ACCA Strategic Professional · Advanced Audit and Assurance (International)

Audit Procedures and Obtaining Evidence for ACCA AAA

Audit procedures and obtaining evidence is the process of designing and performing tests that give the auditor sufficient appropriate evidence to support an opinion. To answer exam questions, link each procedure to a specific risk and assertion in the scenario, explain why it gives reliable evidence, and state what it would show.

What this chapter covers

This chapter covers how auditors gather the evidence behind their opinion. It starts with the idea of sufficient appropriate evidence under ISA 500. It then moves through assertions, analytical procedures, sampling, and specific evidence such as confirmations and inventory counts. Later topics cover estimates, fair values, related parties, experts, representations and data analytics.

In the AAA exam, this chapter is rarely tested as pure theory. Questions give you a client scenario and ask what procedures you would perform, what evidence you need, or what is wrong with the evidence obtained. You must tailor your answer to the facts. Generic lists of procedures score poorly.

The chapter connects to the rest of the paper in two ways. It follows risk assessment, because procedures respond to the risks you have identified. It feeds into completion and reporting, because the evidence you gather decides whether misstatements are material and what opinion you give. It also links to quality management, ethics and group audits, where evidence from others must be evaluated.

Evidence questions can appear in Section A, the 50-mark case study, and in Section B. Each question carries professional skills marks as well as technical marks, and evidence-based requirements are a natural place to show scepticism, analysis and commercial awareness. The skills here also support almost every other audit topic. If you can match a risk to an assertion and then to a precise, reliable procedure, you can score across many requirements, not just this chapter.

Audit procedures and obtaining evidence: topics in the order to study them

1Audit Evidence and Sufficient Appropriate Evidence (ISA 500)It sets the core ideas of sufficiency, appropriateness and reliability that every later topic builds on.
2Audit Procedures and AssertionsYou need the link between assertions and procedure types before you can design tests for any balance or transaction.
3Analytical Procedures (ISA 520)These are used at risk assessment and at the final review, and are tested often with scenario figures.
4Audit Sampling (ISA 530)It shows how tests of controls and details are applied to populations, so it follows the procedures themselves.
5External Confirmations, Inventory Counts and Specific EvidenceThis applies the general ideas to the common balances examiners like to test, such as receivables and inventory.
6Auditing Estimates, Fair Values and Related Parties (ISA 540, 550)These are higher-risk areas that need the earlier foundations plus scepticism about management bias.
7Using Experts, Management Representations and DocumentationIt covers evidence from other sources and the limits of relying on them, which makes most sense after the specific areas.
8Automated Tools, Data Analytics and Computer-Assisted Audit TechniquesStudy it last, so you can place technology as a way of performing procedures you already understand.

How to prepare Audit procedures and obtaining evidence

Treat this chapter as a skill to practise, not a set of notes to memorise. The exam rewards tailored, reasoned answers.

Learn the key terms in ISA 500 in your own words: sufficient, appropriate, relevant, reliable. Be ready to say which source of evidence is more reliable and why.
Build a one-page map linking each assertion to typical procedures for classes of transactions, account balances and presentation.
Practise analytical procedures with real figures. Calculate the ratio or trend, state what you expected, identify what looks unusual and suggest what to investigate.
For each topic, write procedures in the form: what you do, what you look at, and what it proves. Avoid vague verbs like check or review.
Attempt past exam requirements under timed conditions. Read the scenario for risk clues, then tie every procedure to a named fact.
Review your answers for professional skills. Look for scepticism, a clear structure and a judgement, not only a list.
In the last week, redo weak questions and rehearse short answers on estimates, related parties, experts and data analytics.

Common mistakes in Audit procedures and obtaining evidence

Listing generic procedures that ignore the scenario.
Fix: Quote a fact from the scenario in each procedure and explain the risk it addresses.
Not stating what a procedure is meant to prove.
Fix: Finish each point with the assertion or risk it addresses, for example existence of inventory.
Treating analytical procedures as only calculating ratios.
Fix: After each ratio, give a reason for the change, a possible misstatement and a follow-up procedure.
Confusing sampling risk with other kinds of risk, or mixing tests of controls with tests of details.
Fix: Define each term briefly and state what error or deviation you are looking for in each test.
Accepting management's explanations or an expert's work without challenge.
Fix: Say what corroborating evidence you would seek and how you would assess the expert's competence and objectivity.
Presenting data analytics as a cure-all.
Fix: Cover both the benefits and the limits, such as data integrity, setup cost, false positives and the need for follow-up.

Last-day revision: Audit procedures and obtaining evidence

Sufficiency is the quantity of evidence. Appropriateness is its relevance and reliability.
Evidence from external, independent sources is generally more reliable than internal evidence.
Evidence obtained directly by the auditor is more reliable than evidence obtained indirectly or by inference.
Original documents are more reliable than photocopies or scanned copies.
Match every procedure to an assertion, such as existence, completeness, valuation or cut-off.
Analytical procedures are required at risk assessment and the overall review. They can also be used as substantive procedures.
With analytical procedures, compare to an expectation, define a threshold, and investigate significant differences.
Sampling gives a conclusion about a population from part of it. Sampling risk and non-sampling risk both matter.
Test inventory by observing the count, testing count procedures, and checking cut-off and valuation.
For estimates, consider management bias, test the method and assumptions, and check subsequent events.
For related parties, stay alert for undisclosed ones and for transactions not at arm's length.
Using an expert does not remove the auditor's responsibility for the opinion. Evaluate their competence, capability and objectivity.
Written representations support other evidence but cannot replace it.
Data analytics can test whole populations, but the auditor must still assess data reliability and follow up exceptions.

Audit procedures and obtaining evidence practice questions

Audit procedures and obtaining evidence in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit procedures and obtaining evidence: frequently asked questions

What is sufficient appropriate audit evidence?

Sufficient refers to the quantity of evidence, and appropriate refers to its quality, meaning its relevance and reliability. You need both to support an opinion. Higher assessed risk calls for more and better evidence.

How should I answer a question asking for audit procedures?

Read the scenario for the risk, then give specific procedures that respond to it. For each one, say what you do and what it shows. Avoid long lists of unlinked steps.

Are analytical procedures tested with calculations in AAA?

Often yes, using figures in the scenario. Marks usually come from interpreting the results and suggesting follow-up work, not from the arithmetic alone. Always explain what the numbers suggest.

How much should I know about data analytics?

Know what it can do, such as testing full populations and finding unusual items, and what its limits are. Be able to apply it to a given client. Questions usually ask for benefits, risks and how you would use it in the audit.