Advanced Audit and Assurance (International) · Audit procedures and obtaining evidence

Audit Evidence and Sufficient Appropriate Evidence (ISA 500)

Updated 11 October 2026 · Fact-checked

Audit evidence is all the information the auditor uses to reach conclusions for the opinion. It must be sufficient (enough in quantity) and appropriate (relevant and reliable in quality). In the exam, name the source, judge its reliability, link it to the assertion and say what more is needed.

Understand Audit Evidence and Sufficient Appropriate Evidence (ISA 500)

Audit evidence is the information the auditor uses to reach the audit opinion. It includes the accounting records underlying the financial statements and other information, such as confirmations, inspection of assets, and management's explanations. Accounting records alone are not enough. You need other evidence to support them.

Evidence must be sufficient and appropriate. Sufficiency is about quantity. Appropriateness is about quality. Appropriateness has two parts: relevance (does it relate to the assertion being tested, and the right direction of test?) and reliability (can you trust it?). Higher risk of material misstatement means you need more evidence. Better quality evidence reduces the quantity needed, but a lot of poor evidence does not make up for poor quality.

Reliability depends on source and nature. Generally, evidence is more reliable when:

it comes from independent external sources rather than the entity
it is generated within an entity with effective internal controls
it is obtained directly by the auditor, not by inference or through management
it exists in documentary form, whether paper or electronic, rather than oral
it is an original document rather than a photocopy or fax

These are generalisations, not absolute rules. For example, an external document can be unreliable if the source lacks knowledge or is not independent. Evidence from different sources that agrees (corroboration) gives more comfort. If evidence from one source conflicts with another, or you doubt its reliability, you must find out what to do next and consider the effect on the audit.

The auditor also designs procedures to suit the purpose. Procedures include inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. Inquiry alone is not sufficient to test an assertion. When using information produced by the entity, you must evaluate whether it is accurate and complete enough for your purposes. Where management's expert is used, evaluate their competence and objectivity. Selecting items to test is a separate topic (ISA 530).

Key rules to remember

Sufficiency: Sufficiency = quantity of evidence; Affected by assessed risk of material misstatement (more risk, more evidence) and by quality (better quality, less needed).
Appropriateness: Appropriateness = relevance + reliability; Quality of evidence. Relevance links to the assertion tested. Reliability depends on source, nature and circumstances.
Reliability guide: External > internal; controls effective > weak; direct > indirect; documents > oral; original > copy; General guidance only. Always apply it to the facts in the scenario.
Audit procedures: Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, inquiry; Inquiry alone does not give sufficient evidence for an assertion.

How to solve Audit Evidence and Sufficient Appropriate Evidence (ISA 500) questions

Use this method for any question asking you to assess, compare or obtain audit evidence.

1Read the requirement. Decide whether it asks for procedures, an assessment of reliability, or a conclusion on sufficiency.
2Identify the assertion or balance being tested and the risk attached to it.
3For each piece of evidence, state the source (internal or external) and the nature (document, oral, observed).
4Judge reliability with a reason from the scenario, such as weak controls, a third party's independence or a copy document.
5Say whether it is relevant to the assertion. For example, existence testing starts from the item on the books to the asset, while completeness works the other way.
6Conclude on sufficiency: is there enough for the level of risk? Say what further evidence you would get and from whom.
7If evidence conflicts or is doubtful, say you would investigate, extend procedures and consider the effect on the opinion.

Quickest way: Source, nature, risk, next step

When to use it: Use when time is short and the question lists several pieces of evidence to rank or comment on.

Label each item: external or internal, document or oral.
Add one scenario-specific reason for or against reliability.
Match the item to the assertion it supports.
Finish with one extra procedure that fills the gap.

Common mistakes in Audit Evidence and Sufficient Appropriate Evidence (ISA 500)

Treating sufficiency and appropriateness as the same thing.
Both words sound like general approval of the evidence.
Fix: Sufficiency is quantity. Appropriateness is quality, made up of relevance and reliability. Name each separately.
Saying all external evidence is reliable.
Students memorise the hierarchy as a fixed rule.
Fix: Check whether the external source is independent, knowledgeable and has seen the right information. Apply the hierarchy as a guide only.
Relying on inquiry of management as the only procedure.
It is quick and easy to list.
Fix: Inquiry must be corroborated by other procedures. Pair it with inspection, recalculation or confirmation.
Offering a generic list of procedures with no link to the scenario.
Students recall a learned list and skip the application.
Fix: Name the specific balance, risk and assertion. Tailor each procedure to the facts given.
Ignoring the reliability of information produced by the entity.
Reports and spreadsheets look official.
Fix: Test the accuracy and completeness of entity-generated data before using it, for example system reports used in sampling or analytics.
Concluding that more evidence of weak quality solves a gap.
Students assume quantity can offset quality.
Fix: State that poor quality cannot be fixed by volume. Obtain better quality evidence, such as external or directly observed evidence.

Worked examples

Example 1

During the audit of receivables you obtain: (a) a customer statement sent by post to the auditor directly from the customer; (b) a photocopy of a sales invoice held by the client; (c) the credit controller's verbal statement that a debt will be paid. Rank them by reliability and explain.

Show the solution

Item (a): external, direct, documentary. It is the most reliable, because it comes from an independent third party straight to the auditor. It is relevant to existence of receivables.
Item (b): internal and a photocopy. It is less reliable than an original. Reliability also depends on the client's controls over sales invoicing. It supports occurrence and accuracy of sales but not that the customer owes the money.
Item (c): internal and oral. It is the least reliable, because the credit controller is not independent and the statement is unsupported. It relates to valuation, but needs corroboration.
Next step: for (c), inspect post-year-end cash receipts and review the customer's payment history and correspondence.

Answer: Ranking from most to least reliable: (a), then (b), then (c). (a) is external, direct and documentary. (b) is an internal copy. (c) is oral from management and needs corroboration with cash received after the year end.

Example 2

A client's inventory is high risk. The auditor attends the count, which is well controlled, but is told that the client's own spreadsheet of count results is complete. A colleague argues that because the auditor has seen many count sheets, evidence is sufficient. Respond.

Show the solution

Separate the two criteria. The attendance gives good quality evidence on existence because the auditor observed it directly and the count was well controlled.
Sufficiency depends on the risk. High risk means more evidence is needed, so the number of items observed and tested must be enough, not just the count of sheets seen.
The spreadsheet is produced by the entity. You must test its accuracy and completeness by agreeing a sample of count sheets to it and recalculating totals.
Other assertions need more evidence: valuation (cost and net realisable value) and rights and obligations (ownership and any goods held for third parties).
Conclude that the colleague is wrong: volume of count sheets does not show that evidence is appropriate for all assertions.

Answer: Evidence is not yet sufficient. Count attendance gives reliable evidence on existence, but the entity's spreadsheet must be tested for completeness and accuracy. Valuation and ownership require further procedures, and high risk requires more extensive testing.

Exam tips

Always give a scenario-based reason for reliability. A bare statement such as 'it is external' earns little.
Link each procedure to an assertion and a risk. Examiners reward targeted procedures over lists.
Show professional scepticism: question conflicting or inconsistent evidence and say what you would do next.
Use the professional skills marks by ranking evidence clearly and giving a reasoned conclusion, not just a list.
Remember that inquiry alone is not enough, and that information from the entity needs testing before use.

Practice questions from Audit procedures and obtaining evidence

Audit Evidence and Sufficient Appropriate Evidence (ISA 500) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Evidence and Sufficient Appropriate Evidence (ISA 500): frequently asked questions

What is the difference between sufficiency and appropriateness of audit evidence?

Sufficiency is the quantity of evidence. Appropriateness is the quality, made up of relevance and reliability. Both are needed. Large quantities of poor quality evidence will not meet the requirement.

How do I assess reliability of audit evidence in AAA?

Look at the source, nature and circumstances. External, direct, documentary and original evidence from an entity with effective controls is usually more reliable. Always apply this to the scenario and give a reason.

Is inquiry enough as audit evidence?

No. Inquiry alone does not provide sufficient appropriate evidence for an assertion. It should be corroborated with other procedures such as inspection, observation or confirmation.

What should I do if audit evidence is inconsistent or doubtful?

Determine what changes or additions to procedures are needed to resolve the matter. Consider the effect, if any, on other aspects of the audit. If you cannot get sufficient appropriate evidence, consider the effect on the audit opinion.