What Is Audit Evidence? A Complete Guide for Auditors

Audit evidence is the foundation of every audit conclusion.

Whether an auditor is examining financial statements, evaluating internal controls, investigating fraud, or assessing regulatory compliance, the quality of the conclusion depends on the evidence supporting it.

Under PCAOB AS 1105 — Audit Evidence, auditors must obtain sufficient appropriate audit evidence to provide a reasonable basis for their opinions.

But what constitutes audit evidence, how much is enough, and how should auditors evaluate its reliability?

These questions are fundamental to audit quality.

What Is Audit Evidence?

Audit evidence consists of information used by the auditor in arriving at conclusions on which the auditor's opinion is based.

Evidence can come from accounting records, documents, electronic information, third-party confirmations, observations, analytical procedures, and other sources.

Examples include:

• Bank confirmations

• Customer invoices

• Vendor statements

• Contracts and agreements

• General ledger transactions

• Inventory observations

• System-generated reports

• Reconciliations

• Management estimates

• External market information

• Board and Audit Committee minutes

The important question is not simply whether information exists.

The question is whether the information provides a reasonable basis for the auditor's conclusion.

Sufficiency vs. Appropriateness

PCAOB AS 1105 distinguishes between two fundamental characteristics of audit evidence.

Sufficiency — How Much Evidence Is Needed?

Sufficiency refers to the quantity of audit evidence.

The amount needed depends on several factors, including the assessed risks of material misstatement and the quality of the evidence available.

Higher-risk areas generally require more persuasive evidence.

For example, an auditor examining a routine prepaid expense may require different evidence from an auditor evaluating a complex revenue recognition arrangement involving significant management judgment.

However, simply collecting more documents does not automatically produce sufficient audit evidence.

Appropriateness — How Good Is the Evidence?

Appropriateness refers to the quality of audit evidence, including its relevance and reliability.

Relevant evidence addresses the specific assertion or audit objective being tested.

Reliable evidence comes from sources and processes that provide reasonable confidence in its accuracy and completeness.

A large quantity of poor-quality evidence cannot compensate for a fundamental lack of relevance or reliability.

Types of Audit Evidence

Auditors use several techniques to obtain evidence.

1. Inspection

Examining documents, records, or physical assets.

Examples include reviewing contracts, invoices, purchase orders, reconciliations, and accounting records.

2. Observation

Watching a process or procedure being performed.

For example, an auditor may observe inventory counting procedures.

Observation provides evidence about the process at the time observed, but does not necessarily demonstrate that the process operated effectively throughout the year.

3. External Confirmation

Obtaining information directly from an independent third party.

Bank balances, accounts receivable, and certain contractual arrangements may be examined through confirmation procedures.

External confirmations can provide persuasive evidence, although their reliability depends on the circumstances and the auditor's control over the process.

4. Recalculation

Checking the mathematical accuracy of documents or records.

Examples include independently recalculating depreciation, interest, payroll, or financial ratios.

5. Reperformance

Independently executing procedures or controls originally performed by the organization.

For example, an auditor might reperform a bank reconciliation or test an automated calculation.

6. Analytical Procedures

Evaluating relationships among financial and nonfinancial information.

Analytical procedures can help identify unusual trends, unexpected relationships, or potential misstatements.

7. Inquiry

Obtaining information from management or other knowledgeable individuals.

Inquiry is useful, but inquiry alone generally does not provide sufficient evidence for significant audit conclusions.

Auditors should corroborate important representations with other evidence.

Reliability of Audit Evidence

Not all evidence is equally reliable.

Under PCAOB AS 1105, reliability is influenced by the source and nature of the information and the circumstances under which it is obtained.

Generally:

• Evidence from knowledgeable independent external sources may be more reliable than internally generated evidence.

• Internally generated evidence may be more reliable when relevant controls are effective.

• Evidence obtained directly by the auditor may be more reliable than evidence obtained indirectly.

• Original documents may be more reliable than copies, depending on their authenticity and circumstances.

These are general principles, not absolute rules.

An externally generated document can be fraudulent, and an internally generated report can be highly reliable when supported by effective controls and appropriate testing.

Auditors must evaluate the circumstances.

Audit Evidence Must Address Assertions

One of the most common audit weaknesses is collecting evidence without clearly identifying the assertion being tested.

For financial statement audits, relevant assertions include:

• Existence or Occurrence: Do recorded assets and transactions actually exist or occur?

• Completeness: Have all transactions and balances that should be recorded been included?

• Valuation or Allocation: Are amounts recorded appropriately?

• Rights and Obligations: Does the company have the relevant rights and obligations?

• Presentation and Disclosure: Are financial statement items appropriately classified, presented, and disclosed?

Consider accounts payable.

Testing recorded vendor invoices may provide evidence about the validity and accuracy of recorded liabilities.

But that testing alone may provide limited evidence about unrecorded liabilities.

The auditor needs procedures specifically designed to address completeness.

Evidence is useful only when it supports the assertion being tested.

Audit Evidence and Risk Assessment

PCAOB AS 2110 requires auditors to identify and assess risks of material misstatement.

PCAOB AS 2301 then requires auditors to design and perform procedures responsive to those risks.

AS 1105 connects these activities by establishing requirements for the evidence obtained.

The relationship is:

Risk Assessment → Relevant Assertion → Audit Procedure → Audit Evidence → Audit Conclusion

Higher-risk assertions ordinarily require more persuasive audit evidence.

An audit plan that identifies significant risks but does not obtain evidence responsive to those risks has a fundamental weakness.

Audit Evidence in an Electronic Environment

Much of today's audit evidence exists electronically.

Examples include:

• ERP system reports

• Electronic invoices

• Database extracts

• Cloud accounting records

• Automated control logs

• Electronic contracts

• Data analytics

• Third-party information platforms

Auditors need to consider the accuracy, completeness, relevance, and reliability of electronic information.

For example, when using a system-generated report, the auditor may need to evaluate the report's source, parameters, logic, completeness, and accuracy.

Simply downloading a spreadsheet from the client's accounting system does not establish that its contents are reliable.

Technology changes how auditors obtain evidence, but it does not eliminate the need to evaluate that evidence.

Audit Evidence and Professional Skepticism

Professional skepticism is essential when evaluating audit evidence.

Auditors should remain alert to information that:

• Contradicts management's explanations

• Appears inconsistent with other evidence

• Raises questions about document authenticity

• Suggests possible management bias

• Indicates fraud risk

• Challenges assumptions used in accounting estimates

One of the most dangerous audit practices is accepting evidence because it supports an expected conclusion while disregarding contradictory information.

Audit evidence should drive the conclusion—not merely support a conclusion the auditor has already reached.

Audit Documentation: Proving the Work Was Performed

Obtaining evidence is not the same as documenting it.

Under PCAOB AS 1215 — Audit Documentation, the auditor must prepare documentation sufficient to demonstrate the procedures performed, evidence obtained, and conclusions reached.

A properly documented audit workpaper should identify:

• The audit objective

• The relevant assertion

• The assessed risk

• The procedure performed

• The population and items tested

• The evidence examined

• Exceptions identified

• Follow-up procedures

• The auditor's conclusion

• Evidence of supervision and review, as applicable

A workpaper that simply states "No exceptions noted" may not adequately demonstrate the work performed.

The documentation needs to allow an experienced auditor to understand the nature, timing, extent, and results of the procedures.

Common Audit Evidence Deficiencies

Auditors frequently encounter problems involving:

• Overreliance on management representations

• Evidence that does not address the relevant assertion

• Inadequate testing of system-generated reports

• Insufficient evidence for significant accounting estimates

• Failure to investigate contradictory information

• Poorly designed sampling procedures

• Inadequate documentation

• Failure to evaluate exceptions

• Audit conclusions unsupported by the evidence obtained

These weaknesses can result in significant audit quality problems and potential PCAOB inspection findings.

How Much Audit Evidence Is Enough?

There is no universal number of invoices, confirmations, or transactions that guarantees sufficient evidence.

The answer depends on the risk, assertion, population, procedure, evidence quality, and results obtained.

Auditors should continually ask:

Does the evidence obtained reduce audit risk to an appropriately low level?

If the answer is no, additional or different procedures may be necessary.

The objective is not to accumulate the largest possible workpaper file.

The objective is to obtain sufficient appropriate evidence to support a reasonable audit conclusion.

The Bottom Line

Audit evidence is the foundation of audit quality.

PCAOB AS 1105 requires auditors to obtain evidence that is both sufficient in quantity and appropriate in quality.

Effective auditors understand that evidence must be relevant to the assertion, reliable under the circumstances, responsive to assessed risks, and properly evaluated.

The fundamental audit relationship is:

Risk → Assertion → Procedure → Evidence → Conclusion

If that relationship cannot be demonstrated, the audit may not have an adequate evidential foundation.

The quality of an audit opinion can never exceed the quality of the evidence supporting it.