External vs. Internal Audit Evidence: What Auditors Need to Know About Reliability, Sufficiency, and Audit Quality
Why External and Internal Auditors Use Different Evidence Standards—and How Both Can Improve Their Audit Conclusions
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Audit Evidence | PCAOB AS 1105 | IIA Global Internal Audit Standards | COSO | Audit Quality
Audit evidence is the foundation of every defensible audit conclusion.
Whether an auditor is examining financial statements, evaluating internal controls, investigating fraud, or assessing regulatory compliance, the quality of the audit depends on the evidence obtained.
However, external auditors and internal auditors do not always approach audit evidence in the same way.
External auditors performing financial statement audits must obtain sufficient appropriate audit evidence to support their opinions on financial statements and, when applicable, internal control over financial reporting.
Internal auditors obtain evidence to evaluate risks, governance, controls, compliance, and operational effectiveness and to support their engagement findings and conclusions.
Both professions require reliable information and professional judgment. However, their objectives, applicable standards, evidence requirements, and reporting responsibilities differ.
The critical question is not simply whether an auditor has collected evidence. It is whether that evidence is sufficiently reliable, relevant, and persuasive to support the specific audit conclusion.
Understanding these differences is essential for audit quality, professional skepticism, and effective communication with management and Audit Committees.
1. What Is Audit Evidence?
Audit evidence is the information auditors use to support their findings and conclusions.
Evidence may include accounting records, contracts, invoices, bank confirmations, system-generated reports, reconciliations, management explanations, physical observations, analytical results, and independently obtained information.
The evidence needed depends on the audit objective and the risks being evaluated.
For example, an external auditor examining the existence of accounts receivable may obtain confirmations directly from customers.
An internal auditor examining the effectiveness of the credit approval process may inspect credit applications, approval records, system permissions, and evidence of supervisory review.
Both engagements involve accounts receivable.
However, the audit objectives are different, and the evidence must be evaluated in relation to those objectives.
2. External Audit Evidence: PCAOB AS 1105
For audits performed under PCAOB standards, AS 1105, Audit Evidence, establishes requirements concerning the sufficiency and appropriateness of audit evidence.
The auditor must design and perform procedures to obtain sufficient appropriate evidence to provide a reasonable basis for the audit opinion.
Two concepts are central.
Sufficiency
Sufficiency refers to the quantity of audit evidence.
The amount needed depends on factors such as the assessed risk of material misstatement and the quality of the evidence.
Higher risks generally require more persuasive evidence.
However, collecting additional evidence does not necessarily compensate for evidence that is unreliable or irrelevant.
Appropriateness
Appropriateness refers to the quality of audit evidence, including its relevance and reliability.
Evidence must relate to the assertion being tested.
It must also be sufficiently reliable to support the auditor's conclusion.
For example, a customer confirmation may provide evidence about the existence of an account receivable, but it does not necessarily establish that the receivable is collectible.
Auditors must connect evidence to the relevant financial statement assertion.
3. Internal Audit Evidence: IIA Global Internal Audit Standards
The Institute of Internal Auditors' Global Internal Audit Standards establish requirements for obtaining and evaluating information during internal audit engagements.
Standard 14.1, Gathering Information for Analyses and Evaluation, requires internal auditors to gather information that is relevant, reliable, and sufficient to perform analyses and evaluations.
The standard also addresses the usefulness of information.
Other relevant standards include:
Standard 13.2 — Engagement Risk Assessment: Understanding the activity under review and assessing relevant risks.
Standard 13.4 — Evaluation Criteria: Identifying appropriate criteria against which the activity will be evaluated.
Standard 14.2 — Analyses and Potential Engagement Findings: Analyzing information to identify differences between evaluation criteria and actual conditions.
Standard 14.3 — Evaluation of Findings: Evaluating potential findings to determine their significance.
Standard 14.6 — Engagement Documentation: Documenting information and evidence supporting engagement results.
Internal audit evidence must support the engagement objectives and conclusions.
Unlike a financial statement audit, an internal audit engagement may address operational effectiveness, compliance, fraud risks, cybersecurity, procurement, or governance.
The evidence requirements therefore depend on the nature of the engagement.
4. External vs. Internal Audit Evidence: The Major Differences
Area | External audit | Internal audit |
Primary objective | Support an opinion on financial statements or ICFR | Provide assurance and advice concerning governance, risk management, and controls |
Principal standards | PCAOB standards or applicable external auditing standards | IIA Global Internal Audit Standards |
Evidence framework | Sufficient appropriate audit evidence | Relevant, reliable, and sufficient information |
Typical focus | Financial statement assertions and material misstatement risks | Engagement objectives, risk exposures, controls, compliance, and performance |
Common evidence | Confirmations, accounting records, recalculations, inspections, substantive analytics | Interviews, process records, control testing, operational data, analytics, observations |
Risk assessment | Risks of material misstatement and related audit risks | Risks relevant to the activity and engagement objectives |
Materiality | Financial statement materiality and related performance considerations | Significance evaluated in the context of engagement risks and objectives |
Reporting | Audit opinions and required communications | Findings, conclusions, recommendations, and action plans |
Independence | Independence from the audit client under applicable requirements | Organizational independence and individual objectivity under IIA standards |
Documentation | Applicable external auditing documentation requirements | IIA engagement documentation requirements |
The fundamental difference is the purpose for which evidence is obtained.
External audit evidence supports an independent opinion. Internal audit evidence supports conclusions about the effectiveness of governance, risk management, and control processes.
These purposes overlap, but they are not interchangeable.
5. Evidence Reliability: Which Sources Are Most Persuasive?
Auditors should evaluate evidence reliability based on its source, nature, and the circumstances in which it is obtained.
Under PCAOB AS 1105, evidence obtained from knowledgeable independent sources outside the company is generally more reliable than evidence obtained solely from internal company sources.
Evidence generated internally may be more reliable when the company's related controls are effective.
Evidence obtained directly by the auditor may be more reliable than evidence obtained indirectly.
Documentary evidence may be more reliable than unsupported oral explanations.
Illustrative evidence reliability comparison
Evidence | General reliability consideration |
Bank confirmation received directly by the auditor | Strong independent evidence for matters confirmed |
Original executed contract | Potentially persuasive evidence of contractual terms, subject to authenticity |
Auditor reperformance | Direct evidence concerning the procedure reperformed |
System-generated report | Reliability depends on completeness, accuracy, and relevant controls |
Management-prepared spreadsheet | Requires evaluation of inputs, calculations, and assumptions |
Employee interview | Useful evidence that often requires corroboration |
Unsupported management assertion | Generally insufficient by itself for significant conclusions |
This is not an absolute ranking.
A document may be authentic but irrelevant to the assertion.
An external confirmation may not address the complete audit objective.
A system-generated report may be highly reliable when appropriate controls and data integrity have been established.
Auditors must evaluate the evidence in context.
6. Inquiry Alone Is Usually Not Enough
Inquiry is a common procedure in both external and internal auditing.
Auditors ask employees and management to explain transactions, describe procedures, and identify risks.
However, an explanation is not necessarily evidence that a control operated effectively.
Example: Purchasing approvals
An internal auditor asks the purchasing manager:"Are all purchases over $25,000 approved before the purchase order is issued?"
The manager responds: "Yes. That is our policy."
This response establishes what the manager says should happen.
It does not establish that the approval control operated consistently.
The auditor should inspect relevant transactions and approval evidence.
An external auditor testing a relevant purchasing control would face a similar issue.
A control description explains how a process is supposed to operate. Control testing determines whether it actually operated.
7. Inspection: Evidence From Documents and Records
Inspection involves examining records, documents, or tangible assets.
External auditors frequently inspect contracts, invoices, journal entries, bank statements, and accounting records.
Internal auditors may inspect policies, approval records, exception reports, compliance documentation, and operational records.
The reliability of inspected documents depends on their origin and integrity.
Example
An auditor inspects an invoice bearing an approval signature.
The signature may demonstrate that approval occurred.
However, it may not establish that the approver evaluated pricing, vendor legitimacy, contract compliance, or receipt of goods.
The auditor must determine what the control was intended to accomplish.
A signed document is not automatically evidence that an effective review occurred.
8. Observation: Seeing a Control in Operation
Observation involves watching personnel perform a process or control.
An auditor may observe inventory counting, cash handling, physical security procedures, or an operational control.
Observation can provide useful evidence about how a process operates at a particular time.
However, it has an important limitation.
Employees may perform procedures differently when they know an auditor is watching.
Observation also generally provides evidence about the control at the time observed, rather than throughout the entire period.
Auditors may need additional evidence to support conclusions about consistent operation.
9. Reperformance: One of the Most Persuasive Testing Techniques
Reperformance involves independently executing procedures or controls originally performed by company personnel.
Examples include recalculating a bank reconciliation, repeating a three-way match, or independently evaluating a control's calculation.
Example: Vendor payment control
Management states that accounts payable personnel match purchase orders, receiving records, and invoices before payment.
An internal auditor selects transactions and independently verifies the match.
This provides direct evidence about whether the selected transactions satisfied the required criteria.
An external auditor may use similar procedures when testing controls relevant to financial reporting.
Reperformance can provide persuasive evidence, but auditors must still consider sampling, completeness, and the period covered.
10. Analytical Procedures: Evidence or an Indicator of Risk?
Analytical procedures involve evaluating relationships among financial and nonfinancial data.
Examples include:
Revenue trends.
Gross margin comparisons.
Payroll expense ratios.
Inventory turnover.
Duplicate payment analysis.
Budget-to-actual variances.
Unusual journal entry patterns.
Internal auditors frequently use analytics to identify operational inefficiencies, compliance problems, and potential fraud.
External auditors use analytical procedures for risk assessment and, when appropriately designed, as substantive audit procedures.
Important distinction
An unusual trend is not automatically an audit finding.
It may indicate a risk requiring further investigation.
For example, a sudden increase in gross margin could reflect a legitimate change in product mix.
It could also indicate incorrect cost recognition or premature revenue recognition.
The auditor must obtain sufficient evidence before concluding that a misstatement or control failure exists.
11. External Confirmations: Independent Evidence
External confirmations are particularly important in financial statement audits.
Under applicable PCAOB requirements, including AS 2310, The Auditor's Use of Confirmation, auditors may obtain evidence directly from knowledgeable third parties.
Common examples include confirmations of accounts receivable, cash balances, debt arrangements, and contractual terms.
The auditor must maintain appropriate control over the confirmation process.
Why independence matters
A bank balance statement supplied by management may be useful evidence.
A confirmation received directly from the bank through an appropriately controlled process generally provides stronger evidence concerning the confirmed information.
The distinction is not merely the document's appearance.
It is the reliability of the source and the process used to obtain the evidence.
Internal auditors may also obtain third-party confirmations when appropriate to their engagement objectives.
12. Information Produced by the Entity: A Shared Audit Challenge
Both external and internal auditors increasingly rely on information generated by company systems.
Examples include:
Accounts receivable aging reports.
Inventory reports.
Payroll exception reports.
Vendor master files.
User access reports.
Journal entry listings.
Purchasing transaction data.
Financial reporting dashboards.
The challenge is determining whether the information is sufficiently complete and accurate for the intended audit purpose.
Example: Duplicate vendor payment analysis
An internal auditor obtains an accounts payable transaction report and searches for duplicate invoice numbers.
The analysis identifies no duplicate payments.
However, the report excludes payments made through a separate payment platform.
The auditor's conclusion may be unreliable because the population is incomplete.
An external auditor relying on the same report would face a similar concern.
Recommended procedures
Auditors should consider:
Identifying the original data source.
Understanding report parameters and filters.
Reconciling report totals to reliable records.
Evaluating relevant system controls.
Testing selected data fields.
Documenting the procedures used to establish reliability.
Sophisticated analytics performed on incomplete or inaccurate data do not produce reliable audit evidence.
13. Sampling: How Much Evidence Is Enough?
Auditors frequently test samples rather than entire populations.
Sampling decisions should reflect the engagement objective, risk, population characteristics, and applicable standards.
For external auditors, PCAOB AS 2315, Audit Sampling, provides requirements and guidance concerning audit sampling.
Internal auditors should design sampling approaches appropriate to their engagement objectives and the level of assurance needed.
Example
An organization processes 50,000 vendor payments annually.
An auditor selects 25 transactions for testing.
Is that sufficient?
There is no universal answer.
The auditor must consider the objective, sampling methodology, population, expected deviations, tolerable deviation or misstatement, and other relevant factors.
A sample of 25 may be appropriate for one purpose and inadequate for another.
The auditor should document the rationale for the approach.
14. Evidence for Control Design Versus Operating Effectiveness
One of the most common audit errors is confusing evidence of control design with evidence of operating effectiveness.
Design effectiveness
Does the control, if performed as intended, adequately address the identified risk?
Operating effectiveness
Did the control actually operate as designed during the relevant period?
Example: Bank reconciliations
Management provides a written policy requiring monthly bank reconciliations.
The policy may support the auditor's understanding of control design.
However, the auditor must inspect or otherwise test evidence that reconciliations were performed, reviewed, and that significant differences were appropriately resolved.
The existence of a policy does not demonstrate operating effectiveness.
This distinction is particularly important in ICFR audits under PCAOB AS 2201 and in internal audit engagements evaluating control performance.
15. Management Review Controls: Why Signatures Are Not Enough
Management review controls present significant evidence challenges.
Examples include:
Monthly financial statement reviews.
Budget-to-actual comparisons.
Reviews of accounting estimates.
Reviews of unusual transactions.
Reviews of exception reports.
The auditor should determine whether the review operates at sufficient precision to address the identified risk.
Example
The CFO signs a monthly financial reporting package.
Does that establish an effective control?
Not necessarily.
The auditor should understand:
What information was reviewed?
What expectations were used?
Which differences required investigation?
How were explanations evaluated?
What corrective actions were taken?
Was the underlying information reliable?
A signature may establish that a report was acknowledged.
It may not demonstrate that the review could identify a material misstatement.
16. Fraud Investigations Require a Different Evidence Mindset
Fraud-related engagements can require evidence approaches beyond routine control testing.
An internal auditor examining potential vendor fraud may need to analyze:
Vendor ownership information.
Bank account changes.
Payment patterns.
Employee relationships.
Contract terms.
Approval records.
System access logs.
Communications and transaction histories.
The auditor must distinguish between suspicious indicators and established facts.
Example
An employee and vendor share a mailing address.
That fact may warrant further investigation.
It does not, by itself, establish fraud.
Additional evidence may be needed to determine whether an undisclosed conflict of interest or fraudulent transaction occurred.
External auditors also have responsibilities relating to fraud risks, including requirements under PCAOB AS 2401.
However, a financial statement audit is not equivalent to a comprehensive forensic fraud investigation.
17. Conflicting Audit Evidence: What Should the Auditor Do?
Auditors sometimes obtain evidence that contradicts other information.
For example:
Management states that all journal entries require approval.
System records show that certain entries were posted without approval.
Management explains that those entries were emergencies.
The auditor should investigate the inconsistency.
Under PCAOB AS 1105, inconsistent evidence or doubts about reliability require the auditor to determine what modifications or additions to audit procedures are necessary.
Internal auditors should similarly investigate inconsistencies that affect the reliability of their analyses and conclusions.
Professional skepticism
Auditors should not automatically accept the explanation that best supports management's position.
They should obtain sufficient evidence to resolve the matter appropriately.
If the inconsistency remains unresolved, the auditor must consider its effect on the engagement conclusion.
18. Documentation: If the Workpapers Do Not Support the Conclusion, the Audit Has a Problem
Audit documentation should demonstrate the work performed and the basis for the auditor's conclusions.
External auditors performing PCAOB engagements must comply with AS 1215, Audit Documentation.
Internal auditors must satisfy applicable IIA requirements, including Standard 14.6.
Essential documentation elements
The audit objective.
The risk or assertion being evaluated.
The evaluation criteria.
The source of evidence.
The procedures performed.
The population and sample selected.
The results of testing.
Exceptions identified.
Additional procedures performed.
The auditor's conclusions.
Relevant supervisory review.
A workpaper should allow an appropriately experienced reviewer to understand the work performed and its significance.
Documentation should not merely state: "Tested 25 transactions. No exceptions."
It should explain what was tested, how the sample was selected, which criteria were applied, and what evidence supports the result.
19. The Five Elements of an Internal Audit Finding
Internal auditors frequently organize findings around five elements.
Condition: What exists?
Criteria: What should exist?
Cause: Why did the difference occur?
Effect: What is the consequence or risk?
Management Action Plan: What corrective action management has committed to?
Evidence is necessary to support each factual element.
Example: Vendor master file controls
Condition: Testing identified vendor bank account changes without evidence of independent verification.
Criteria: Company policy requires independent verification before bank account changes become effective.
Cause: The process lacks a consistently enforced verification procedure.
Effect: The organization faces increased risk of fraudulent or misdirected payments.
Management Action Plan: Management will establish and monitor an independent verification process.
The auditor should distinguish between causes established through evidence and potential causes that require additional investigation.
A recommendation should address the underlying control problem rather than simply restating the policy.
20. How External Auditors May Use Internal Audit Work
External auditors may consider work performed by internal auditors when permitted under applicable standards.
For PCAOB engagements, AS 2605, Consideration of the Internal Audit Function, addresses the external auditor's consideration of internal audit work.
The external auditor evaluates relevant factors, including the internal auditors' competence and objectivity, and determines whether and to what extent the work may be used.
In an integrated audit, AS 2201 also addresses using the work of others.
Important limitation
The external auditor retains responsibility for the audit opinion.
The existence of internal audit testing does not automatically eliminate the need for external audit procedures.
The external auditor must evaluate the work's relevance, quality, and suitability for the intended purpose.
Practical example
Internal Audit tests monthly account reconciliations.
The external auditor may evaluate the internal audit methodology, workpapers, personnel qualifications, objectivity, and testing results.
Depending on the assessed risk and applicable requirements, the external auditor may use some of that work.
However, the external auditor remains responsible for obtaining sufficient appropriate evidence.
21. Ten Common Audit Evidence Failures
Both external and internal auditors should recognize these recurring problems.
1. Excessive reliance on inquiry. Accepting verbal explanations without adequate corroboration.
2. Incomplete populations. Testing data without establishing that the population is complete.
3. Unreliable system reports. Relying on reports without evaluating relevant data integrity risks.
4. Weak sampling methodology. Selecting samples without a defensible rationale.
5. Inadequate management review testing. Treating signatures as evidence of effective review.
6. Failure to investigate exceptions. Dismissing unusual results without obtaining support.
7. Confusing policies with performance. Assuming documented procedures operated effectively.
8. Insufficient evidence for conclusions. Reaching findings that exceed what the evidence establishes.
9. Poor documentation. Failing to record procedures, results, and supporting evidence.
10. Confirmation bias. Favoring information that supports an initial conclusion while discounting contradictory evidence.
These weaknesses can undermine otherwise well-designed audit programs.
22. How Artificial Intelligence Can Improve Audit Evidence Analysis
AI tools can assist auditors with organizing evidence, identifying anomalies, evaluating documentation gaps, and developing preliminary testing procedures.
However, AI-generated outputs are not automatically reliable audit evidence.
Example 1: Evidence sufficiency review
Review this audit workpaper and identify whether the documented evidence supports the stated audit objective and conclusion. Identify missing procedures, unsupported assumptions, and contradictory evidence. Do not invent facts or conclude that evidence exists unless it is documented.
Example 2: Control testing
Develop testing procedures for a monthly management review control. Address design effectiveness, operating effectiveness, review precision, report completeness and accuracy, and evidence of investigation.
Example 3: Fraud risk analysis
Analyze this vendor payment dataset for potential duplicate payments, unusual payment patterns, and vendor bank account changes. Identify anomalies requiring investigation. Do not characterize anomalies as fraud without corroborating evidence.
Example 4: Audit documentation quality
Review this audit workpaper for completeness. Determine whether the objective, population, sample selection, procedures, results, exceptions, and conclusion are adequately documented.
AI limitations
Auditors must verify AI-generated interpretations and calculations.
Confidential information should be used only in approved environments.
AI cannot independently establish the authenticity of documents or the reliability of underlying data merely by analyzing their contents.
AI can improve the efficiency of evidence analysis, but it does not replace professional skepticism or the auditor's responsibility to obtain sufficient reliable evidence.
23. A Practical Audit Evidence Quality Checklist
Before finalizing an audit conclusion, auditors should ask:
Is the audit objective clearly defined?
Is the evidence relevant to that objective?
Is the evidence sufficiently reliable?
Was the completeness and accuracy of relevant information evaluated?
Were appropriate testing procedures performed?
Was the population properly identified?
Was the sampling methodology appropriate?
Were exceptions investigated?
Was contradictory evidence considered?
Were management explanations corroborated where necessary?
Does the evidence support the specific conclusion?
Is the work adequately documented?
Has the work received appropriate supervisory review?
Are limitations in the evidence appropriately reflected in the conclusion?
Would an appropriately experienced reviewer understand and be able to evaluate the work performed?
This checklist is useful for both external and internal audit engagements, with adjustments for the applicable standards and objectives.
24. Why Audit Evidence Training Matters
Audit evidence requirements affect virtually every stage of an engagement.
Staff auditors must understand how to obtain and document evidence.
Senior auditors must evaluate whether procedures address the intended risks.
Audit managers must determine whether the evidence supports engagement findings and conclusions.
Engagement partners and chief audit executives must oversee audit quality and ensure that conclusions are appropriately supported.
Training should therefore address more than the terminology of audit evidence.
It should teach auditors how to connect objectives, risks, procedures, evidence, exceptions, and conclusions.
This connection is fundamental to effective audit tradecraft.
Corporate Compliance Seminars: Professional CPE Training in Audit Evidence
Corporate Compliance Seminars (CCS) offers continuing professional education programs designed to help auditors strengthen their technical knowledge and practical audit skills.
Relevant CCS training areas include:
PCAOB AS 1105 — Audit Evidence: Understanding sufficiency, appropriateness, relevance, reliability, and the evidence necessary to support financial statement audit opinions.
PCAOB AS 2201 — An Audit of ICFR: Applying a risk-based approach to selecting and testing controls over financial reporting.
PCAOB AS 1215 — Audit Documentation: Preparing workpapers that demonstrate the procedures performed, evidence obtained, and conclusions reached.
Internal Auditing Programs: Developing practical skills in risk assessment, audit planning, control testing, interviewing, evidence evaluation, findings, and reporting.
Fraud Auditing and Investigation: Recognizing fraud indicators, evaluating suspicious transactions, and obtaining evidence to support defensible findings.
Artificial Intelligence for Auditors: Using AI to assist with risk assessment, analytics, documentation review, and audit testing while maintaining professional judgment.
Recommended CCS CPE Events
CCS also provides private group training for organizations seeking to strengthen the technical capabilities of their audit teams.
Conclusion: Evidence Determines the Credibility of the Audit
External and internal auditors have different responsibilities, but both depend on evidence to support their work.
External auditors must obtain sufficient appropriate evidence to support financial statement and applicable ICFR opinions.
Internal auditors must gather relevant, reliable, and sufficient information to support engagement findings and conclusions.
The standards differ because the engagement objectives differ.
However, both professions share fundamental responsibilities.
Auditors must evaluate the reliability of information.
They must obtain evidence relevant to the risks being examined.
They must investigate exceptions and contradictory information.
They must exercise professional skepticism.
And they must document the basis for their conclusions.
The quality of an audit is not measured by the number of documents collected, the number of transactions tested, or the length of the final report. It is measured by whether the evidence obtained is sufficiently persuasive to support the conclusions reached.
That is the foundation of effective audit quality.
Corporate Compliance Seminars — Professional CPE Training in External Auditing, Internal Auditing, PCAOB Standards, Internal Controls, Fraud Detection, and Audit Tradecraft.
Comments