Inspection, Observation, Inquiry, and Confirmation as Audit Evidence: A Practical Guide for Auditors
Understanding the Four Essential Audit Evidence Techniques Under PCAOB AS 1105 and AS 2310
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Audit Evidence | PCAOB Auditing Standards | Audit Quality
An auditor's conclusion is only as reliable as the evidence supporting it.
Auditors routinely inspect documents, observe business processes, interview management and employees, and obtain confirmations from external parties. These techniques are fundamental to both financial statement audits and internal control testing.
However, performing an audit procedure does not necessarily mean the auditor has obtained sufficient appropriate audit evidence.
A signed document may not establish that a transaction was legitimate. Observing a control once may not demonstrate that it operated effectively throughout the year.
Management's explanation may be incomplete or inaccurate. Even a third-party confirmation must be evaluated for authenticity, relevance, and reliability.
Under PCAOB AS 1105, Audit Evidence, auditors must design and perform procedures that provide sufficient appropriate evidence to support their conclusions.
Four frequently used techniques are:
Inspection.
Observation.
Inquiry.
Confirmation.
Each technique has different strengths, limitations, and applications.
Understanding when and how to use them—and when additional corroboration is necessary—is essential to effective auditing.
1. What Makes Audit Evidence Sufficient and Appropriate?
PCAOB AS 1105 establishes two fundamental characteristics of audit evidence.
Sufficiency: The quantity of evidence
Sufficiency refers to how much evidence the auditor obtains.
The amount required depends on the assessed risk and the quality of the evidence.
Higher-risk areas generally require more persuasive evidence.
However, obtaining additional evidence of poor quality does not necessarily compensate for its weaknesses.
Appropriateness: The quality of evidence
Appropriateness refers to the relevance and reliability of the evidence.
Relevance means the evidence addresses the assertion or control objective being tested.
Reliability depends on the source, nature, and circumstances under which the evidence is obtained.
For example, a bank confirmation received directly by the auditor generally provides more reliable evidence about a bank balance than a bank balance schedule prepared by management.
However, a bank confirmation may not establish whether all bank accounts have been disclosed.
The auditor must consider what the evidence actually proves.
An essential principle
The most persuasive audit evidence is not necessarily the most detailed document. It is the evidence that reliably addresses the relevant audit objective.
2. Inspection: Examining Documents, Records, and Physical Assets
PCAOB AS 1105.15 describes inspection as examining information in paper, electronic, or other forms, or physically examining an asset.
Inspection is among the most frequently used audit procedures.
Examples of inspection
Auditors may inspect:
Contracts and agreements.
Invoices and purchase orders.
Bank statements.
Board and Audit Committee minutes.
General ledger entries.
Shipping documents.
Inventory.
Fixed assets.
Electronic approval records.
Reconciliation documentation.
Example: Revenue occurrence
An auditor selects a recorded sales transaction and inspects the customer order, invoice, shipping documentation, and relevant contract terms.
The objective is to determine whether the recorded transaction occurred and whether revenue recognition was appropriate.
The auditor must evaluate the evidence rather than simply verify that documents exist.
Example: Internal control testing
An auditor inspects a purchasing transaction for evidence that an authorized employee approved the purchase before the commitment was made.
The evidence may include an electronic approval record showing the approver, approval date, and transaction details.
However, the auditor should also determine whether the approval record is reliable and whether the approver had appropriate authority.
Strengths of inspection
Inspection can provide documentary evidence supporting the existence, occurrence, authorization, valuation, or other characteristics of transactions and balances.
It also creates an identifiable record that can be retained or referenced in audit documentation.
Limitations of inspection
A document may be inaccurate, incomplete, altered, or fraudulent.
Management-generated reports may contain errors.
A signed approval may be a formality rather than evidence of a meaningful review.
Physical inspection of an asset generally provides evidence about existence, but not necessarily ownership or valuation.
Key audit lesson
The existence of a document does not establish the validity of the transaction it describes.
Auditors must evaluate the source, authenticity, completeness, and relevance of the inspected information.
3. Observation: Watching a Process or Control Being Performed
PCAOB AS 1105.16 describes observation as watching a process or procedure performed by others.
Observation can be particularly useful when evaluating how employees perform operational or control activities.
Examples of observation
Auditors may observe:
Physical inventory counts.
Cash handling.
Warehouse receiving procedures.
Segregation of duties.
Supervisory reviews.
Access-control procedures.
Security activities.
Manufacturing processes.
Selected compliance procedures.
Example: Inventory counting
An auditor attends a company's physical inventory count.
The auditor observes whether employees follow the established count instructions, properly identify inventory, and investigate count differences.
The auditor may also perform independent test counts.
The distinction matters.
Watching employees count inventory is observation.
Independently counting selected items is a separate audit procedure.
Both may be necessary.
Example: Cash handling
An internal auditor observes how a cashier receives cash, records transactions, secures funds, and transfers collections for deposit.
The auditor may identify weaknesses involving custody, recording, or segregation of duties.
However, the auditor must consider whether the process observed reflects normal operations.
Strengths of observation
Observation allows the auditor to see how procedures are performed rather than relying exclusively on descriptions.
It may reveal undocumented practices, workarounds, or control weaknesses.
Limitations of observation
Observation provides evidence primarily about what occurs at the time of observation.
Employees may change their behavior because an auditor is watching.
A properly performed procedure on one occasion does not establish that it operated effectively throughout the audit period.
Key audit lesson
Observing a control once is not equivalent to demonstrating its operating effectiveness throughout the year.
Auditors may need additional evidence from inspection, inquiry, reperformance, or testing across the relevant period.
4. Inquiry: Obtaining Information From Knowledgeable Individuals
PCAOB AS 1105.17 describes inquiry as seeking information from knowledgeable persons inside or outside the organization.
Inquiry can be formal or informal and may involve written or oral communications.
It is an important technique for understanding business processes, identifying risks, and investigating unusual transactions.
Examples of inquiry
Auditors may interview:
Chief financial officers.
Controllers.
Internal auditors.
Information technology personnel.
Procurement managers.
Warehouse employees.
Human resources personnel.
Compliance officers.
Audit Committee members.
External specialists.
Example: Understanding journal entry controls
An auditor asks the controller: “Who can post manual journal entries, and what independent review occurs before or after posting?”
The controller explains that all manual journal entries require approval.
That response is useful information.
However, it does not establish that the approval control actually operated effectively.
The auditor should obtain corroborating evidence, such as system access records, approval logs, and selected journal entries.
Example: Fraud risk assessment
An auditor asks management about known or suspected fraud, unusual transactions, related-party relationships, and incentives that may create financial reporting risks.
The auditor should consider the responses alongside other information, including contradictory evidence.
Strengths of inquiry
Inquiry helps auditors understand processes, identify risks, explain anomalies, and determine where additional testing is needed.
Experienced auditors use carefully structured questions to identify inconsistencies and gaps in management's explanations.
Limitations of inquiry
Individuals may misunderstand questions, have incomplete knowledge, or provide inaccurate information.
Some may intentionally conceal facts.
Management explanations may be influenced by incentives or conflicts of interest.
PCAOB AS 1105 expressly states that inquiry of company personnel, by itself, does not provide sufficient evidence to reduce audit risk to an appropriately low level for a relevant assertion or support a conclusion about a control's effectiveness.
Key audit lesson
Inquiry tells the auditor what people say happens. Other procedures are generally needed to determine what actually happened.
5. Confirmation: Obtaining Evidence Directly From External Parties
Confirmation is a procedure for obtaining audit evidence directly from a knowledgeable external source.
PCAOB AS 1105.18 addresses confirmation responses, while AS 2310, The Auditor's Use of Confirmation, establishes detailed requirements for the confirmation process.
The updated AS 2310 applies to audits of financial statements for fiscal years ending on or after June 15, 2025.
Common confirmation applications
Auditors may confirm:
Bank balances and arrangements.
Accounts receivable balances.
Loan balances and terms.
Debt arrangements.
Selected contractual provisions.
Other financial information held by knowledgeable external parties.
Example: Accounts receivable
A company reports that a customer owes $750,000.
The auditor sends a confirmation request directly to the customer.
The customer responds directly to the auditor, confirming the balance or identifying a difference.
The auditor evaluates the response and investigates exceptions.
Example: Bank confirmation
An auditor obtains confirmation from a financial institution concerning a company's bank balances and relevant financial arrangements.
The confirmation provides evidence from an external source.
However, the auditor must still evaluate whether the confirmation addresses the relevant assertions and whether additional procedures are necessary.
Strengths of confirmation
Evidence obtained directly from a knowledgeable independent external source is generally more reliable than information obtained solely from management.
Confirmation can provide persuasive evidence about specific balances, terms, and arrangements.
Limitations of confirmation
A confirming party may misunderstand the request or provide incomplete information.
A response may be intercepted, altered, or fraudulently prepared.
Nonresponses require appropriate follow-up and evaluation.
A confirmation of a recorded balance does not necessarily establish completeness of all transactions or arrangements.
Important AS 2310 requirements
Under the modernized confirmation standard, auditors must maintain control over the confirmation process and evaluate the reliability of responses.
The standard includes specific considerations for cash, accounts receivable, and terms of certain transactions.
For accounts receivable, the standard generally requires confirmation procedures, subject to specified exceptions and related requirements.
Negative confirmation requests are not permitted as confirmation procedures under the updated AS 2310.
Auditors must apply the current requirements rather than relying on obsolete confirmation practices.
Key audit lesson
External confirmation can provide highly persuasive evidence, but the auditor must control the process and evaluate what the response actually establishes.
6. Comparing the Four Audit Evidence Techniques
Technique | What the auditor does | Principal strength | Principal limitation |
Inspection | Examines records, documents, or assets | Direct examination of supporting information | Documents may be unreliable or incomplete |
Observation | Watches others perform procedures | Reveals how processes operate | Evidence is limited to observed circumstances |
Inquiry | Asks knowledgeable individuals questions | Develops understanding and identifies risks | Responses require corroboration |
Confirmation | Obtains direct written responses from external parties | Potentially persuasive independent evidence | Nonresponses, authenticity, and scope limitations |
No single technique is always sufficient.
The appropriate combination depends on the audit objective and assessed risks.
7. Matching Audit Procedures to Financial Statement Assertions
The auditor should first identify the assertion being tested.
Financial statement assertion | Relevant evidence techniques | Example |
Existence or occurrence | Inspection, confirmation, observation | Confirm receivables or inspect inventory |
Completeness | Inspection, inquiry, targeted external evidence | Trace shipping records to recorded sales |
Valuation or allocation | Inspection, confirmation, recalculation | Examine aging data and subsequent collections |
Rights and obligations | Inspection, confirmation | Examine ownership documents and debt agreements |
Presentation and disclosure | Inspection, inquiry, confirmation where relevant | Examine agreements and disclosure support |
The procedures listed are illustrative rather than exhaustive.
For example, inspecting an inventory item may establish physical existence, but it does not necessarily establish that the company owns it or that it is properly valued.
Similarly, confirming accounts receivable may support existence but does not necessarily establish that revenue was recognized in the correct period.
Auditors must design procedures around assertions—not merely around available documents.
8. Combining Evidence Techniques: A Practical Revenue Audit Example
Assume an auditor is examining a company that reports $50 million in annual revenue.
The auditor identifies risks involving fictitious sales, premature revenue recognition, and management override.
A well-designed audit response may combine several techniques.
Inspection
Examine selected contracts, customer orders, invoices, shipping records, and accounting entries.
Determine whether recorded transactions are supported and whether revenue recognition complies with the applicable accounting framework.
Observation
Observe relevant order-processing or shipping procedures where appropriate.
Determine whether employees follow established processes.
Inquiry
Interview sales management, accounting personnel, and operations employees.
Investigate unusual transactions, changes in business practices, and period-end sales activity.
Confirmation
Obtain direct confirmation evidence from selected customers when appropriate under AS 2310.
Investigate discrepancies and nonresponses in accordance with the standard.
Additional procedures
Perform recalculation, reperformance, analytical procedures, and other substantive tests as necessary.
Why this approach works
Each technique addresses different aspects of the audit risk.
Inquiry helps identify what management believes or represents.
Inspection provides documentary support.
Observation helps evaluate processes.
Confirmation obtains evidence from knowledgeable external parties.
Additional procedures address assertions that these techniques may not sufficiently cover.
The auditor must evaluate the combined evidence and resolve material inconsistencies.
9. The Difference Between Evidence and Corroboration
One of the most important audit concepts is corroboration.
Suppose management states that a major customer has agreed to extend payment terms.
The auditor might obtain:
Management's explanation.
A copy of the amended agreement.
Correspondence with the customer.
Direct confirmation of the amended terms.
The evidence becomes more persuasive when reliable, independent sources support the same conclusion.
However, auditors must be alert to apparent corroboration that actually originates from the same source.
For example, three internal management reports may all rely on the same inaccurate underlying data.
They are not necessarily three independent sources of evidence.
Corroboration requires evaluating the independence and reliability of the underlying sources, not simply counting documents.
10. Evaluating Contradictory Audit Evidence
PCAOB AS 1105 recognizes that audit evidence includes information that supports management's assertions and information that contradicts them.
This distinction is critical.
Auditors should not design procedures solely to confirm management's explanations.
Example
Management states that all significant supplier payments are properly authorized.
The auditor inspects selected payment records and identifies transactions lacking required approvals.
Management explains that the transactions were exceptions handled outside the normal process.
The auditor should investigate the explanation and determine whether the exceptions indicate a control deficiency, broader pattern, or fraud risk.
The auditor should not dismiss contradictory evidence simply because management provides a plausible explanation.
AS 1105.29 requires auditors to perform procedures necessary to resolve inconsistencies or doubts about evidence reliability and consider their implications for other aspects of the audit.
11. Electronic Evidence and the Reliability of Information
Modern audits increasingly rely on electronic records, automated reports, and information obtained through technology platforms.
Examples include:
ERP transaction reports.
Electronic approval workflows.
Digital contracts.
Online banking information.
Electronic confirmation platforms.
System access logs.
Automated exception reports.
Electronic information is not automatically reliable because it comes from a sophisticated system.
Auditors must consider whether the information is complete, accurate, and protected against inappropriate modification.
PCAOB AS 1105.10
When using information produced by the company, auditors must evaluate its accuracy, completeness, and precision for the audit purpose, including applicable controls over the information.
PCAOB AS 1105.10A
The standard also establishes specific requirements for evaluating external information received by the company in electronic form and subsequently provided to the auditor.
This is particularly important when management supplies electronic information that originally came from banks, customers, pricing services, or other external sources.
An external origin does not eliminate the need to evaluate what happened to the information after the company received it.
12. Common Audit Failures Involving These Techniques
Failure 1: Treating inquiry as sufficient evidence
The auditor asks management whether a control operated and accepts the answer without corroboration.
Improvement: Inspect evidence of operation or perform other appropriate procedures.
Failure 2: Inspecting documents without evaluating authenticity
The auditor accepts a contract or invoice without considering whether it is complete, accurate, or potentially altered.
Improvement: Evaluate source reliability and investigate indicators of modification.
Failure 3: Overreliance on observation
The auditor watches a control operate once and concludes it was effective throughout the year.
Improvement: Obtain evidence covering the relevant period.
Failure 4: Losing control of confirmations
The auditor permits management to control confirmation addresses, delivery, or responses without appropriate safeguards.
Improvement: Maintain control over the confirmation process under AS 2310.
Failure 5: Ignoring contradictory evidence
The auditor accepts management's explanation despite inconsistencies in external records.
Improvement: Resolve inconsistencies and reassess the implications for audit risk.
Failure 6: Using evidence that does not address the assertion
The auditor examines invoices to test revenue completeness without addressing whether shipments were omitted from accounting records.
Improvement: Select procedures and populations that directly address the assertion.
Failure 7: Inadequate documentation
The workpaper states that management was interviewed and documents were reviewed but does not identify the procedures, evidence, results, or conclusions.
Improvement: Document the evidence obtained and the reasoning supporting the conclusion.
13. Documentation Requirements Under PCAOB AS 1215
Audit documentation should allow an experienced auditor with no previous connection to the engagement to understand the nature, timing, extent, and results of the procedures performed, the evidence obtained, and the conclusions reached.
For these four techniques, documentation should ordinarily identify:
Procedure | Documentation considerations |
Inspection | Documents examined, identifying characteristics, assertions tested, exceptions, conclusions |
Observation | Process observed, date, personnel, conditions, deviations, limitations |
Inquiry | Person interviewed, role, date, significant questions and responses, corroboration |
Confirmation | Requests, control over transmission, responses, exceptions, follow-up, conclusions |
Documentation should also explain how contradictory information was resolved.
A statement such as “reviewed and appears reasonable” is not a substitute for a clear audit conclusion supported by evidence.
14. Using AI to Improve Audit Evidence Procedures
Artificial intelligence can assist auditors with planning, analyzing, and documenting evidence-gathering procedures.
However, AI-generated information does not automatically constitute reliable audit evidence.
Auditors must validate outputs and maintain responsibility for audit judgments.
AI example 1: Inspection planning
Prompt: “Develop a document inspection program for testing revenue occurrence under PCAOB AS 1105. Identify the relevant assertions, supporting records, potential fraud indicators, and additional procedures needed when evidence is inconsistent.”
AI example 2: Observation checklist
Prompt: “Create an observation checklist for a physical inventory count. Address count instructions, inventory movement, damaged goods, independent test counts, and the limitations of observation.”
AI example 3: Inquiry questions
Prompt: “Develop 20 open-ended interview questions for the controller concerning manual journal entries, management override, unusual adjustments, and segregation of duties. Identify evidence needed to corroborate significant responses.”
AI example 4: Confirmation planning
Prompt: “Develop an audit confirmation planning checklist consistent with PCAOB AS 2310. Address confirming-party reliability, maintaining auditor control, response evaluation, exceptions, nonresponses, and alternative procedures.”
AI example 5: Evidence evaluation
Prompt: “Review this audit evidence summary. Identify which assertions are supported, which conclusions rely only on management inquiry, where evidence is contradictory, and what additional procedures may be necessary.”
Client information should be handled only through approved systems, and AI outputs must be independently evaluated.
15. A Practical Evidence Quality Review Checklist
Before completing an audit procedure, the auditor should consider:
Does the evidence directly address the relevant assertion?
Is the source knowledgeable and reliable?
Was the evidence obtained directly or indirectly?
Has the completeness and accuracy of company-produced information been evaluated?
Does the evidence cover the appropriate period?
Are there inconsistencies requiring investigation?
Has management's explanation been independently corroborated?
Are additional procedures necessary?
Is the evidence sufficient given the assessed risk?
Does the documentation clearly support the conclusion?
These questions help distinguish meaningful audit evidence from the mere completion of an audit checklist.
Improve Audit Evidence Skills With Corporate Compliance Seminars
Corporate Compliance Seminars provides continuing professional education designed to strengthen the practical skills of external auditors, internal auditors, accounting professionals, and audit managers.
Relevant CCS training programs include:
PCAOB AS 1105 — Audit Evidence
Understand the sufficiency, appropriateness, relevance, and reliability of audit evidence.
PCAOB AS 2310 — The Auditor's Use of Confirmation
Learn the requirements for obtaining and evaluating evidence from knowledgeable external sources.
PCAOB AS 2315 — Audit Sampling
Develop effective approaches to selecting, testing, and evaluating representative samples.
PCAOB AS 2301 — Responses to Risks of Material Misstatement
Design audit procedures that respond appropriately to identified financial reporting risks.
PCAOB AS 1215 — Audit Documentation
Improve workpaper quality and the documentation of evidence and audit conclusions.
Audit & Assurance Staff Development
Build the practical audit tradecraft needed to perform inspections, observations, inquiries, confirmations, and other audit procedures effectively.
CCS also provides customized training for accounting firms, internal audit departments, financial institutions, and other organizations seeking to improve audit quality.
Conclusion: The Right Evidence Matters More Than the Number of Procedures
Inspection, observation, inquiry, and confirmation are foundational audit techniques.
But each has limitations.
Inspection may establish that documents exist without proving that the underlying transactions are valid.
Observation may demonstrate that a control operates at one moment without establishing effectiveness throughout the year.
Inquiry provides valuable information but generally requires corroboration.
Confirmation may provide persuasive independent evidence but must be properly designed, controlled, and evaluated.
Effective auditors understand these differences.
They select procedures based on the assertions being tested, evaluate the reliability of the evidence, investigate contradictory information, and document conclusions supported by sufficient appropriate evidence.
Audit quality is not measured by how many documents were inspected, how many questions were asked, or how many confirmations were sent.
It is measured by whether the auditor obtained reliable evidence sufficient to support the audit conclusion.
That is the essential discipline behind PCAOB AS 1105—and the foundation of effective audit execution.
Corporate Compliance Seminars — Practical Continuing Professional Education for External Auditors, Internal Auditors, and Accounting Professionals.
Comments