Internal and Forensic Audit · Internal Audit Engagements and Planning

Audit Evidence, Sampling and Working Papers in Internal Audit

Updated 11 October 2026 · Fact-checked

Audit evidence is the information an internal auditor gathers to support findings and conclusions. It must be sufficient and appropriate. Sampling tests part of a population to reach a conclusion on all of it. Working papers are the record of the work done, the evidence seen and the conclusions reached.

Understand Audit Evidence, Sampling and Working Papers

Every internal audit conclusion needs support. That support is audit evidence: the information you collect to back your findings, such as documents, confirmations, observation, inquiry, recalculation and data analysis. Evidence is judged on two tests. Sufficiency is about quantity. Appropriateness is about quality: how relevant and reliable it is.

You cannot check every transaction in a large population. So you use audit sampling: you test fewer than all items and draw a conclusion about the whole. There are two broad approaches. Statistical sampling uses random selection and probability theory to measure sampling risk. Non-statistical (judgmental) sampling relies on your judgment to pick items, for example high-value or unusual ones. In both cases the sample must be representative enough to support the conclusion. Some items you may test 100%, such as very large or high-risk ones.

Sampling carries sampling risk: the sample may suggest a conclusion different from what a full test would give. There is also non-sampling risk, which comes from errors in method, such as using a wrong procedure or misreading evidence. Sampling risk can be reduced by a larger sample. Non-sampling risk is reduced by good planning, supervision and review.

Working papers are the documented record of the engagement: the plan, programme, procedures performed, evidence examined, findings, conclusions and review notes. They show that the work was properly planned, performed, supervised and reviewed. Evidence and working papers are different things. Evidence is the information you obtain. Working papers are the file in which you record it and what you did with it.

The external audit standards give a useful parallel. SA 610 (Revised) expects an external auditor who relies on internal audit work to check that it was properly planned, performed, supervised, reviewed and documented, and that sufficient appropriate evidence supports its conclusions. SA 610 also lists review of the internal audit function's work programme and working papers as a way to judge quality. For your paper, the lesson is that your working papers will be read by others. Write them so a reviewer can follow your work without asking you.

Key rules to remember

Test of evidence: Good evidence = Sufficient (enough in quantity) + Appropriate (relevant and reliable); State both parts in every answer. Higher risk needs more and better evidence.
Sampling approaches: Sampling = Statistical (random, measured risk) or Non-statistical (judgmental); Both are valid if the sample supports the conclusion. Statistical lets you quantify sampling risk.
Risks in sampling: Audit risk from testing = Sampling risk + Non-sampling risk; Sampling risk falls with a larger sample. Non-sampling risk falls with better procedures and review.
Working paper content: Working paper = Objective + Procedure + Source/evidence + Findings + Conclusion + Preparer and reviewer sign-off with dates; Use this as a checklist when asked what a working paper should contain.
Reliance on internal audit work (SA 610 Revised, para 23): Work properly planned, performed, supervised, reviewed and documented; evidence sufficient and appropriate; conclusions appropriate; Three checks an external auditor applies before using internal audit work.

How to solve Audit Evidence, Sampling and Working Papers questions

Use this method for any question on evidence, sampling or working papers. It keeps answers structured and case-based.

1Read the facts and identify what is asked: evidence, sampling method, working paper content, or a comparison.
2State the rule or concept in one or two lines, such as sufficiency and appropriateness, or the type of sampling.
3Apply it to the facts. Name the area under audit, the risk level, the population and the type of evidence available.
4Rank the evidence by reliability: external over internal, direct observation over inquiry alone, original over copies, and controlled systems over weak ones.
5For sampling, justify the choice: population size, risk, homogeneity, and whether to test all high-value or unusual items.
6Say how the work will be recorded in working papers: objective, procedure, evidence, finding, conclusion, review.
7Conclude clearly and add a practical point, such as extending the sample if errors are found.

Quickest way: S-A-R-D check under time pressure

When to use it: Use it when you have little time and need a structured short answer on any evidence or working paper question.

S: Is the evidence sufficient?
A: Is it appropriate, meaning relevant and reliable?
R: Is the sample representative and the risk addressed?
D: Is it documented with source, procedure, conclusion and review sign-off?
Write one line on each letter, linked to the facts, then conclude.

Common mistakes in Audit Evidence, Sampling and Working Papers

Treating audit evidence and working papers as the same thing.
Both involve documents, so they seem identical.
Fix: Say evidence is what you obtain to support conclusions. Working papers are the record of the work, including the evidence you relied on and your conclusions.
Defining sufficiency and appropriateness as one idea.
Students use the words 'enough' and 'good' loosely.
Fix: Sufficiency is quantity. Appropriateness is quality, made up of relevance and reliability. Write them separately.
Saying statistical sampling is always better.
It sounds more scientific.
Fix: Either approach is acceptable if it gives a valid basis for the conclusion. Statistical sampling lets you measure sampling risk. Judgmental sampling suits targeted testing.
Ignoring what to do when errors are found in a sample.
Students stop at selecting the sample.
Fix: Investigate the cause, consider extending the sample or testing more, and revise the conclusion or plan if needed. Changing the plan in light of new evidence is a normal part of audit.
Writing working papers as a list of ticks with no conclusion.
Students think recording procedures is enough.
Fix: Each working paper needs an objective, the work done, the evidence, findings, a conclusion, and preparer and reviewer sign-off with dates.
Relying on inquiry alone for a high-risk area.
It is quick and easy.
Fix: Corroborate inquiry with documents, observation, recalculation or data analysis. Higher risk calls for stronger evidence.

Worked examples

Example 1

You are the internal auditor of Bharat Textiles Ltd. You are testing whether purchase invoices above ₹5,00,000 were approved before payment. There are 40 such invoices out of 6,000 invoices in the year. Suggest how you would select items and what evidence you would keep.

Show the solution

Concept: the objective is to test approval control. Evidence must be sufficient and appropriate.
Population: the 40 high-value invoices are few and carry higher risk, so test all 40 rather than sample them.
For the remaining 5,960 invoices, select a sample using random selection or a judgmental method, depending on whether you want to measure sampling risk. Include unusual items, such as invoices near period end or from new vendors.
Evidence: obtain the invoice, purchase order, goods receipt note and payment approval. Check dates to confirm approval came before payment.
Reliability: original approvals in the system or signed copies are better than verbal confirmation.
Documentation: record in the working paper the objective, population, sample basis, items tested, exceptions, conclusion and reviewer sign-off.
If exceptions are found, extend the sample and report the control weakness.

Answer: Test all 40 high-value invoices and a representative sample of the rest. Collect invoice, PO, GRN and approval evidence, then record objective, procedure, exceptions, conclusion and review in the working paper.

Example 2

The audit committee asks why the internal audit team of Sagar Pharma Ltd keeps detailed working papers when its final report already states the findings. Explain the purpose and contents of working papers.

Show the solution

Meaning: working papers are the record of the work performed, evidence obtained and conclusions reached during the engagement.
Purpose one: they support the report. Each finding in the report can be traced to evidence in the file.
Purpose two: they show the work was properly planned, performed, supervised and reviewed. A reviewer can assess quality from them.
Purpose three: they help in follow-up and in planning future audits, and let another person continue the work.
Purpose four: they can be used by an external auditor who plans to rely on the work. SA 610 (Revised) has the external auditor check whether the work was properly planned, performed, supervised, reviewed and documented, and may review the work programme and working papers.
Contents: audit plan and programme, objectives, procedures performed, samples and basis, evidence or references, exceptions, conclusions, and preparer and reviewer sign-off with dates.
Conclusion: the report is a summary. The working papers are the proof behind it.

Answer: Working papers record the plan, procedures, evidence, findings, conclusions and review. They support the report, show quality of work, aid follow-up and allow reliance by others, so they are kept in addition to the report.

Exam tips

Always define evidence with both tests: sufficient and appropriate. Examiners look for both words.
In sampling answers, name the approach (statistical or judgmental), justify it from the facts, and mention what you do if errors appear.
When asked to differentiate evidence and working papers, give three or four clear points: nature, purpose, form and use.
Link answers to the facts in the case. Mention the risk, the population and the type of evidence available.
If you cite SA 610 (Revised), use only the points you are sure of: work properly planned, performed, supervised, reviewed and documented; sufficient appropriate evidence; and review of working papers as a way to assess quality.

Practice questions from Internal Audit Engagements and Planning

Audit Evidence, Sampling and Working Papers in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Evidence, Sampling and Working Papers: frequently asked questions

What is audit evidence in internal audit?

It is the information the internal auditor collects to support findings and conclusions. It includes documents, observations, inquiries, recalculations and data analysis. It must be sufficient and appropriate.

What is the difference between audit evidence and working papers?

Audit evidence is the information you obtain to support your conclusions. Working papers are the record of the work done, which includes the evidence relied on, the procedures, findings and conclusions. Evidence is the input and working papers are the file that documents it.

What are the types of audit sampling?

The two broad types are statistical sampling and non-statistical or judgmental sampling. Statistical sampling uses random selection and probability to measure sampling risk. Judgmental sampling relies on the auditor's judgment to select items.

What should a working paper contain?

It should show the objective, procedure performed, source of evidence, findings, conclusion, and the preparer and reviewer with dates. It should be clear enough for a reviewer to follow without further explanation.

Can an external auditor use internal audit working papers?

Under SA 610 (Revised), an external auditor can use the work of the internal audit function after performing enough procedures to judge its adequacy. This includes checking that the work was properly planned, performed, supervised, reviewed and documented, and that the evidence supports the conclusions.