is made up of relevance and reliability. The auditor needs both to support the opinion.

What makes audit evidence reliable?

Reliability depends on the source, how it was obtained, its form and the client's controls. Generally, external, direct, written and original evidence is more reliable. Internal evidence is more reliable when produced under effective controls.

Can more evidence make up for poor quality evidence?

No. The quantity needed depends on risk and on quality, but a large amount of unreliable evidence still does not give assurance. The auditor needs better evidence.

What does ISA 500 require?

ISA 500 requires the auditor to design and perform audit procedures that are appropriate in the circumstances to obtain sufficient appropriate audit evidence. It also requires the auditor to consider the relevance and reliability of the information used as evidence.