Inspection, Observation, Inquiry, and Confirmation as Audit Evidence: A Practical Guide for External and Internal Auditors
How to Select, Evaluate, and Document Four Essential Audit Evidence Techniques Under PCAOB AS 1105
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Audit Evidence | PCAOB AS 1105 | PCAOB AS 2310 | Internal Auditing | Audit Quality
Every auditor must answer one fundamental question before reaching an audit conclusion:
Do I have sufficient, appropriate, and reliable evidence to support what I am reporting?
Whether conducting a financial statement audit, testing internal controls, examining regulatory compliance, or investigating suspected fraud, the auditor's conclusions are only as defensible as the evidence supporting them.
Four of the most frequently used techniques for obtaining audit evidence are:
Inspection — Examining documents, records, information, or physical assets.
Observation — Watching people perform procedures or controls.
Inquiry — Obtaining information from knowledgeable individuals.
Confirmation — Obtaining written responses directly from knowledgeable external parties.
These procedures are specifically addressed in PCAOB Auditing Standard 1105, Audit Evidence.
However, auditors frequently make mistakes when selecting and applying them.
They may accept management explanations without corroboration, inspect documents without evaluating authenticity, observe controls without considering the period covered, or rely on confirmations that do not address the relevant financial statement assertion.
The result can be an audit conclusion that appears reasonable but lacks sufficient supporting evidence.
Effective auditing requires selecting evidence-gathering procedures based on the audit objective, assessed risks, and the reliability of the information obtained.
Corporate Compliance Seminars (CCS) provides continuing professional education programs covering PCAOB auditing standards, audit evidence, internal controls, and the practical skills auditors need to perform effective engagements.
1. Understanding PCAOB AS 1105: Audit Evidence
PCAOB AS 1105 establishes requirements for designing and performing procedures to obtain sufficient appropriate audit evidence.
The standard identifies two essential characteristics of audit evidence.
Sufficiency
Sufficiency refers to the quantity of evidence obtained.
The quantity required depends on the assessed risk and the quality of the evidence.
Higher-risk areas generally require more persuasive evidence.
However, obtaining more evidence of poor quality does not necessarily compensate for its lack of reliability.
Appropriateness
Appropriateness refers to the quality of evidence, including its relevance and reliability.
Evidence must address the particular assertion or control objective being tested.
For example, inspecting a customer invoice may support the recorded amount of a sale.
However, the invoice alone may not establish that the transaction actually occurred or that revenue was recognized in the correct accounting period.
Auditors must understand what each piece of evidence proves—and what it does not prove.
2. Comparing the Four Evidence-Gathering Techniques
Technique | What the auditor does | Example | Important limitation |
Inspection | Examines records, information, or assets | Inspects approved purchase orders | Documents may be incomplete, unreliable, or insufficient for the objective |
Observation | Watches a process being performed | Observes inventory counting | Generally provides evidence only about the time observed |
Inquiry | Asks knowledgeable individuals questions | Interviews the controller about reconciliations | Inquiry alone is insufficient to support certain audit conclusions |
Confirmation | Obtains direct written information from an external party | Confirms a bank balance | A response may not address every relevant assertion |
These techniques are complementary.
An effective audit frequently combines several procedures to obtain sufficiently persuasive evidence.
3. Inspection: Examining Documents, Records, and Assets
Inspection involves examining information in paper, electronic, or other forms, or physically examining an asset.
It is among the most commonly used audit procedures.
External auditors inspect accounting records, contracts, invoices, bank statements, journal entries, and supporting schedules.
Internal auditors inspect policies, approval records, exception reports, contracts, operational records, and evidence of control performance.
Example: Accounts payable testing
An auditor selects a sample of vendor payments.
For each transaction, the auditor examines:
The purchase requisition.
The approved purchase order.
The vendor invoice.
Evidence of receipt of goods or services.
Payment authorization.
The accounting entry.
The objective is to determine whether the transaction complied with the relevant requirements and whether the accounting treatment is supported.
However, the auditor must evaluate the evidence rather than merely confirm that documents exist.
An invoice can exist for goods that were never received.
A purchase order may have been approved after the purchase occurred.
A payment authorization may have been performed by someone without appropriate authority.
Inspection is not simply collecting documents. It is evaluating whether those documents support the audit objective.
4. Inspection of Physical Assets
Inspection can also involve physically examining assets.
Examples include:
Inventory.
Machinery and equipment.
Vehicles.
Cash.
Securities.
Capital assets.
Physical inspection can provide evidence about the existence or condition of an asset.
However, it may not establish ownership, appropriate valuation, or completeness.
Example: Inventory
An auditor physically inspects inventory stored in a warehouse.
The auditor may establish that selected inventory items exist.
However, physical inspection alone may not establish whether the inventory belongs to the company or whether its recorded value is recoverable.
Additional procedures may be necessary.
The auditor should determine which assertions are addressed by physical inspection and which require other evidence.
5. The Reliability of Inspected Documents
Not all documents provide equally reliable evidence.
PCAOB AS 1105 recognizes that evidence obtained from knowledgeable independent external sources is generally more reliable than evidence obtained solely from internal company sources.
Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly.
The reliability of electronic documents also depends on the circumstances in which they are created, received, maintained, and processed.
Example: Bank statement
Management provides the auditor with a PDF bank statement.
The document appears authentic.
However, the auditor should consider whether the document has been modified or whether other circumstances raise questions about its reliability.
Depending on the audit objective and assessed risk, the auditor may need evidence obtained directly from the bank.
A common audit mistake
Auditors sometimes assume that a document is reliable because it looks official.
A logo, electronic signature, or professional format does not establish authenticity.
The auditor must evaluate the source and circumstances of the evidence.
6. Observation: Watching Controls and Procedures in Action
Observation involves watching a process or procedure performed by others.
Examples include:
Observing an inventory count.
Watching cash-handling procedures.
Observing access controls.
Watching the processing of vendor invoices.
Observing a physical security procedure.
Watching a supervisory review.
Observation can help auditors understand how a process operates.
It can also provide evidence that a particular procedure was performed.
However, observation has two significant limitations.
First, it generally provides evidence only about the point in time observed.
Second, employees may behave differently when they know they are being observed.
Example: Cash handling
An internal auditor observes a cashier balancing the cash drawer at the end of the day.
The cashier follows the required procedures.
Does this establish that the control operated effectively throughout the year? No.
It establishes evidence about the procedure observed.
Additional testing may be needed to support conclusions about consistent operation over time.
7. Observation of Inventory Counts
Inventory count observation is a particularly important external audit application.
PCAOB AS 2510, Auditing Inventories, addresses the auditor's responsibilities concerning inventory observations.
When inventory quantities are determined through physical counting, the auditor generally needs to obtain appropriate evidence regarding the existence and condition of inventory through observation and other procedures, subject to the standard's requirements.
Practical inventory observation procedures
The auditor may:
Observe management's count instructions.
Evaluate whether counting teams follow established procedures.
Perform independent test counts.
Inspect selected inventory items.
Identify damaged or obsolete inventory.
Evaluate controls over inventory movements.
Consider the completeness and accuracy of count records.
The auditor should distinguish between observing management's procedures and independently testing inventory quantities.
Watching employees count inventory is not necessarily sufficient by itself.
8. Inquiry: Obtaining Information From Knowledgeable Individuals
Inquiry involves seeking information from knowledgeable individuals within or outside the organization.
It can be performed through interviews, written questions, informal discussions, and structured questionnaires.
Inquiry is essential to understanding business processes, identifying risks, investigating exceptions, and evaluating management explanations.
Examples of inquiry
An external auditor asks the CFO about significant accounting estimates.
An internal auditor asks the purchasing manager about vendor approval procedures.
An IT auditor asks a system administrator about privileged access.
A fraud auditor asks an employee about unusual payments.
Inquiry often provides the starting point for additional audit procedures.
However, the auditor must evaluate the reliability of the information obtained.
9. Why Inquiry Alone Is Not Sufficient
PCAOB AS 1105 specifically cautions that inquiry of company personnel alone does not provide sufficient audit evidence to reduce audit risk to an appropriately low level for a relevant assertion or support a conclusion about control effectiveness.
This is one of the most important lessons for auditors.
Example: Bank reconciliations
The auditor asks the controller: "Are all bank accounts reconciled monthly?"
The controller responds: "Yes, every account is reconciled and reviewed."
This response does not establish that the reconciliations occurred.
The auditor should inspect reconciliation records and evidence of review, and perform other appropriate procedures.
Example: Vendor approval
The purchasing manager states: "No vendor can be added without independent approval."
The auditor should examine relevant vendor master file changes, approval evidence, and system access controls.
The inquiry identifies the stated process.
Testing establishes whether the process operated as represented.
Management explanations are evidence to be evaluated—not conclusions to be accepted automatically.
10. Effective Auditor Interviewing Techniques
Inquiry becomes more useful when auditors ask well-designed questions.
A weak question is: "Do you follow the purchasing policy?"
A stronger question is: "Walk me through the last vendor you approved. What information did you review, who authorized the change, and where is the evidence maintained?"
Effective inquiries should be specific, open-ended, and focused on actual transactions or events.
Five practical interviewing techniques
Ask process questions. Understand how work is performed.
Ask for examples. Connect explanations to actual transactions.
Ask about exceptions. Determine what happens when procedures fail.
Ask follow-up questions. Investigate vague or inconsistent responses.
Corroborate explanations. Obtain supporting records or perform additional procedures.
Auditors should also document significant responses accurately and distinguish statements made by personnel from facts independently verified.
11. Confirmation: Obtaining Evidence Directly From External Parties
Confirmation involves obtaining written information directly from a knowledgeable external party in response to an auditor-controlled confirmation request.
Examples include:
Bank balance confirmations.
Accounts receivable confirmations.
Debt confirmations.
Confirmation of contractual terms.
Certain related-party transaction confirmations.
Confirmation can provide persuasive evidence because the information is obtained directly from a source outside the company.
However, the auditor must evaluate the reliability of the response and determine whether it addresses the relevant assertion.
Example: Accounts receivable
A customer confirms that it owes the company $500,000.
This may provide evidence supporting the existence of the receivable.
However, the confirmation does not necessarily establish that the customer will pay the balance.
The auditor may need additional procedures addressing valuation and collectibility.
12. PCAOB AS 2310: The Updated Confirmation Standard
PCAOB AS 2310, The Auditor's Use of Confirmation, establishes requirements for obtaining audit evidence through the confirmation process.
The updated standard became effective for audits of financial statements for fiscal years ending on or after June 15, 2025.
It modernized the PCAOB's requirements for confirmation procedures, including electronic communications and the use of intermediaries.
The standard emphasizes the auditor's responsibility for designing and controlling the confirmation process and evaluating the results.
Important requirements and considerations
Auditors should understand the requirements concerning:
Designing confirmation requests.
Identifying knowledgeable confirming parties.
Maintaining control over confirmation requests and responses.
Evaluating the reliability of responses.
Investigating confirmation exceptions.
Addressing nonresponses and incomplete responses.
Evaluating intermediaries used for electronic confirmations.
Obtaining evidence for cash, accounts receivable, and certain transaction terms.
The updated standard also contains specific requirements concerning cash held by third parties and accounts receivable.
Auditors should use the current AS 2310 rather than relying on outdated confirmation procedures.
13. Maintaining Control Over the Confirmation Process
A confirmation is more reliable when the auditor controls the process.
The auditor should not allow management to control the selection, transmission, or receipt of confirmations in a way that undermines the reliability of the evidence.
Example: Customer confirmation
Management offers to email confirmation requests to customers and forward the responses to the auditor.
This approach raises concerns because management controls the communication channel.
The auditor should follow the applicable requirements for maintaining control over the confirmation process.
Electronic confirmations
Electronic confirmation platforms can improve efficiency.
However, auditors must evaluate whether the process provides appropriate assurance about the identity of the responding party and the integrity of the response.
Technology does not automatically make evidence reliable.
14. Positive and Negative Confirmations
A positive confirmation requests a response from the confirming party.
The party may be asked to verify stated information or provide the requested information directly.
A negative confirmation requests a response only if the confirming party disagrees with the stated information.
The updated PCAOB AS 2310 does not permit the auditor to use negative confirmation requests as a confirmation procedure under the standard.
Auditors should ensure their confirmation methodologies reflect the current requirements.
This is an important area for CPA firms updating older audit programs.
15. What Should Auditors Do When Confirmations Are Not Returned?
A nonresponse does not establish that the recorded amount is correct.
The auditor must determine the appropriate response under AS 2310.
Depending on the circumstances and applicable requirements, this may involve follow-up requests or alternative procedures.
Example: Accounts receivable
A customer does not respond to a confirmation request.
The auditor may examine subsequent cash receipts and related supporting documentation.
However, the auditor must evaluate whether those procedures provide relevant and reliable evidence for the assertion being tested.
A subsequent payment may support the existence of a receivable.
It may not resolve every question concerning the underlying transaction.
The auditor should document the procedures performed and the conclusions reached.
16. Combining Inspection, Observation, Inquiry, and Confirmation
Audit evidence techniques are often most effective when used together.
Consider an auditor evaluating controls over vendor bank account changes.
Inquiry
Interview accounts payable personnel about how vendor banking information is changed.
Inspection
Examine vendor change requests, approval records, and supporting documentation.
Observation
Observe an authorized employee processing a vendor bank account change.
Confirmation
Where appropriate, obtain information directly from the vendor through an independently verified communication channel.
The combined procedures may provide a more complete understanding of the process and stronger evidence concerning the control.
However, each procedure must be designed to address the specific audit objective.
17. A Practical Audit Evidence Matrix
Audit objective | Inspection | Observation | Inquiry | Confirmation |
Verify accounts receivable existence | Sales and shipping records | Limited use | Credit personnel | Customer confirmations |
Evaluate inventory existence | Inventory records and physical items | Inventory count observation | Warehouse personnel | Third-party custodians when relevant |
Test purchase approvals | Purchase orders and approvals | Purchasing process | Purchasing manager | Vendor information when relevant |
Evaluate cash balances | Bank statements and reconciliations | Cash count when relevant | Treasury personnel | Bank confirmations |
Test payroll controls | Payroll records and approvals | Payroll processing | HR and payroll personnel | External evidence where relevant |
Investigate vendor fraud | Vendor files and payment records | Vendor setup process | Employees and vendors | Independently verified vendor communications |
The appropriate combination depends on the engagement objective and assessed risk.
Not every procedure is necessary for every audit objective.
18. The Importance of Financial Statement Assertions
External auditors should connect evidence-gathering procedures to relevant financial statement assertions.
Existence or occurrence
Does the asset exist, or did the transaction occur?
Completeness
Have all required transactions and balances been recorded?
Valuation or allocation
Are amounts recorded appropriately?
Rights and obligations
Does the company have rights to the assets and obligations for the liabilities?
Presentation and disclosure
Are financial statement amounts properly classified, described, and disclosed?
Example
Confirming a bank balance may support existence and certain rights-related matters.
However, the auditor may need other procedures to address completeness of bank accounts, restrictions on cash, and financial statement presentation.
The procedure must be evaluated in relation to the assertion.
19. Evidence Reliability and Company-Generated Information
Auditors increasingly rely on electronic reports, spreadsheets, dashboards, and system extracts.
PCAOB AS 1105 requires auditors to evaluate the accuracy and completeness of company-produced information used as audit evidence, or test relevant controls over that information, and evaluate whether the information is sufficiently precise and detailed.
Example: Accounts receivable aging
An auditor inspects an accounts receivable aging report.
However, the report excludes one division because of a system filter.
The report may be accurate for the transactions included but incomplete for the intended audit purpose.
The auditor should evaluate report parameters, reconcile totals where appropriate, and perform procedures addressing completeness.
An audit procedure performed correctly on unreliable information can still produce an unsupported conclusion.
20. Contradictory Audit Evidence
Auditors sometimes obtain evidence that conflicts with other information.
For example:
Management states that all inventory is owned by the company.
Warehouse records identify certain inventory as consigned goods.
The auditor should investigate the inconsistency.
PCAOB AS 1105 requires auditors to perform procedures necessary to resolve inconsistencies or doubts about reliability and consider their effect on other aspects of the audit.
Auditors should not simply select the evidence that supports their initial conclusion.
Professional skepticism requires evaluating contradictory information.
21. Documentation: Making the Audit Evidence Defensible
PCAOB AS 1215 establishes requirements for audit documentation.
Auditors should document the nature, timing, and extent of procedures performed, the evidence obtained, and the conclusions reached.
Recommended documentation
Procedure | Documentation |
Inspection | Documents examined, selection basis, attributes tested, results |
Observation | Process observed, date, personnel, procedures, observations |
Inquiry | Individuals interviewed, questions, significant responses, corroboration |
Confirmation | Requests, transmission controls, responses, exceptions, follow-up |
Evidence evaluation | Reliability assessment, inconsistencies, conclusions |
Supervisory review | Review evidence and resolution of significant matters |
A statement such as "Discussed with management; no exceptions" is rarely adequate for a significant audit conclusion.
Workpapers should establish what the auditor actually did and what evidence supports the result.
22. Common Audit Evidence Failures
Several mistakes can undermine audit quality.
Accepting inquiry without corroboration. Management explanations are treated as sufficient evidence.
Inspecting documents without evaluating reliability. The auditor assumes that documents are authentic and complete.
Overreliance on observation. The auditor concludes that a control operated throughout the year based on one observation.
Improper confirmation procedures. The auditor does not maintain appropriate control over requests and responses.
Failure to investigate exceptions. Contradictory evidence is dismissed without adequate procedures.
Unreliable populations. Testing is performed on incomplete or inaccurate reports.
Weak documentation. The audit file does not support the procedures or conclusions.
Incorrect assertion coverage. Evidence is obtained but does not address the relevant audit objective.
Auditors should evaluate these risks during engagement planning, supervision, and completion reviews.
23. Using Artificial Intelligence to Improve Audit Evidence Procedures
Artificial intelligence can assist auditors with developing audit programs, reviewing workpapers, and identifying gaps in evidence.
However, AI does not independently establish the authenticity or reliability of audit evidence.
AI prompt: Inspection
Review this audit objective and develop inspection procedures identifying the documents to examine, relevant attributes, reliability considerations, and evidence necessary to support a conclusion.
AI prompt: Observation
Develop an observation checklist for a physical inventory count. Include procedures for evaluating count instructions, control performance, test counts, inventory movements, and documentation.
AI prompt: Inquiry
Develop interview questions for evaluating vendor master file controls. Include open-ended questions, exception scenarios, and recommended corroborating evidence.
AI prompt: Confirmation
Review this proposed confirmation procedure against the applicable requirements of PCAOB AS 2310. Identify concerns involving confirmation design, auditor control, reliability, nonresponses, and documentation.
AI prompt: Evidence sufficiency
Evaluate whether the inspection, observation, inquiry, and confirmation procedures documented in this workpaper adequately address the stated audit objective. Identify unsupported conclusions and additional evidence that may be needed.
Auditors must verify AI-generated suggestions, protect confidential client information, and exercise professional judgment.
24. Audit Evidence Quality Checklist
Before finalizing an audit conclusion, auditors should consider the following questions.
Is the audit objective clearly defined?
Are the relevant financial statement assertions or control objectives identified?
Were appropriate evidence-gathering techniques selected?
Is the evidence relevant to the objective?
Is the evidence sufficiently reliable?
Was the completeness and accuracy of relevant information evaluated?
Were management explanations corroborated where necessary?
Were observation limitations considered?
Were confirmation procedures appropriately controlled?
Were exceptions and contradictory information investigated?
Is the quantity of evidence sufficient for the assessed risk?
Does the evidence support the specific conclusion?
Were the procedures adequately documented?
Did supervisory review address significant judgments?
Are any remaining evidence limitations reflected in the audit conclusion?
This checklist can support external and internal audit quality reviews.
Corporate Compliance Seminars: CPE Training in Audit Evidence
Corporate Compliance Seminars provides practical continuing professional education for external auditors, internal auditors, accounting professionals, and compliance personnel.
CCS programs focus on the technical standards and audit tradecraft skills necessary to perform effective engagements.
Recommended CCS training programs
PCAOB AS 1105 — Audit Evidence
Understand sufficient appropriate evidence, reliability, relevance, audit procedures, and the documentation necessary to support audit conclusions.
PCAOB AS 2310 — The Auditor's Use of Confirmation
Strengthen understanding of confirmation requirements, auditor control over the confirmation process, electronic confirmations, nonresponses, and exceptions.
PCAOB AS 2301 — The Auditor's Responses to the Risks of Material Misstatement
Learn how to connect risk assessment with appropriate tests of controls and substantive audit procedures.
PCAOB AS 2201 — An Audit of ICFR
Develop skills in risk-based control selection, design and operating effectiveness testing, and evaluating control deficiencies.
Internal Auditing Programs
Develop practical skills in interviewing, evidence collection, control testing, risk assessment, audit documentation, and reporting findings.
CCS also offers private group training for organizations seeking to strengthen audit staff capabilities and improve audit quality.
Conclusion: The Right Evidence Matters More Than the Amount of Evidence
Inspection, observation, inquiry, and confirmation are essential tools in the auditor's professional toolkit.
Each technique provides different types of evidence.
Inspection allows auditors to examine records and assets.
Observation allows auditors to watch processes and controls being performed.
Inquiry helps auditors understand activities, judgments, and explanations.
Confirmation provides evidence directly from knowledgeable external parties.
However, none of these procedures automatically establishes that an audit objective has been satisfied.
The auditor must evaluate relevance, reliability, sufficiency, and the relationship between the evidence and the conclusion.
The best auditors do not simply collect evidence. They understand what the evidence proves, recognize what it does not prove, and obtain additional evidence when necessary.
That is the foundation of effective audit tradecraft.
Corporate Compliance Seminars — Practical CPE Training in PCAOB Auditing Standards, Audit Evidence, Internal Auditing, Internal Controls, Fraud Detection, and Audit Quality.
Comments