Sufficient vs. Appropriate Audit Evidence: What Every Auditor Needs to Understand
Why More Audit Evidence Does Not Always Mean Better Audit Evidence
One of the most important requirements in external auditing is obtaining sufficient appropriate audit evidence.
Under PCAOB AS 1105 — Audit Evidence, auditors must obtain evidence that provides a reasonable basis for their audit opinions.
But sufficiency and appropriateness are not interchangeable concepts.
An auditor might examine hundreds of transactions and still fail to obtain appropriate evidence.
Conversely, a smaller quantity of highly reliable and relevant evidence may provide stronger support for a particular audit conclusion.
Understanding the distinction is essential to effective audit planning, audit execution, and audit quality.
The central question is not simply how much evidence the auditor collected. It is whether the evidence is sufficient in quantity and appropriate in quality to support the conclusion.
1. What Is Sufficient Audit Evidence?
Sufficiency refers to the quantity of audit evidence.
The amount of evidence needed depends on the assessed risk of material misstatement and the quality of the evidence obtained.
Generally, higher-risk areas require more persuasive audit evidence.
For example, an auditor evaluating a routine prepaid insurance balance may need a different extent of testing than an auditor examining revenue recognition involving complex contracts and significant management judgment.
Factors affecting sufficiency include:
The assessed risk of material misstatement.
The significance of the account or disclosure.
The characteristics of the population being tested.
The effectiveness of relevant internal controls.
The nature of the audit procedure.
The reliability of the evidence.
Exceptions or contradictory information identified.
Sufficiency is not determined by applying the same sample size to every audit area.
There is no universal rule that testing 25 transactions automatically produces sufficient evidence.
2. What Is Appropriate Audit Evidence?
Appropriateness refers to the quality of audit evidence.
Under AS 1105, the quality of evidence depends principally on two characteristics:
Relevance: Does the evidence address the audit objective and relevant assertion?
Reliability: Can the auditor reasonably rely on the information, considering its source, nature, and circumstances?
A document can be authentic and still be irrelevant to the assertion being tested.
For example, a customer invoice may support the occurrence of a recorded sale, but it does not necessarily establish that all sales have been recorded.
Likewise, a report may be relevant but unreliable because its completeness or accuracy has not been established.
Both relevance and reliability matter.
3. Sufficiency vs. Appropriateness: The Key Differences
Characteristic | Sufficiency | Appropriateness |
Primary concern | Quantity of evidence | Quality of evidence |
Key question | How much evidence is needed? | Is the evidence relevant and reliable? |
Main influences | Risk, population, procedure, evidence quality | Source, nature, assertion, circumstances |
Common weakness | Too little testing | Testing the wrong information |
Audit consequence | Insufficient support for the conclusion | Unreliable or irrelevant support |
Corrective response | Obtain additional evidence | Obtain different or more reliable evidence |
These characteristics work together.
Increasing the quantity of evidence cannot compensate for evidence that is fundamentally inappropriate.
4. Practical Example: Accounts Receivable
Assume an auditor is examining a company's accounts receivable balance.
Management provides a detailed aging report containing 2,000 customer accounts.
The auditor selects 100 balances for testing.
Does testing 100 balances automatically provide sufficient appropriate audit evidence? No.
The auditor must consider whether the aging report is complete and accurate, whether the selection addresses relevant risks, and whether the procedures produce reliable evidence.
For example:
Existence: Confirming balances directly with customers may provide relevant evidence that recorded receivables exist.
Valuation: Examining subsequent collections and evaluating overdue balances may provide evidence about collectibility.
Completeness: Testing only balances already recorded in the aging report may provide limited evidence about receivables omitted from the records.
The number of items tested is only one part of the evaluation.
The procedures must address the correct assertions.
5. Practical Example: Inventory
Consider an auditor evaluating inventory reported at $25 million.
Management provides a perpetual inventory listing.
The auditor selects 75 items from the listing and traces them to warehouse locations.
This procedure may provide evidence about the existence of selected recorded inventory items.
However, it may not adequately address:
Inventory physically present but omitted from the records.
Obsolete or damaged inventory.
Incorrect inventory costs.
Goods held on consignment.
Inventory cutoff errors.
Additional procedures may be necessary.
For example, selecting physical inventory items and tracing them back to accounting records may provide evidence relevant to completeness.
A procedure that supports existence does not automatically support valuation or completeness.
6. Reliability of Audit Evidence
PCAOB AS 1105 recognizes that reliability depends on the source and nature of the evidence and the circumstances under which it is obtained.
General considerations include:
Independent external sources: Information obtained from knowledgeable independent parties may be more reliable than information generated internally.
Direct auditor knowledge: Evidence obtained through the auditor's own observation, inspection, recalculation, or reperformance may be more reliable than evidence obtained indirectly.
Internal controls: Internally generated information may be more reliable when relevant controls over its preparation and maintenance are effective.
Original documents: Original records may be more reliable than copies, depending on the circumstances.
These principles require professional judgment.
An external confirmation may be unreliable if the response is fraudulent or its source cannot be authenticated.
A system-generated report may be highly reliable if its completeness, accuracy, and underlying controls have been appropriately evaluated.
7. Company-Produced Information Requires Attention
Auditors frequently use information produced by the company, including:
Accounts receivable aging reports.
Inventory listings.
Journal entry reports.
Payroll registers.
Fixed asset schedules.
Revenue transaction reports.
Management-generated spreadsheets.
System-generated exception reports.
Under AS 1105, auditors must address the accuracy and completeness of company-produced information used as audit evidence, as applicable to the procedures being performed.
A report should not be accepted as reliable simply because it came from the company's accounting system.
Auditors should understand how the report was generated, what data it contains, whether relevant filters were applied, and whether the information is sufficiently accurate and complete for the intended audit purpose.
8. How Risk Assessment Affects Audit Evidence
PCAOB AS 2110 requires auditors to identify and assess risks of material misstatement.
AS 2301 requires auditors to design and perform procedures responsive to those risks.
AS 1105 establishes requirements concerning the evidence obtained.
The relationship is:
Risk Assessment → Audit Procedure → Audit Evidence → Audit Conclusion
Consider a company experiencing financial difficulties.
Management may have incentives to overstate revenue or assets.
The auditor should evaluate whether the planned procedures produce sufficiently persuasive evidence to address the increased risk.
Merely increasing the number of invoices examined may not be an effective response if the procedures do not address the underlying fraud risk.
9. Contradictory Evidence Must Be Evaluated
Professional skepticism requires auditors to evaluate evidence objectively.
Suppose management states that a significant receivable is fully collectible.
However, the auditor identifies:
Repeated missed payments.
A customer experiencing financial distress.
Disputed invoices.
Significant balances outstanding beyond normal terms.
The auditor cannot disregard these facts simply because management provided a representation supporting collectibility.
Contradictory evidence may require additional procedures, reconsideration of risk assessments, or revision of audit conclusions.
The auditor's responsibility is to evaluate all relevant evidence—not just the evidence supporting management's preferred accounting treatment.
10. Audit Documentation Must Demonstrate Both
Under PCAOB AS 1215 — Audit Documentation, auditors must document the work performed and conclusions reached.
A properly documented workpaper should make clear:
What assertion was tested.
Why the procedure was selected.
What evidence was examined.
How the evidence was obtained.
Whether the information was reliable.
How the extent of testing was determined.
What exceptions were identified.
How contradictory evidence was resolved.
What conclusion was reached.
A workpaper that states only "Tested 25 items; no exceptions" may not demonstrate that the evidence was sufficient or appropriate.
The auditor should be able to explain why the work performed was responsive to the identified risk.
11. Common PCAOB Inspection Concerns
Audit evidence deficiencies can arise when auditors:
Fail to obtain enough evidence for significant risks.
Rely excessively on management explanations.
Use unreliable company-generated information.
Perform procedures that do not address relevant assertions.
Fail to test significant assumptions in accounting estimates.
Ignore contradictory information.
Rely on analytical procedures without sufficiently evaluating their precision.
Fail to investigate identified exceptions.
Do not adequately document the procedures performed.
These weaknesses can undermine the support for an audit opinion even when the engagement contains extensive workpapers.
12. A Practical Audit Evidence Evaluation Checklist
Before concluding on an audit area, auditors should ask:
Have we identified the relevant assertion and assessed risk?
Does the evidence directly address that assertion?
Have we evaluated the reliability of the information?
Is the extent of testing appropriate for the risk?
Have we evaluated the completeness and accuracy of company-produced information?
Have we considered contradictory evidence?
Have we investigated significant exceptions?
Do the workpapers adequately document the procedures and results?
Would an experienced auditor understand how the evidence supports the conclusion?
These questions help shift the focus from completing audit procedures to evaluating whether the evidence actually supports the audit opinion.
The Bottom Line
Sufficiency and appropriateness are two essential characteristics of audit evidence.
Sufficiency addresses quantity. Appropriateness addresses quality.
Both must be evaluated in relation to the assessed risks and relevant assertions.
A large audit file does not necessarily contain persuasive evidence.
The goal is not to perform the greatest number of procedures.
It is to obtain sufficient appropriate audit evidence that provides a reasonable basis for the auditor's conclusion.
Comments