PCAOB Audit Evidence: If the Evidence Does Not Support the Conclusion, the Audit Has a Problem
PCAOB Audit Evidence CPE — September 17 and November 12, 2026
External auditors can perform extensive planning, hold dozens of meetings, complete hundreds of workpapers and produce an impressive audit file.
But ultimately, a PCAOB-regulated audit comes down to a fundamental question:
Did the auditor obtain sufficient appropriate audit evidence to support the opinion?
That is the objective established by PCAOB Auditing Standard AS 1105 — Audit Evidence. PCAOB defines audit evidence broadly to include information that supports and corroborates management's assertions and information that contradicts those assertions.
That second part deserves attention.
The auditor's job is not to build a file proving management is right.
The auditor's job is to evaluate the evidence.
Corporate Compliance Seminars' PCAOB Audit Evidence program focuses on this foundation of audit quality. Upcoming sessions are:
Thursday, September 17, 2026
Thursday, November 12, 2026
The live webinar provides 2 CPE credits in Auditing and addresses AS 1105 along with AS 1110, AS 1201 and AS 1215, connecting audit evidence with quality control, supervision and audit documentation.
More Evidence Does Not Necessarily Mean Better Evidence
One of the most important concepts in AS 1105 is the distinction between sufficiency and appropriateness.
Sufficiency addresses the quantity of evidence.
Appropriateness addresses its quality—specifically its relevance and reliability.
That distinction creates an important audit-quality principle:
You cannot solve a quality problem merely by collecting more poor-quality evidence.
PCAOB explicitly states that obtaining more of the same type of evidence cannot compensate for poor-quality evidence.
Imagine an auditor receives ten internally generated spreadsheets supporting an account balance.
Ten spreadsheets are certainly more than one.
But if the auditor has not established the reliability of the underlying information, the additional spreadsheets may simply represent more questionable evidence.
The right question isn't:
“How much documentation do we have?”
It is:
“How persuasive is the evidence supporting our conclusion?”
Higher Risk Should Drive More Persuasive Audit Evidence
AS 1105 connects the amount of evidence required to the assessed risk.
As the risk of material misstatement increases, the amount of evidence ordinarily needs to increase. The quality of the evidence also affects how much corroborating evidence is necessary.
The audit logic should therefore look something like:
Risk of Material Misstatement
→ Relevant Assertion
→ Audit Response
→ Evidence Required
→ Evidence Obtained
→ Evaluation
→ Conclusion
This is why an audit program should never become a checklist detached from the risk assessment.
The question is not:
“Did we perform the procedure from last year's audit program?”
The question is:
“Did our procedures produce sufficient appropriate evidence to address the assessed risk?”
Relevance: Does the Evidence Actually Address the Assertion?
Evidence can be reliable and still be irrelevant to the assertion being tested.
AS 1105 explains that relevance depends in part upon the design and timing of the audit procedure and the level of detail necessary to achieve the procedure's objective.
Consider accounts payable.
Testing recorded payables may provide evidence about whether recorded liabilities exist.
But if the audit risk concerns unrecorded liabilities, testing only items already recorded may fail to address the completeness assertion.
The procedure has to fit the assertion.
That sounds basic.
Yet this is exactly where mechanical auditing can fail.
A perfectly executed audit procedure is still inadequate if it addresses the wrong risk.
Reliability: Where Did the Evidence Come From?
AS 1105 also requires auditors to consider the source and nature of audit evidence.
As a general principle, evidence obtained from a knowledgeable source independent of the company is more reliable than evidence obtained only from internal company sources.
Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly.
That gives the auditor a useful hierarchy to consider.
Management tells you something.
That's information.
Management gives you an internally generated report.
Potentially better—but its reliability still needs consideration.
The auditor independently obtains evidence from an appropriate external source.
Potentially stronger.
The auditor independently reperforms the procedure.
Different again.
The point is not that one form of evidence is universally superior.
The point is:
The auditor has to evaluate reliability rather than merely collect documents.
Information Produced by the Company Is a Major Issue
Modern audits depend heavily upon information produced by the company, frequently called IPE.
Management may provide:
Aging reports
Inventory reports
Sales reports
Exception reports
System-generated reconciliations
User-access listings
Journal-entry populations
Spreadsheet analyses
AS 1105 requires auditors using company-produced information as evidence to evaluate whether that information is sufficient and appropriate. That includes procedures addressing its accuracy and completeness and whether it is sufficiently precise and detailed for the audit purpose. The standard also recognizes the relevance of IT general controls and automated application controls.
This creates an important question:
How do we know the report we are auditing from is reliable?
If the auditor selects a beautiful sample from an incomplete population, excellent sample testing does not fix the underlying problem.
Inquiry Is Evidence—but Inquiry Alone Is Not Enough
Auditors obtain enormous amounts of information by asking questions.
That's appropriate.
AS 1105 recognizes inquiry as an audit procedure.
But PCAOB also makes an important point: inquiry of company personnel by itself does not provide sufficient audit evidence to reduce audit risk appropriately for a relevant assertion or support a conclusion about control effectiveness.
This should be burned into the thinking of every developing auditor.
Management says:
“We review that every month.”
The auditor asks:
“Show me.”
Management says:
“The system prevents duplicate payments.”
The auditor asks:
“What evidence demonstrates that?”
Management says:
“That was an isolated exception.”
The auditor asks:
“How did you determine that?”
Management says:
“We corrected the control.”
The auditor asks:
“Can we test the corrective action?”
That is professional skepticism applied to evidence gathering.
Contradictory Evidence Cannot Simply Be Explained Away
This is one of the most important aspects of AS 1105.
Audit evidence includes information that contradicts management's assertions, not merely information supporting them.
Suppose five pieces of evidence support management's explanation.
A sixth contradicts it.
The audit isn't necessarily finished because five beats one.
The auditor needs to understand the contradiction.
AS 1105 addresses circumstances involving inconsistencies in evidence or doubts about reliability.
The auditor should not become an advocate for the conclusion already written in the workpaper.
Instead:
Follow the evidence wherever it leads.
Audit Documentation and Audit Evidence Are Closely Connected
CCS's program appropriately combines AS 1105 with AS 1215 — Audit Documentation. The course focuses on systematic documentation that supports audit conclusions and can withstand review.
A strong workpaper should allow an experienced reviewer to follow the logic:
Risk
→ Assertion
→ Procedure
→ Evidence
→ Results
→ Exceptions
→ Additional Procedures
→ Conclusion
If the reviewer cannot understand why the documented evidence supports the conclusion, there is a problem.
And there is an even more fundamental rule:
Good documentation cannot transform inadequate evidence into adequate evidence.
Better writing cannot rescue bad auditing.
Supervision Is Part of Audit Evidence Quality
CCS also incorporates AS 1201 — Supervision of the Audit Engagement into the program.
That makes sense.
Staff auditors may obtain the evidence, but senior team members need to challenge whether that evidence actually supports the engagement's conclusions.
A good reviewer should ask:
What assertion were we testing?
Why was this procedure selected?
Is this evidence reliable?
Did we validate company-produced information?
Were exceptions appropriately investigated?
Is there contradictory evidence?
Does the conclusion go beyond what the evidence establishes?
Review should not be limited to formatting and whether all the boxes were checked.
Review is an audit-quality control.
AI Makes Evidence Discipline Even More Important
Artificial intelligence introduces another dimension.
Auditors can increasingly use AI to summarize documents, identify relationships, analyze populations, develop questions and assist with documentation.
That can improve productivity.
But AI also makes it easier to produce extremely convincing language that exceeds the underlying evidence.
Imagine giving an AI tool incomplete testing results and asking:
“Write my conclusion.”
It may produce a beautifully written conclusion.
That doesn't mean the evidence supports it.
The auditor should reverse the process.
Provide the appropriately protected information and ask:
“Identify every statement in this proposed conclusion that is not directly supported by the documented evidence.”
Then:
“What contradictory evidence has not been addressed?”
Then:
“What additional evidence would be necessary to support this conclusion?”
That is a much better application of AI to audit quality.
AI should help the auditor challenge evidence, not manufacture certainty.
One of the Best Review Questions: “How Do We Know?”
There is a remarkably powerful audit question:
How do we know?
Management says inventory exists.
How do we know?
Management says the estimate is reasonable.
How do we know?
Management says a control operated.
How do we know?
The audit staff says an exception is isolated.
How do we know?
The workpaper says the account is fairly stated.
How do we know?
Keep asking that question and eventually you arrive at the evidence.
That is the essence of auditing.
Who Should Attend?
CCS designed PCAOB Audit Evidence for auditors, CPA firm personnel and financial professionals seeking stronger skills in gathering, evaluating and documenting evidence for PCAOB-regulated audits. The course is classified at the Basic level, requires no prerequisites or advance preparation, and provides 2 CPE credits in Auditing.
The program covers four interconnected standards:
AS 1105 — Audit Evidence
AS 1110 — Relationship Between Auditing and Quality Control
AS 1201 — Supervision of the Audit Engagement
AS 1215 — Audit Documentation
That combination is useful because audit quality doesn't come from evidence alone.
The evidence needs to be obtained appropriately, evaluated critically, supervised effectively and documented sufficiently.
Two Opportunities to Attend in 2026
CCS offers the program every eight weeks on Thursdays from 1:00 p.m. to 3:00 p.m. Central Time as a Group Internet-Based seminar.
The upcoming sessions are:
Thursday, September 17, 2026
and
Thursday, November 12, 2026
The November session is particularly well timed for CPA firms preparing staff and engagement teams for the approaching year-end audit cycle.
The Bottom Line: The Opinion Is Only as Strong as the Evidence Behind It
Auditing is ultimately an evidence business.
Not documentation volume.
Not hours charged.
Not the number of workpapers.
Not the number of meetings.
Not how professionally the conclusion is written.
The real progression is:
Identify the Risk
→ Understand the Assertion
→ Design the Procedure
→ Obtain the Evidence
→ Evaluate Reliability
→ Investigate Exceptions
→ Consider Contradictory Evidence
→ Reach the Conclusion
→ Document the Reasoning
PCAOB AS 1105 requires sufficient appropriate evidence to provide a reasonable basis for the auditor's opinion.
That makes the fundamental audit-quality question remarkably simple:
If a PCAOB inspector challenged this conclusion tomorrow, could we show them the evidence that supports it?
If the answer is uncertain, the audit team isn't finished.
Comments