What Makes Audit Evidence Reliable? A Practical Guide for Internal and External Auditors
Understanding the Quality, Source, Relevance, and Reliability of Audit Evidence Under PCAOB AS 1105
Audit conclusions are only as strong as the evidence supporting them.
An auditor may perform extensive testing, complete hundreds of workpapers, and document numerous procedures. However, if the underlying evidence is unreliable, the audit conclusions may still be unsupported.
This is one of the most important principles of professional auditing.
Under PCAOB AS 1105, Audit Evidence, auditors must plan and perform procedures to obtain sufficient appropriate audit evidence to provide a reasonable basis for their opinions.
The key question is not simply whether evidence exists.
The key question is whether the evidence is sufficiently relevant and reliable to support the particular audit assertion and conclusion.
Understanding what makes audit evidence reliable is an essential part of professional audit tradecraft.
1. Sufficient Evidence Is Not Necessarily Reliable Evidence
PCAOB AS 1105 distinguishes between two fundamental characteristics of audit evidence.
Sufficiency refers to the quantity of evidence obtained.
Appropriateness refers to the quality of evidence, including its relevance and reliability.
These concepts are related, but they are not interchangeable.
For example, an auditor might examine 200 invoices generated by a company's accounting system.
That may represent a substantial quantity of documentation.
However, if the auditor has not evaluated whether the invoices are genuine, complete, accurate, and relevant to the assertion being tested, the evidence may provide limited assurance.
Increasing the number of unreliable documents examined does not necessarily improve the quality of the audit.
More evidence does not compensate for evidence that is fundamentally inappropriate.
2. What Does PCAOB AS 1105 Say About Reliability?
PCAOB AS 1105 explains that the reliability of audit evidence depends on its source, nature, and the circumstances under which it is obtained.
The standard provides important general principles.
Evidence obtained from knowledgeable independent sources outside the company is generally more reliable than evidence obtained solely from internal company sources.
Evidence generated internally is generally more reliable when the company's controls over its preparation and maintenance are effective.
Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly or through inference.
Documentary evidence is generally more reliable than oral representations.
Original documents are generally more reliable than photocopies, facsimiles, or documents converted into electronic form, although the reliability of electronic information depends on the controls and circumstances surrounding its creation and maintenance.
These principles guide professional judgment.
They are not an automatic ranking system that eliminates the need to evaluate individual evidence.
3. The Five Questions Auditors Should Ask About Evidence
A practical evaluation of audit evidence begins with five questions.
Question | What the auditor evaluates |
Who created the information? | Independence, competence, objectivity, and potential bias |
How was it obtained? | Direct observation, external confirmation, company records, or management representations |
How was it produced and maintained? | Systems, controls, processing, and potential alteration |
What assertion does it support? | Relevance to existence, completeness, valuation, rights, obligations, or presentation |
Does other evidence corroborate it? | Consistency with independent records and contradictory information |
These questions should be applied before concluding that evidence supports an audit objective.
4. Independence of the Evidence Source
The independence of the source is an important factor in evaluating reliability.
Evidence obtained directly from an independent third party is generally more reliable than evidence prepared exclusively by management.
Consider the audit of cash.
An internally prepared bank reconciliation provides useful information.
However, the auditor may also obtain a bank confirmation directly from the financial institution.
The confirmation provides evidence from a source outside the company.
Similarly, a customer's response to an accounts receivable confirmation may provide evidence about a recorded balance.
However, the auditor must still evaluate whether the confirmation addresses the relevant assertion and whether the responding party is appropriate.
External evidence is not automatically reliable merely because it comes from outside the company.
The auditor should consider the source's knowledge, objectivity, and the circumstances surrounding the information.
5. Direct Evidence Is Generally Stronger Than Indirect Evidence
Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly.
For example:
Direct evidence: The auditor observes inventory during a physical inventory count.
Indirect evidence: Management provides a written statement that all inventory was counted.
Direct observation provides stronger evidence concerning the counting procedures and inventory present at the observation date.
However, observation alone does not establish every relevant assertion.
The auditor may still need procedures addressing ownership, valuation, completeness, and inventory movements.
The critical principle is that evidence must support the specific assertion being evaluated.
6. Documentary Evidence Versus Oral Representations
Documentary evidence generally provides a more reliable basis for audit conclusions than oral statements.
Consider a situation in which management explains that a significant liability was paid after year-end.
An oral explanation may be useful.
However, the auditor should consider examining:
Subsequent bank statements.
Payment records.
Vendor correspondence.
Relevant invoices.
General ledger entries.
The auditor should evaluate whether the records collectively support the explanation.
Management representations are an important part of the audit, but they ordinarily do not substitute for other necessary audit evidence.
Professional skepticism requires auditors to corroborate important management assertions.
7. The Reliability of Internally Generated Information
Auditors frequently rely on information produced by the company.
Examples include:
Accounts receivable aging reports.
Inventory listings.
Payroll registers.
Fixed asset schedules.
Sales transaction reports.
Vendor master files.
Journal entry populations.
System-generated exception reports.
Before using this information, auditors should evaluate whether it is sufficiently reliable for the intended audit purpose.
This generally involves considering its accuracy and completeness, or the controls supporting those characteristics, as required by the applicable standard.
For example, an auditor testing accounts receivable valuation may use an aging report.
If the report excludes certain customer balances or assigns incorrect aging categories, the auditor's analysis may be misleading.
The auditor should consider procedures such as reconciling report totals to the general ledger, evaluating report parameters, and testing relevant underlying information.
A report generated by an accounting system is not reliable simply because it came from the system.
8. Information Technology Controls Affect Evidence Reliability
Modern audits depend heavily on electronic information.
The reliability of that information may depend on controls involving:
User access.
Privileged access.
Program changes.
System interfaces.
Automated calculations.
Data processing.
Report generation.
Data retention.
System security.
For example, an automated revenue report may be accurate when the application is functioning properly.
However, inappropriate changes to report logic or underlying data could affect its reliability.
Auditors should understand relevant technology dependencies and determine the procedures necessary to evaluate information used as evidence.
Testing general information technology controls may be important when the auditor's approach depends on automated controls or system-generated information.
The required procedures depend on the circumstances and the planned audit approach.
9. Relevance Is Just as Important as Reliability
Reliable evidence may still be inappropriate if it does not address the assertion being tested.
Consider the audit of accounts receivable.
A customer confirmation may support the existence of a receivable.
However, it does not necessarily establish that the customer can pay the balance.
Collectibility requires additional evidence.
Similarly, observing physical inventory may support existence but does not establish that inventory is properly valued.
An auditor must determine what each procedure actually proves.
Audit assertion | Example of relevant evidence |
Existence | Inventory observation or appropriate external confirmation |
Completeness | Search for unrecorded liabilities |
Valuation | Subsequent receipts, market information, or tested valuation assumptions |
Rights and obligations | Contracts, title documents, and relevant agreements |
Occurrence | Supporting records demonstrating that a recorded transaction occurred |
Cutoff | Shipping, receiving, and transaction records around period-end |
Presentation and disclosure | Agreements, accounting analyses, and disclosure support |
An effective audit links each risk to a relevant assertion and then identifies evidence capable of addressing that assertion.
10. Corroboration Strengthens Audit Evidence
Evidence becomes more persuasive when independent sources support the same conclusion.
For example, an auditor testing a significant sale might examine:
The customer contract.
The customer purchase order.
Shipping or delivery records.
The sales invoice.
The accounts receivable entry.
Subsequent customer payment.
These records may collectively support the occurrence, timing, and measurement of the transaction.
However, the auditor must consider whether the records are genuinely independent.
Several documents generated from the same inaccurate system record may repeat the same error.
Corroboration is strongest when the evidence comes from sources or processes with meaningfully different reliability characteristics.
11. Contradictory Evidence Must Be Investigated
Professional skepticism requires auditors to evaluate evidence that contradicts management's assertions.
Suppose management states that a significant receivable is fully collectible.
However, the auditor discovers:
Repeated late payments.
Customer financial difficulties.
Disputed invoices.
Subsequent credit memos.
Correspondence indicating collection concerns.
The auditor should not ignore this information because it conflicts with management's explanation.
Contradictory evidence may require additional procedures, revised risk assessments, or reconsideration of the accounting conclusion.
Audit evidence should be evaluated objectively, not selected merely because it supports the conclusion the auditor expected to reach.
12. Reliability of External Confirmations
External confirmations can provide persuasive evidence when properly designed and controlled.
However, the auditor should evaluate:
Whether the responding party is appropriate.
Whether the request was sent to a reliable address.
Whether the auditor maintained control over the confirmation process.
Whether the response was received directly.
Whether the response is authentic.
Whether exceptions or inconsistencies require investigation.
For example, an email appearing to come from a customer may not be authentic.
Auditors should consider the risk of impersonation, compromised email accounts, or other circumstances affecting the reliability of electronic responses.
The applicable requirements for confirmation procedures are addressed in PCAOB AS 2310, The Auditor's Use of Confirmation.
13. Reliability of Audit Evidence Involving Accounting Estimates
Accounting estimates present special challenges because they frequently depend on assumptions about future events.
Examples include:
Allowances for credit losses.
Asset impairments.
Fair value measurements.
Warranty liabilities.
Contingent liabilities.
Revenue-related estimates.
Management may use models, historical information, market data, and forecasts.
The auditor should evaluate the relevance and reliability of the underlying data and the reasonableness of significant assumptions.
For example, a discounted cash flow model may be mathematically correct but still produce an unreliable estimate if its revenue growth assumptions are unsupported.
The auditor must evaluate more than the mathematical accuracy of the model.
PCAOB AS 2501, Auditing Accounting Estimates, Including Fair Value Measurements, establishes additional requirements for auditing estimates.
14. Audit Evidence Obtained Through Data Analytics
Data analytics can improve audit effectiveness by allowing auditors to examine large transaction populations.
Examples include:
Identifying duplicate payments.
Detecting unusual journal entries.
Analyzing revenue cutoff.
Comparing vendor and employee information.
Evaluating transaction patterns.
Identifying unusual account relationships.
However, the quality of the results depends on the reliability of the underlying data.
An analytical procedure applied to incomplete or inaccurate data may produce misleading conclusions.
Auditors should evaluate data completeness, accuracy, extraction procedures, and the logic used in the analysis.
For example, an auditor examining all journal entries must determine whether the extracted population includes the relevant journals, periods, entities, and posting sources.
A sophisticated analytical model cannot compensate for an incomplete population.
15. Artificial Intelligence Creates Additional Evidence Reliability Risks
Artificial intelligence can assist auditors with document analysis, anomaly detection, contract review, and risk assessment.
However, AI-generated output should not automatically be treated as audit evidence.
AI systems may:
Generate inaccurate statements.
Misinterpret contractual language.
Omit relevant exceptions.
Produce unsupported conclusions.
Misclassify transactions.
Rely on incomplete data.
Provide citations that do not support the stated conclusion.
Auditors should distinguish between using AI as a tool to identify potential evidence and obtaining reliable evidence that supports an audit conclusion.
For example, AI may identify a potentially unusual revenue contract.
The auditor should then examine the underlying contract and evaluate the relevant accounting requirements.
AI can assist the auditor in finding and analyzing evidence, but the auditor remains responsible for evaluating its reliability and reaching the audit conclusion.
16. A Practical Audit Evidence Reliability Matrix
Auditors can use a structured evaluation to assess the reliability of important evidence.
Evidence type | General reliability considerations | Additional audit work that may be needed |
Direct bank confirmation | Independent external source | Authenticate and evaluate exceptions |
Management-prepared reconciliation | Internal company information | Test underlying records and relevant controls |
Customer invoice | May be internally generated | Corroborate with contracts, delivery, and payment evidence |
Physical inventory observation | Direct auditor observation | Address ownership, completeness, and valuation |
System-generated report | Depends on data and controls | Evaluate accuracy, completeness, and report logic |
Management representation | Subject to management bias | Obtain corroborating evidence |
External market data | Source may be independent | Evaluate relevance, reliability, and suitability |
AI-generated analysis | Depends on model, data, and verification | Independently validate material findings |
The matrix is a practical training aid, not a substitute for applying PCAOB requirements and professional judgment.
17. Common Audit Evidence Reliability Deficiencies
Auditors should be alert to several recurring problems.
Accepting management explanations without corroboration
Management inquiries can identify relevant information, but they do not automatically establish the accuracy of financial statement assertions.
Failing to test company-generated reports
Reports used in audit procedures may be incomplete, inaccurate, or generated using inappropriate parameters.
Relying on evidence that addresses the wrong assertion
A procedure may be properly performed but fail to address the identified risk.
Ignoring contradictory information
Evidence inconsistent with management's representations must be evaluated.
Assuming electronic information is authentic
Digital records can be altered, manipulated, or transmitted through compromised systems.
Treating analytical procedures as conclusive
Unexpected relationships and anomalies may require investigation and corroboration.
Relying on workpaper completion rather than evidence quality
A completed checklist does not establish that the evidence supports the audit conclusion.
Using AI outputs without validation
AI-generated summaries, calculations, or classifications may contain errors that affect audit judgments.
8. Audit Documentation Should Explain Why Evidence Is Reliable
Audit workpapers should do more than identify the documents examined.
For significant audit areas, documentation should demonstrate:
The audit objective.
The identified risk.
The relevant assertion.
The evidence obtained.
The source of the evidence.
The procedures used to evaluate its reliability.
The results of those procedures.
Exceptions and contradictory information.
Additional procedures performed.
The final audit conclusion.
Consider the difference between two workpaper conclusions.
Weak conclusion: “Reviewed the accounts receivable aging report. No exceptions noted.”
Stronger conclusion: “Reconciled the aging report total to the general ledger, evaluated the report's aging parameters, tested selected invoice dates and balances to supporting records, and investigated material past-due amounts. The procedures performed supported use of the report for the planned valuation analysis.”
The second conclusion explains the work performed and how the auditor evaluated the information.
Documentation should be sufficient for an experienced auditor to understand the procedures, results, and conclusions.
19. Audit Evidence Reliability Checklist
Before relying on important evidence, auditors should ask:
Is the evidence relevant to the assertion being tested?
Is the source knowledgeable and objective?
Was the evidence obtained directly or indirectly?
Is the evidence documentary or primarily oral?
Could the evidence have been altered?
Are relevant internal controls effective?
Has the accuracy of company-generated information been evaluated?
Has the completeness of relevant information been evaluated?
Are electronic records authentic and appropriately controlled?
Does the evidence agree with other independent information?
Have contradictory findings been investigated?
Are significant management assumptions supported?
Does the evidence address the specific identified risk?
Is additional corroboration necessary?
Is the evidence sufficiently persuasive given the assessed risk?
Have the reliability assessment and conclusions been documented?
20. What Internal Auditors Can Learn from PCAOB AS 1105
Although PCAOB standards govern audits within the PCAOB's jurisdiction, the principles of reliable evidence are also useful to internal auditors.
Internal auditors routinely evaluate:
Internal controls.
Regulatory compliance.
Fraud risks.
Financial processes.
Information technology.
Operational performance.
Governance.
Risk management.
Internal audit conclusions also depend on information that is relevant, reliable, and sufficient for the engagement objectives.
The IIA Global Internal Audit Standards address the gathering and evaluation of information, including requirements concerning relevance, reliability, and sufficiency.
For both internal and external auditors, professional skepticism and disciplined evidence evaluation are essential skills.
The Bottom Line: Audit Evidence Must Be Persuasive, Not Merely Available
Reliable audit evidence is the foundation of an effective audit.
The quality of evidence depends on its source, nature, relevance, and the circumstances under which it was obtained.
Evidence obtained directly from independent sources may be more reliable than internally generated information, but every item of evidence must be evaluated in context.
Auditors must also consider the effectiveness of relevant controls, the reliability of electronic information, the need for corroboration, and the existence of contradictory evidence.
As audit teams increasingly use data analytics and artificial intelligence, evaluating evidence reliability becomes even more important.
The professional auditor's responsibility is not simply to collect information. It is to determine whether the information provides a reasonable basis for the audit conclusion.
That is the difference between completing audit procedures and performing a high-quality audit.
Strengthen Your Audit Evidence Skills with Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides continuing professional education covering PCAOB auditing standards, audit evidence, risk assessment, internal controls, fraud detection, and professional audit tradecraft.
Our programs help auditors strengthen the judgment and technical skills required to evaluate evidence, investigate exceptions, and document defensible audit conclusions.
Explore auditing and assurance CPE programs at Corporate Compliance Seminars.
Comments