Most audit evidence in a mid-size Indian audit starts life inside the client: a receivables ageing, a stock register, a payroll export, a Tally day book. SA 500 asks the auditor to consider the relevance and reliability of information used as audit evidence. That means a report is not evidence just because it came out of the system. It has to be shown to be complete and accurate for the purpose it is used for.
Last reviewed: 17 October 2026. Facts checked. We opened search results containing Irish and UK adaptations of ISA 500 (2022 and 2023 versions), an ACCA article and a 2007 comment letter. We could not open the ICAI text of SA 500, so paragraph numbers and the Indian wording of the requirement on information produced by the entity are not quoted. Check them in SA 500 before you cite.
Why this matters
Sufficiency is about quantity. Appropriateness is about quality: relevance and reliability. Audit evidence is persuasive rather than conclusive. Our article on audit evidence types and how much is enough covers those basics, and the list of procedures names the ways of gathering it. This post covers one narrow but frequent problem: using the entity's own reports as the starting point for a test.
The risk in plain terms
Suppose the auditor selects a sample of debtors from the ageing report and confirms balances. If the ageing omits a few large debtors, the sample can never reach them. If it misstates dates, the ageing provisions are wrong. The test looked thorough, but the population was wrong.
Two questions to ask about every report
- Is it complete? Does the report include all the items it should?
- Is it accurate? Are the amounts, dates and categories right?
Ways to test completeness
- Control total to the ledger. Agree the report total with the general ledger or trial balance. A mismatch must be explained.
- Sequence checks. For invoices, voucher numbers or GRNs, look for gaps and duplicates.
- Independent source. Compare a total to something outside the report, such as GST returns for sales or bank statements for receipts.
- Parameters. Ask how the report was generated. A report filtered to a date range, branch or voucher type can drop items without any visible sign.
Ways to test accuracy
- Recalculate the arithmetic and the ageing for a sample.
- Trace to source documents: invoice, delivery challan, receipt.
- Reperform the report logic in a spreadsheet for a small sample and compare.
- Inspect the report's logic if the client uses a custom report and ask who last changed it.
Where the controls come in
If the system that produced the report has effective general IT controls, and the report logic is stable and tested, less direct testing may be needed. If not, test the report each time. Our ITGC guide covers change management and access.
Reliability in general
Common teaching on audit evidence holds that evidence is generally more reliable when it comes from independent external sources, when it is obtained directly by the auditor, when it is in documentary form and when it is original rather than a copy. The Indian standard text should be checked for exact wording. A bank confirmation is therefore stronger than an internal email, and a count the auditor saw is stronger than a count sheet handed over. The note on external confirmations under SA 505 goes through that.
Example
An auditor wants to test slow-moving stock provisions and receives a "stock ageing" Excel export from the ERP.
- The total ties to the trial balance, but the file has a filter on one warehouse.
- The auditor asks for the report to be rerun for all warehouses; the total now differs by a transfer-in-transit amount that is explained.
- A sample of 25 items has receipt dates traced to goods receipt notes. Three dates are wrong because the ERP uses the last transfer date.
- The auditor concludes the report cannot be used as is, asks for corrected ageing logic, and extends testing on the three affected categories.
The details are illustrative.
What to write on the file
For each report used: its name, who provided it, how it was generated, what was done to test completeness and accuracy, the conclusion and any limits. A short note is enough, but it must exist. See the file review comments post for how reviewers read this.
Frequently Asked Questions
Is a client-prepared schedule audit evidence?
It can be, once tested. It is a starting point, not a conclusion.
Do I test the report every year?
If the report logic or the system has not changed and controls are effective, less may be needed. Judge it each year.
Can AI tools prepare these tests?
They can speed up the recalculation and sequence checks. The auditor still decides whether the evidence is enough.
What is "sufficient appropriate" evidence?
Sufficient is quantity, appropriate is quality. Both are needed for the opinion.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error