Advanced Audit and Assurance (International) · The audit of performance information (pre-determined objectives) in the public sector

Audit Evidence and Procedures for Performance Information

Updated 11 October 2026 · Fact-checked

Performance information is reported data on whether a public body met its pre-determined objectives. You audit it by testing the data against suitable criteria. Check validity, accuracy and completeness, and test the systems that produce it. Use inquiry, inspection, recalculation, reperformance and analytical procedures, then judge if evidence is sufficient and appropriate.

Understand Evidence and Procedures for Performance Information

Public sector bodies set objectives in advance, such as treating patients within a set time or building a number of houses. They then report indicators and results against those targets. Users rely on these figures to judge whether public money was used well. Your job is to give assurance on whether the reported figures are reliable.

Start by asking what could be wrong with a reported figure. Three questions cover most of it. Is the event real and does it belong to the entity (validity)? Is the number measured and calculated correctly (accuracy)? Are all relevant events included (completeness)? Reported results can also be wrong in how they are presented, measured against the wrong period, or compared with a target that changed.

Then ask where the number comes from. Performance data often comes from operational systems, not the accounting ledger. Examples are call logs, case management systems, spreadsheets kept by managers and third-party reports. These sources often have weaker controls than financial systems. So you test both the data and the system that produces it, including how it is collected, recorded, aggregated and reported.

Evidence must be sufficient (enough) and appropriate (relevant and reliable). Evidence from outside the entity, or from you directly, is more reliable than internal evidence. Evidence from strong controls is more reliable than evidence from weak ones. Because the data is often non-financial and judgemental, you need extra scepticism. Managers may feel pressure to show targets were met, which creates a risk of bias or manipulation.

In the exam, you will usually get a scenario with a named indicator and some hints of weakness. You must link procedures to the specific indicator and risk, not list generic audit tests.

Key rules to remember

Data quality attributes: Validity + Accuracy + Completeness (+ Timeliness, Consistency); Use these as headings to structure procedures. Validity covers occurrence and relevance, accuracy covers calculation and measurement, completeness covers omissions.
Evidence quality: Sufficient (quantity) + Appropriate (relevance and reliability); Quantity depends on assessed risk and the quality of evidence. Better quality evidence reduces the quantity needed, but does not remove the need for it.
Recalculation check: Reported result = Numerator ÷ Denominator; Re-derive both parts from source records and confirm the definition used matches the published criteria.
Test of completeness direction: Source population → Reported figure; Select from the underlying records and trace to the report to find omissions. Selecting from the report tests validity instead.
Test of validity direction: Reported figure → Supporting source records; Select from the reported items and trace back to evidence that the event happened.

How to solve Evidence and Procedures for Performance Information questions

Use this method for any question asking for procedures or evidence on a performance indicator.

1Identify the indicator, its definition and the criteria it is measured against. Note the period and any target.
2Identify the data source and how the figure is produced: collection, recording, aggregation and reporting.
3Pick the risks from the scenario, such as manual spreadsheets, third-party data, pressure to hit targets or changed definitions. Link each to validity, accuracy or completeness.
4Match each risk to a specific procedure. Use inquiry, observation, inspection, recalculation, reperformance, confirmation and analytical procedures.
5Cover the system as well as the data. Test controls over capture, access, change and review, and consider IT general controls.
6Say what evidence you expect and how reliable it is. Prefer external or directly obtained evidence.
7Conclude on sufficiency and appropriateness, and say what you do if evidence is weak, such as extending testing or considering a modified conclusion.
8Add professional scepticism points, such as corroborating management explanations and watching for bias.

Quickest way: Three-column risk, procedure, evidence grid

When to use it: Use for 8 to 10 mark questions asking for procedures on a named indicator when time is short.

Write three headings in your plan: Validity, Accuracy, Completeness.
Under each, note one specific risk from the scenario.
Beside each, write one named procedure with direction of test and the evidence it produces.
Add one line on systems testing and one on scepticism.
Write it up as short bullets, each starting with the procedure verb.

Common mistakes in Evidence and Procedures for Performance Information

Listing generic financial audit tests such as inventory counts or bank confirmations.
Students reuse financial audit lists without reading the indicator.
Fix: Name the indicator in each procedure and say what you will inspect, for example call logs for response time.
Testing only the reported number and ignoring the system that produces it.
Students see the figure as the whole subject.
Fix: Always add procedures on how data is captured, aggregated and controlled, including spreadsheets and IT access.
Confusing the direction of testing for completeness and validity.
Both involve tracing, so the direction gets mixed up.
Fix: Completeness: from source records to the report. Validity: from the report back to source evidence.
Accepting management explanations as evidence.
Inquiry feels like a quick, easy answer.
Fix: Treat inquiry as a starting point and corroborate with inspection, recalculation or external evidence.
Ignoring whether the indicator definition matches the published criteria.
Students focus on arithmetic only.
Fix: Check the definition, period and scope first. A correct calculation of the wrong measure is still misreporting.
Not stating the conclusion on evidence or what happens if it is insufficient.
Students stop after listing procedures.
Fix: Finish with a sentence on sufficiency and appropriateness, and the effect on the conclusion if you cannot obtain evidence.

Worked examples

Example 1

A public hospital trust reports that 95% of emergency patients were seen within four hours. Figures come from a ward system where staff record arrival and treatment times, and the trust has been under pressure to hit the target. Describe the procedures you would use to test the reliability of this indicator. (8 marks)

Show the solution

Criteria: confirm the definition of the start and end points of the four-hour clock and the period, and compare to the published criteria.
Validity risk: patients may be recorded as seen when they were not. Select a sample of reported records and trace to clinical notes and triage records to confirm the patient attended and the times are supported.
Accuracy risk: times may be entered late or rounded. Reperform the calculation of the percentage from the full data extract, and compare recorded times to independent evidence such as lab request time stamps.
Completeness risk: patients may be excluded to improve results. Select from admission, ambulance arrival and registration records and trace to the ward system to find omitted patients. Review reasons for exclusions.
Systems: test access controls, audit trails of edits to times, and any manual overrides. Inquire and observe how staff record times.
Analytical procedures: compare the pattern of breaches by hour and month to prior years and to similar trusts, and investigate clustering just under the four-hour limit.
Scepticism: corroborate management explanations, and consider bias given target pressure.

Answer: Test the definition against criteria, trace sampled reported records back to clinical evidence for validity, trace from admission records forward for completeness, reperform the percentage, test system controls and edit logs, and use analytical procedures to spot clustering near the limit, all with scepticism about target pressure.

Example 2

A government agency reports that it processed 48,000 licence applications, with 90% decided within 30 days. The agency's manager sends you a spreadsheet showing 43,200 on time. Recompute and explain what evidence you would seek to rely on the figure. (6 marks)

Show the solution

Recalculate: 90% of 48,000 = 0.90 × 48,000 = 43,200, so the spreadsheet agrees with the reported percentage.
Arithmetic agreement does not prove the underlying data is right. Test the inputs.
Completeness: agree the total of 48,000 to the application register and to receipts or fees paid, and check for applications left out or withdrawn without reason.
Validity: sample on-time applications and inspect application and decision dates in the case files to confirm the decision occurred within 30 days.
Accuracy: check the 30-day count method (calendar days or working days, start date) against the published criteria.
System and spreadsheet: test formulas, version control and who can edit, and compare the spreadsheet to the case system extract.

Answer: The recalculation of 43,200 on time is arithmetically correct, but you need evidence on the 48,000 population, sampled decision dates in case files, the day-count definition and controls over the spreadsheet before relying on the 90% figure.

Exam tips

Name the indicator in every procedure. Marks go to procedures tied to the scenario, not general lists.
Use validity, accuracy and completeness as headings so the marker can find each point quickly.
State the direction of testing when you mention tracing. It is an easy mark.
Include one point on the system or spreadsheet controls, and one on scepticism, to earn professional skills credit.
Finish with a short conclusion on sufficiency and appropriateness and the effect of any limitation.

Practice questions from The audit of performance information (pre-determined objectives) in the public sector

Evidence and Procedures for Performance Information in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Evidence and Procedures for Performance Information: frequently asked questions

What evidence do auditors use for performance information?

They use source records, system extracts, third-party data, recalculations, observation and analytical comparisons. External or directly obtained evidence is more reliable than internal explanations. The mix depends on the risks identified for each indicator.

How do you test completeness of reported performance data?

Select items from underlying source records such as registers, receipts or logs and trace them to the reported figure. This finds omissions. Also review exclusions and the reasons given for them.

Why test the system as well as the data?

Performance data often comes from operational systems with weaker controls than the ledger. If capture, aggregation or access controls are weak, errors and manipulation are more likely. Testing the system tells you how much testing of the data you need.

What if you cannot obtain enough evidence on an indicator?

First try to extend or change procedures. If you still lack sufficient appropriate evidence, consider the effect on your conclusion, which may be a modified conclusion depending on materiality and pervasiveness.