PCAOB Audit Evidence: The Auditor's Opinion Is Only as Good as the Evidence Behind It

PCAOB Audit Evidence — September 17 and November 12, 2026

Every external audit ultimately comes down to one question:

What evidence supports the auditor's opinion?

An audit program is not evidence.

A completed checklist is not evidence.

Management's explanation is not automatically sufficient evidence.

And a workpaper conclusion saying “No exceptions noted” is only as reliable as the audit evidence and procedures supporting it.

That is why PCAOB AS 1105 — Audit Evidence is one of the foundational standards for auditors performing PCAOB-regulated engagements.

Corporate Compliance Seminars' PCAOB Audit Evidence webinar examines AS 1105 together with related PCAOB requirements concerning audit quality, supervision and documentation. The live program provides 2 CPE credits in Auditing and is offered on:

• Thursday, September 17, 2026

• Thursday, November 12, 2026

What Exactly Is Audit Evidence?

PCAOB AS 1105 defines audit evidence broadly. It includes information obtained through audit procedures and from other sources that the auditor uses in reaching the conclusions underlying the audit opinion.

There is an especially important point in that definition:

Audit evidence includes information that supports management's assertions and information that contradicts them.

That distinction is fundamental to professional skepticism.

The auditor isn't hired to accumulate evidence proving management is correct.

The auditor is responsible for obtaining evidence that provides a reasonable basis for an independent opinion.

Sometimes that evidence supports management.

Sometimes it doesn't.

The auditor must follow the evidence in either direction.

Two Words Every PCAOB Auditor Needs to Understand: Sufficient and Appropriate

AS 1105 requires auditors to obtain sufficient appropriate audit evidence.

Those two words mean different things.

Sufficiency = Quantity

How much evidence does the auditor need?

The answer depends partly on risk. AS 1105 states that as the risk of material misstatement—or risk associated with a control—increases, the amount of evidence ordinarily needed also increases.

That creates an important relationship:

Higher Risk

→ More Persuasive Audit Evidence Required

Appropriateness = Quality

Appropriateness concerns the relevance and reliability of the evidence.

And this produces one of the most important lessons in AS 1105:

More bad evidence does not become good evidence.

The PCAOB specifically notes that obtaining more evidence of the same type cannot compensate for poor-quality evidence.

An auditor could examine 100 pieces of weak evidence and still lack an adequate basis for a conclusion.

Relevance: Does the Evidence Actually Test the Assertion?

Audit evidence must relate to what the auditor is trying to prove.

Consider Accounts Receivable.

Management may assert:

These receivables exist.

The auditor could examine the sales ledger.

But does a company-generated sales ledger independently establish existence?

Not necessarily.

A customer confirmation may provide considerably more relevant evidence concerning whether the receivable actually exists.

Now change the assertion:

All receivables that should have been recorded were recorded.

The confirmation procedure designed primarily to establish existence may not provide the same assurance about completeness.

Same account.

Different assertion.

Different risk.

Potentially different evidence.

That is why strong audit planning follows this chain:

Account

→ Assertion

→ Risk

→ Audit Objective

→ Procedure

→ Evidence

→ Conclusion

AS 1105 states that relevance depends on factors including the design and timing of the audit procedure and the level of detail necessary to achieve its objective.

Reliability: Where Did the Evidence Come From?

Not all evidence deserves equal weight.

AS 1105 provides several useful principles concerning reliability.

In general:

• Independent external evidence is more reliable than evidence obtained solely from internal sources.

• Evidence obtained directly by the auditor is more reliable than evidence obtained indirectly.

• Original documents are generally more reliable than copies, subject to considerations surrounding electronic documents and the controls over them. 

Consider a bank balance.

Management gives the auditor an Excel spreadsheet showing: Bank Balance — $4,732,821

That is evidence.

Now compare it with a confirmation obtained directly from the bank.

That is also evidence.

But the two pieces of evidence do not necessarily have the same reliability.

The auditor should understand the source, independence, controls and circumstances surrounding the evidence.

Management-Produced Information Creates Another Audit Question

Modern audits depend heavily upon information produced by the company.

Examples include:

• Aged receivable reports

• Inventory reports

• Payroll reports

• Journal-entry populations

• Exception reports

• System-generated reconciliations

• Sales reports

• Management dashboards

• Spreadsheets

The temptation is to receive the report and immediately begin testing from it.

But there is a problem:

How does the auditor know the information itself is accurate and complete?

AS 1105 requires the auditor, when using company-produced information as audit evidence, to evaluate whether that information is sufficient and appropriate. This includes testing its accuracy and completeness—or testing controls over accuracy and completeness—and evaluating whether it is sufficiently precise and detailed for the audit purpose.

This is an extremely important issue in modern auditing.

Don't Test a Population Before Establishing That the Population Is Reliable

Suppose the auditor asks management:

“Give us all journal entries posted during the year.”

Management provides 87,432 records.

The auditor selects 50 entries.

Excellent.

But what if the actual population contained 91,205 entries?

The auditor may have performed excellent testing against an incomplete population.

The problem isn't the sample.

The problem is the audit evidence underlying the sample.

Before relying on the population, the auditor needs evidence supporting its completeness and accuracy.

That concept applies throughout the audit:

Obtain Population

→ Establish Reliability

→ Select Items

→ Perform Procedures

→ Evaluate Evidence

→ Reach Conclusion

Skipping the second step can undermine everything that follows.

ITGCs Can Affect the Reliability of Audit Evidence

This becomes particularly important when evidence comes from information systems.

AS 1105 recognizes that company-produced information, and certain electronically provided external information, may be more reliable when controls over that information—including applicable IT general controls and automated application controls—are effective.

That creates an important connection between financial auditing and IT auditing.

Suppose an auditor relies upon an automated report generated by the company's ERP system.

Questions should include:

Who can modify the underlying data?

Who can change the report logic?

Are program changes controlled?

Is access appropriately restricted?

Is the report complete?

Can users alter the information before giving it to the auditor?

The report may look impressive.

That does not establish reliability.

External Electronic Information Also Requires Attention

Electronic audit evidence has become increasingly important.

AS 1105 includes requirements concerning external information that a company provides to the auditor electronically.

The auditor needs to understand the source of the information and the company's process for receiving, maintaining and, where applicable, processing it. The auditor also needs to address whether the company modified the information or test relevant controls.

This matters because: External source

does not necessarily mean: Untouched external evidence.

If information passes through management's systems before reaching the auditor, the auditor needs to understand what happened to it along the way.

Contradictory Evidence Is Where Professional Skepticism Becomes Visible

Suppose management says:

“There are no collectibility problems with this customer.”

Most evidence appears consistent with that statement.

Then the auditor discovers an email saying:

“Customer has stopped making payments and is disputing the invoices.”

That evidence cannot simply be buried in the workpapers because the rest of the audit evidence supports management.

AS 1105 specifically includes contradictory information within the concept of audit evidence.

The auditor needs to ask:

• Why does the evidence conflict?

• Is management's assertion still reasonable?

• Are additional procedures necessary?

• Does the issue affect the risk assessment?

• Does it affect other accounts?

• Could it indicate management bias or fraud?

A mature auditor does not fear contradictory evidence.

The auditor investigates it.

Assertions Give Audit Evidence Its Purpose

AS 1105 identifies financial-statement assertions involving recognition, measurement, presentation and disclosure. These include existence or occurrence and completeness, among others.

Assertions prevent auditors from performing procedures without knowing exactly what those procedures are supposed to establish.

For example:

Inventory

• Existence: Does the inventory actually exist?

• Completeness: Is all inventory that should be recorded included?

• Valuation: Is inventory recorded at an appropriate amount?

• Rights: Does the company own it?

Different assertion.

Different risk.

Different audit procedure.

Different evidence.

That is audit tradecraft.

Evidence Should Drive the Conclusion—not the Other Way Around

One of the greatest behavioral risks in auditing is confirmation bias.

The auditor forms an initial expectation:

“This account looks fine.”

Then the auditor unconsciously gives greater weight to evidence supporting that expectation.

A stronger approach is:

Assertion

→ Risk

→ Procedure

→ Evidence

→ Evaluation

→ Conclusion

Not:

Expected Conclusion

→ Search for Supporting Evidence

This is why professional skepticism is inseparable from audit evidence.

Evidence and Documentation Are Not the Same Thing

There is another distinction auditors need to understand.

Audit evidence supports the auditor's conclusion.

Audit documentation records the procedures performed, evidence obtained and conclusions reached.

CCS's program therefore connects AS 1105 with AS 1215 — Audit Documentation and AS 1201 — Supervision of the Audit Engagement.

The evidence may be excellent.

But if the auditor fails to document what was tested, what evidence was examined and how the conclusion was reached, the audit file may fail to demonstrate the quality of the work performed.

A strong workpaper should allow an experienced auditor to understand:

• What was the audit objective?

• What risk was being addressed?

• What procedure was performed?

• What evidence was obtained?

• What exceptions were identified?

• How were those exceptions resolved?

• What conclusion was reached?

Supervision Is Part of Evidence Quality

The CCS program also examines AS 1201 — Supervision of the Audit Engagement because evidence quality is not solely the responsibility of the staff auditor collecting it.

Senior auditors, managers and engagement partners need to challenge:

Is this the right procedure?

Is this evidence reliable?

Does the evidence actually address the assertion?

Were exceptions adequately investigated?

Is contradictory evidence resolved?

Does the documentation support the conclusion?

That is why workpaper review should be more than checking that every box contains a tick mark.

Effective review challenges the logic of the audit evidence.

AI Creates a New Audit Evidence Problem

Artificial intelligence makes AS 1105 even more relevant.

Auditors increasingly encounter AI-generated:

• Analyses

• Summaries

• Reports

• Predictions

• Exception lists

• Risk assessments

• Management explanations

But an AI-generated output does not become reliable audit evidence simply because it is sophisticated.

The auditor still needs to consider:

• Source

• Accuracy

• Completeness

• Relevance

• Reliability

• Underlying data

• Controls over the system

• Potential modification

• Potential bias

AI can help analyze evidence.

It does not eliminate the auditor's responsibility to determine whether the evidence is appropriate.

Ask the Five Questions

When evaluating an important piece of audit evidence, auditors should develop the habit of asking:

1. What assertion or audit objective does this evidence address?

2. Where did the evidence come from?

3. How do I know it is accurate and complete?

4. What evidence contradicts it?

5. Is this evidence sufficiently persuasive given the risk?

Those five questions can improve audit quality substantially.

Two Opportunities to Attend in 2026

Corporate Compliance Seminars' PCAOB Audit Evidence is a 2-CPE Auditing webinar designed for auditors, CPA-firm personnel and financial professionals working with PCAOB-regulated audits.

Upcoming sessions are:

• Thursday, September 17, 2026

• Thursday, November 12, 2026

The program is presented from 1:00 p.m. to 3:00 p.m. Central Time, is Basic level, requires no prerequisites or advance preparation, and costs $140 per attendee. CCS also offers private sessions for groups of two or more.

The course addresses AS 1105 Audit Evidence, AS 1110, AS 1201 Supervision of the Audit Engagement, and AS 1215 Audit Documentation, connecting evidence gathering with engagement quality, supervision and documentation.

The Bottom Line: Follow the Evidence

The auditor's opinion sits at the end of a long chain:

Financial Statement Assertion

↓

Risk of Material Misstatement

↓

Audit Objective

↓

Audit Procedure

↓

Audit Evidence

↓

Evaluation

↓

Audit Documentation

↓

Audit Conclusion

↓

Audit Opinion

If the evidence in the middle of that chain is weak, the conclusion at the end is weak.

That is why PCAOB AS 1105 deserves more attention than simply memorizing the definitions of sufficiency and appropriateness.

The standard goes to the heart of audit quality:

What do you know, what evidence supports what you know, and is that evidence persuasive enough to support your audit opinion?

Corporate Compliance Seminars' PCAOB Audit Evidence webinar on September 17 and November 12, 2026 provides two focused CPE hours for auditors who want to strengthen that fundamental element of PCAOB audit tradecraft.