PCAOB AS 1105 Audit Evidence: A Practical Guide for Auditors
Understanding the Foundation of a High-Quality PCAOB Audit
Audit evidence is the foundation of every audit opinion.
An auditor may develop a comprehensive audit plan, identify significant risks, document internal controls, and perform numerous audit procedures. However, the audit cannot support an appropriate opinion unless the auditor obtains sufficient appropriate audit evidence.
For registered public accounting firms auditing issuers, the Public Company Accounting Oversight Board (PCAOB) establishes requirements concerning audit evidence through AS 1105, Audit Evidence.
AS 1105 addresses what constitutes audit evidence, the relationship between evidence quantity and quality, the reliability of different sources, and the auditor's responsibility to evaluate information used in reaching conclusions.
The standard is fundamental to nearly every phase of an audit.
The central principle is straightforward: auditors must obtain sufficient appropriate audit evidence to provide a reasonable basis for their audit opinion.
The challenge lies in determining what evidence is sufficient, whether it is reliable, and whether it actually supports the relevant financial statement assertions.
1. What Is Audit Evidence Under PCAOB AS 1105?
Audit evidence consists of information used by the auditor in arriving at the conclusions on which the audit opinion is based.
Evidence includes information contained in the accounting records underlying the financial statements and other information obtained during the audit.
Examples include:
General ledger transactions and account balances.
Contracts and agreements.
Bank statements and confirmations.
Customer invoices and purchase orders.
Shipping and receiving documentation.
Inventory count records.
Board meeting minutes.
External valuation information.
Management calculations and accounting estimates.
Electronic records and system-generated reports.
Audit evidence may be obtained through risk assessment procedures, tests of controls, and substantive procedures.
It may also include information obtained during previous audits when relevant and appropriate under applicable standards.
Importantly, evidence includes information that corroborates management's assertions and information that contradicts them.
Auditors must evaluate both.
2. Sufficiency vs. Appropriateness of Audit Evidence
Two concepts are central to AS 1105.
Sufficiency: The Quantity of Evidence
Sufficiency refers to the amount of audit evidence obtained.
The quantity needed depends on factors such as:
The assessed risks of material misstatement.
The significance of the financial statement assertion.
The quality of available evidence.
The effectiveness of relevant internal controls.
The nature of the audit procedures performed.
Higher assessed risks generally require more persuasive evidence.
However, obtaining more evidence does not automatically improve audit quality.
Appropriateness: The Quality of Evidence
Appropriateness refers to the quality of evidence, particularly its relevance and reliability.
Evidence is relevant when it relates to the assertion or audit objective being tested.
Evidence is reliable when its source and nature provide an appropriate basis for reliance.
A large volume of unreliable evidence cannot compensate for inadequate evidence quality.
For example, reviewing 100 internally prepared schedules does not necessarily provide stronger evidence than obtaining a reliable independent confirmation directly from a third party.
The auditor must evaluate the circumstances.
3. Relevance: Does the Evidence Address the Assertion?
Evidence must be relevant to the financial statement assertion being evaluated.
An audit procedure may produce accurate information but still fail to address the intended assertion.
Consider accounts receivable.
If an auditor selects recorded customer balances and examines supporting invoices, the procedure may help evaluate whether recorded receivables exist.
However, that procedure does not necessarily establish whether all receivables that should have been recorded were included.
The direction of testing matters.
Financial statement assertion | Example audit procedure |
Existence | Confirm selected recorded receivables with customers |
Completeness | Trace relevant source records to the accounting records |
Valuation | Evaluate aging, collections, and allowance assumptions |
Rights and obligations | Examine agreements and relevant contractual terms |
Presentation and disclosure | Compare financial statement disclosures with applicable reporting requirements |
A procedure must be designed to address the specific assertion and assessed risk.
Performing an audit procedure is not the same as obtaining relevant evidence.
4. Reliability: Can the Auditor Depend on the Information?
AS 1105 explains that the reliability of audit evidence depends on its source, nature, and the circumstances under which it is obtained.
Important considerations include:
Independent external sources: Evidence from knowledgeable independent sources outside the company is generally more reliable than evidence generated internally.
Effective internal controls: Internally generated evidence is more reliable when the company's relevant controls operate effectively.
Direct auditor knowledge: Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly or by inference.
Documentary evidence: Evidence in documentary form is generally more reliable than oral representations.
Original documents: Original documents are generally more reliable than photocopies or facsimiles, although the reliability of electronic and reproduced documents depends on relevant controls and circumstances.
These are general principles rather than absolute rules.
For example, a document that appears to originate from an external party may be unreliable if management altered it before providing it to the auditor.
Auditors must evaluate the actual source and integrity of the information.
5. Audit Evidence Obtained From External Sources
External evidence can be particularly persuasive when obtained directly by the auditor from an independent source.
Examples include:
Bank confirmations.
Customer confirmations.
Lender confirmations.
Independent custodian statements.
Certain third-party contractual records.
Information obtained directly from external service providers.
However, external origin alone does not guarantee reliability.
The auditor should consider the source's competence, independence, authenticity, and the means by which the evidence was obtained.
When external information is provided through management, additional evaluation may be necessary to determine whether it is complete and unaltered.
6. Information Produced by the Company
One of the most important practical areas under AS 1105 concerns information produced by the company and used as audit evidence.
Auditors frequently rely on reports generated from accounting systems, spreadsheets, databases, and other company information systems.
Examples include:
Accounts receivable aging reports.
Inventory listings.
Fixed asset registers.
Payroll reports.
Sales transaction reports.
Accounts payable listings.
Journal entry populations.
System access reports.
When using company-produced information, the auditor must evaluate whether the information is sufficiently reliable for the audit's purposes.
This includes obtaining evidence concerning its accuracy and completeness, either directly or through testing relevant controls, and evaluating whether it is sufficiently precise and detailed for the audit purpose.
Practical Example: Accounts Receivable Aging
Suppose an auditor uses an accounts receivable aging report to evaluate the allowance for credit losses.
The auditor should consider:
Does the report include the complete relevant receivables population?
Are balances accurately extracted from the accounting system?
Are aging categories calculated correctly?
Does the report reconcile to the general ledger?
Is the report sufficiently detailed for the planned procedures?
Are relevant report parameters and dates appropriate?
An aging report that is incomplete or incorrectly calculated may undermine the audit conclusion even if the auditor performs extensive analysis of its contents.
7. Electronic Audit Evidence
Much of today's audit evidence exists electronically.
Examples include:
Enterprise resource planning system records.
Cloud accounting reports.
Electronic contracts.
Database extracts.
Digital confirmations.
System audit logs.
Electronic payment records.
Electronic evidence introduces considerations involving access controls, data integrity, system configuration, and report generation.
Auditors may need to evaluate:
Whether data originated from the expected system.
Whether information was altered during extraction.
Whether the relevant population is complete.
Whether report parameters are appropriate.
Whether relevant information technology controls affect reliability.
Whether the evidence can be retained and reproduced.
A spreadsheet exported from a system is not automatically reliable merely because it came from the company's accounting software.
The auditor must evaluate whether the information supports the intended audit purpose.
8. Audit Evidence and Risk Assessment
AS 1105 operates together with the PCAOB's risk assessment standards.
Under AS 2110, auditors identify and assess risks of material misstatement.
Under AS 2301, auditors design and perform procedures responsive to those assessed risks.
AS 1105 addresses the evidence obtained through those procedures.
The relationship can be summarized as follows:
Identify Risk → Determine Relevant Assertion → Design Audit Procedure → Obtain Evidence → Evaluate Sufficiency and Appropriateness
For example, if revenue recognition is identified as a significant risk, the auditor should design procedures that obtain persuasive evidence relevant to the identified risks and assertions.
Simply increasing the number of revenue transactions tested may not be sufficient if the procedures do not address the actual risk.
9. Inspection of Records and Documents
Inspection involves examining records or documents, whether internal or external, in paper or electronic form.
Examples include:
Reviewing executed contracts.
Examining invoices.
Inspecting loan agreements.
Reviewing purchase orders.
Examining bank statements.
Inspection may provide evidence concerning authorization, terms, rights, obligations, or transaction occurrence.
However, the auditor must determine what the inspected document actually establishes.
An approved invoice, for example, does not necessarily prove that goods were received or that the transaction had a legitimate business purpose.
10. Observation
Observation involves watching a process or procedure performed by others.
A common example is observing a company's physical inventory count.
Observation can provide evidence about how a procedure is performed at a particular time.
However, observation has limitations.
Employees may perform a procedure differently when they know they are being observed.
Observation also generally does not establish that the procedure operated consistently throughout the audit period.
Additional testing may be necessary.
11. External Confirmation
External confirmation involves obtaining a direct written response from a third party.
Common applications include:
Accounts receivable balances.
Bank balances.
Certain debt arrangements.
Contractual terms.
Other information held by knowledgeable third parties.
PCAOB AS 2310, The Auditor's Use of Confirmation, provides specific requirements for confirmation procedures.
Auditors must maintain appropriate control over the confirmation process and evaluate responses and exceptions.
A confirmation response should be assessed in light of its authenticity, reliability, and relevance to the assertion.
12. Recalculation and Reperformance
Recalculation
Recalculation involves checking the mathematical accuracy of documents or records.
Examples include:
Recalculating depreciation.
Verifying interest expense.
Checking invoice extensions.
Recomputing payroll amounts.
Reperformance
Reperformance involves independently executing procedures or controls originally performed by the company.
Examples include:
Reperforming a bank reconciliation.
Reperforming selected control calculations.
Independently executing an approval or matching procedure where feasible.
These procedures may provide persuasive evidence because the auditor obtains direct knowledge of the result.
However, they must still be relevant to the identified assertion or control objective.
13. Analytical Procedures
Analytical procedures evaluate relationships among financial and nonfinancial information.
Examples include:
Comparing revenue trends with unit sales.
Analyzing gross margin changes.
Comparing payroll expense with staffing levels.
Evaluating interest expense against debt balances.
Comparing inventory turnover across periods.
Analytical procedures can identify unexpected relationships that warrant investigation.
However, identifying a plausible explanation for a variance does not necessarily provide sufficient evidence.
Auditors should evaluate the reliability of underlying data and obtain appropriate corroboration when required.
PCAOB AS 2305 establishes requirements for substantive analytical procedures.
14. Inquiry and Management Representations
Inquiry involves seeking information from knowledgeable individuals inside or outside the company.
It can help auditors understand processes, identify risks, and investigate unusual matters.
However, inquiry alone ordinarily does not provide sufficient appropriate evidence for an assertion requiring further support.
For example, management may state that all outstanding liabilities have been recorded.
The auditor should not rely exclusively on that statement.
Appropriate procedures may include examining subsequent disbursements, vendor statements, and other relevant records.
Written management representations are addressed by PCAOB AS 2805.
Such representations are important but do not replace other necessary audit evidence.
15. Contradictory Audit Evidence
Auditors must consider evidence that contradicts management's assertions or other audit evidence.
Examples include:
A customer disputing a recorded receivable.
Inventory records inconsistent with physical counts.
Contract terms conflicting with management's accounting treatment.
Subsequent events indicating an estimate may have been unreasonable.
Documents inconsistent with management explanations.
When evidence is inconsistent, the auditor should investigate the discrepancy and determine its implications for the audit.
The auditor should not simply select the evidence that supports the desired conclusion.
Contradictory evidence may be more important than a large volume of corroborating information.
16. Using Specialists and External Information
Some audit areas require specialized knowledge.
Examples include:
Complex financial instruments.
Business valuations.
Actuarial estimates.
Environmental liabilities.
Certain information technology matters.
Auditors may use the work of specialists or information from external sources, subject to applicable PCAOB requirements.
The auditor remains responsible for evaluating whether the evidence is appropriate for the audit purpose.
Specialist involvement does not automatically establish that an estimate or conclusion is reasonable.
The auditor must perform the procedures required by the applicable standards.
17. Using Artificial Intelligence in Audit Evidence Evaluation
Artificial intelligence and advanced analytics can help auditors identify unusual transactions, compare documents, and analyze large datasets.
Potential applications include:
Identifying unusual journal entries.
Detecting duplicate payments.
Comparing contract terms.
Reviewing large transaction populations.
Identifying inconsistent accounting descriptions.
Analyzing changes in account relationships.
However, AI-generated summaries, risk scores, and classifications are not automatically reliable audit evidence.
Auditors should evaluate the underlying information, the reliability of the technology, and whether the outputs are sufficiently accurate and complete for the intended use.
The use of AI does not eliminate the auditor's responsibility to obtain sufficient appropriate audit evidence.
18. Common PCAOB Audit Evidence Deficiencies
Common problems include:
Relying on inquiry without adequate corroboration.
Using company-produced reports without testing reliability.
Failing to test the completeness of transaction populations.
Performing procedures unrelated to the relevant assertions.
Relying on internally generated documents without evaluating relevant controls.
Failing to investigate contradictory evidence.
Using analytical procedures without sufficiently reliable data.
Failing to evaluate confirmation exceptions.
Accepting management estimates without adequate testing.
Concluding that evidence is sufficient based primarily on sample size.
These weaknesses can result in audit conclusions that are not adequately supported.
19. Practical Audit Evidence Example: Revenue Recognition
Assume an issuer reports $85 million in annual revenue.
The auditor identifies a risk that revenue may have been recognized before the applicable recognition criteria were satisfied.
A weak audit approach might involve selecting invoices and verifying that amounts agree to the general ledger.
Although this provides some evidence, it may not adequately address premature revenue recognition.
A stronger approach may include:
Understanding the relevant revenue arrangements.
Identifying the applicable financial statement assertions.
Examining contracts and performance obligations.
Inspecting relevant shipping, delivery, or service completion evidence.
Evaluating transaction cutoff near period-end.
Testing the completeness and accuracy of relevant reports.
Investigating unusual or contradictory information.
Evaluating whether the combined evidence supports the revenue conclusion.
The audit procedures should respond to the specific risk, not simply produce a larger volume of documentation.
20. Audit Documentation and Evidence
PCAOB AS 1215, Audit Documentation, establishes requirements for documenting audit work.
Audit documentation should enable an experienced auditor, having no previous connection with the engagement, to understand the nature, timing, extent, and results of the procedures performed, the evidence obtained, and the conclusions reached.
Documentation should identify significant findings or issues and how they were addressed.
The workpapers should demonstrate the connection between:
Assessed risks.
Relevant assertions.
Procedures performed.
Evidence obtained.
Exceptions identified.
Conclusions reached.
A workpaper containing a large amount of information is not necessarily a well-supported workpaper.
The documentation must explain why the evidence supports the audit conclusion.
21. A Practical AS 1105 Audit Evidence Checklist
Before concluding on a significant audit area, auditors should consider:
Have we identified the relevant assertion and assessed risk?
Are our procedures responsive to that risk?
Is the evidence relevant to the intended objective?
Is the evidence sufficiently reliable?
Have we evaluated the completeness and accuracy of company-produced information?
Are relevant electronic records and reports reliable?
Have we considered contradictory evidence?
Have significant exceptions been investigated?
Have management explanations been corroborated where necessary?
Does the combined evidence provide a reasonable basis for the conclusion?
Are the procedures, evidence, and conclusions adequately documented?
Would an experienced auditor understand how the conclusion was reached?
These questions can improve audit execution, supervision, and engagement quality review.
The Bottom Line
PCAOB AS 1105 is one of the most important standards governing audit execution.
It requires auditors to focus not only on obtaining evidence, but also on evaluating whether that evidence is relevant, reliable, and sufficient to support the audit opinion.
The standard applies across the audit process, from risk assessment through substantive testing and final evaluation.
Auditors should pay particular attention to company-produced information, electronic records, contradictory evidence, and the relationship between procedures and financial statement assertions.
Audit quality is not measured by the number of documents collected or the number of procedures completed. It is measured by whether the auditor has obtained sufficient appropriate evidence to support the conclusions reached.
For firms preparing for PCAOB inspections, a disciplined approach to audit evidence is essential.
Comments