Advanced Audit and Assurance (International) · Evidence and testing considerations

Audit Evidence: Sufficiency and Appropriateness under ISA 500

Updated 11 October 2026 · Fact-checked

Audit evidence is the information the auditor uses to reach conclusions for the opinion. Sufficiency is the quantity of evidence. Appropriateness is its quality: relevance and reliability. To solve a question, link each procedure to the risk and assertion, then judge both quantity and quality, and say what more is needed.

Understand Audit Evidence: Sufficiency and Appropriateness (ISA 500)

Audit evidence is all the information the auditor uses to support the audit opinion. It includes accounting records and other information, such as confirmations, minutes, and the results of procedures. The auditor must obtain enough of the right evidence to reduce audit risk to an acceptably low level.

Two words matter. Sufficiency is about quantity. Appropriateness is about quality, and it has two parts: relevance (does it relate to the assertion being tested?) and reliability (can you trust the source and form?). The two are linked. Better quality evidence means you may need less of it. But a large amount of poor evidence never makes up for poor quality.

The amount needed rises with the assessed risk of material misstatement. Higher risk means more evidence, and more reliable evidence. Reliability depends on circumstances, so these are general guides, not absolute rules. Evidence is generally more reliable when it comes from independent external sources, when it is obtained directly by the auditor, when it is in documentary form, when it is an original rather than a photocopy or scan, and when the entity's related internal controls are effective.

The auditor gets evidence by performing audit procedures: inspection (of records, documents or tangible assets), observation (watching a process, such as an inventory count), external confirmation, recalculation, reperformance, analytical procedures and inquiry. Inquiry alone is not enough to support an assertion. It needs corroboration. Procedures are used for risk assessment, tests of controls and substantive procedures.

If information from the entity is used as evidence, the auditor must consider its accuracy and completeness. If evidence from one source is inconsistent with another, or doubts arise over reliability, the auditor must find out what changes to procedures are needed and consider the effect on other parts of the audit. Where management's expert was used, the auditor also evaluates that expert's competence, capabilities and objectivity.

Key rules to remember

Sufficiency: Sufficiency = quantity of audit evidence; Affected by assessed risk of material misstatement and by the quality of the evidence. Higher risk needs more.
Appropriateness: Appropriateness = relevance + reliability; Quality of evidence. Both parts are needed to support an assertion.
Reliability guides: External > internal (with good controls) > internal (weak controls); direct > indirect; documentary > oral; original > copy; General guides only. Always judge in the circumstances of the scenario.
Audit procedures: Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, inquiry; Inquiry alone is not sufficient. It must be corroborated.
Evidence and risk: Higher risk of material misstatement → more and better evidence; Link every procedure to a risk and an assertion.

How to solve Audit Evidence: Sufficiency and Appropriateness (ISA 500) questions

Use this method for any question that asks you to assess, obtain or evaluate audit evidence.

1Read the requirement. Decide whether it asks for procedures, an evaluation of evidence, or both.
2Identify the assertion or balance at risk, and the risk level given in the scenario.
3For each piece of evidence, state its source: external or internal, direct or indirect, documentary or oral, original or copy.
4Judge reliability using the hierarchy, then relevance to the assertion. Say clearly if it is relevant but weak, or reliable but irrelevant.
5Conclude on sufficiency. Consider risk, the amount tested and whether the evidence is consistent across sources.
6Recommend further procedures, named precisely, such as confirm directly with the bank or inspect the original agreement.
7State the effect on the audit, such as extending testing, or a possible limitation on scope if evidence cannot be obtained.

Quickest way: Source, form, risk

When to use it: Use this when you have a few minutes and must judge evidence or suggest procedures.

Source: who produced it, and is it independent of the client?
Form: is it original and documentary, or oral or a copy?
Risk: is the area high risk? If so, ask for stronger evidence and more of it.
Name one procedure that would improve the evidence, and link it to the assertion.

Common mistakes in Audit Evidence: Sufficiency and Appropriateness (ISA 500)

Treating sufficient and appropriate as the same thing.
The phrase is often used as one block.
Fix: Define sufficiency as quantity and appropriateness as quality (relevance and reliability). Comment on each separately.
Listing procedures without linking them to an assertion or risk.
Students recall a list of procedures from memory.
Fix: For every procedure, state what it tests, such as existence of inventory or completeness of liabilities.
Relying on inquiry of management alone.
It is quick and sounds sensible.
Fix: Say inquiry must be corroborated by other evidence, such as inspection of documents or external confirmation.
Stating the reliability hierarchy as always true.
It is learned as a fixed ranking.
Fix: Say evidence is 'generally more reliable' and note exceptions, for example an external document can be unreliable if the source lacks competence.
Assuming more evidence cures poor quality evidence.
Students link sufficiency to volume only.
Fix: Explain that quantity does not compensate for weak quality. The auditor needs reliable evidence.
Ignoring reliability of information produced by the entity.
Client reports are taken at face value.
Fix: State that the auditor must assess whether such information is accurate and complete before using it, for example by testing the report's source data.

Worked examples

Example 1

During the audit of Zenta Co, a manufacturer, the auditor wants evidence of the existence of trade receivables. Management gives a schedule of balances and a verbal assurance that customers pay on time. A copy of one large customer's statement was held on file. Evaluate the reliability of this evidence and suggest better procedures.

Show the solution

Identify the assertion: existence of receivables.
The schedule is internally produced. Its accuracy and completeness must be checked before it is used, for example by agreeing it to the receivables ledger.
The verbal assurance is oral and from management. It is the weakest form and is not independent. It needs corroboration.
The customer statement is a copy and was on client file. It is indirect, so it is less reliable than evidence obtained directly from the customer.
Better procedure: send external confirmation requests directly to customers, with the auditor controlling the process.
For non-replies, perform alternative procedures such as inspecting after-date cash receipts and the related invoices and despatch documents.

Answer: The evidence is weak. The verbal assurance and internal schedule are not independent, and the copied statement is indirect. The auditor should obtain external confirmations and, for non-replies, test subsequent receipts and supporting documents.

Example 2

Explain why a bank confirmation received directly by the auditor is more persuasive evidence of cash at bank than the client's bank reconciliation. Also state what makes evidence sufficient.

Show the solution

Source: the bank confirmation is external and independent of the client. The reconciliation is prepared by the client.
Directness: the auditor receives the confirmation directly, so management cannot alter it. The reconciliation is passed through management.
Form: the confirmation is written and documentary.
The reconciliation is still useful. The auditor can test it by agreeing balances to the confirmation and checking reconciling items to later bank statements.
Sufficiency is about quantity. It depends on the assessed risk of material misstatement and the quality of the evidence. Higher risk or weaker quality means more evidence is needed.

Answer: The confirmation is more persuasive because it is external, direct and documentary. The reconciliation is internal and needs testing. Sufficiency is the quantity of evidence, driven by risk and quality.

Exam tips

Always give both halves: sufficiency (quantity) and appropriateness (relevance and reliability). Examiners reward the distinction.
Use scenario facts. Name who produced the evidence and in what form, then judge it.
When asked for procedures, name the type (inspection, observation, confirmation, recalculation) and the assertion it supports.
Earn professional skills marks by showing scepticism: question management explanations and ask for corroboration.
Do not claim the hierarchy is absolute. Use words like 'generally' and mention exceptions.

Practice questions from Evidence and testing considerations

Audit Evidence: Sufficiency and Appropriateness (ISA 500) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Evidence: Sufficiency and Appropriateness (ISA 500): frequently asked questions

What is the difference between sufficient and appropriate audit evidence?

Sufficiency is the quantity of evidence. Appropriateness is its quality, made up of relevance and reliability. The auditor needs both to support an opinion.

What is the reliability hierarchy of audit evidence?

Evidence is generally more reliable if it is external, obtained directly, documentary and original, and if the entity's controls are effective. These are guides, not fixed rules, so judge each case.

Is inquiry enough as audit evidence?

No. Inquiry alone is not sufficient to support an assertion. The auditor should corroborate it with other evidence, such as inspection or confirmation.

What audit procedures does ISA 500 describe?

Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. They are used for risk assessment, tests of controls and substantive procedures.