Audit evidence is the information you collect to support your conclusion. You judge it on two tests: is it appropriate (reliable and relevant) and is there enough of it (sufficient)? Evidence from outside sources, collected by you directly, is generally more reliable than what the auditee tells you.
Last reviewed: 17 October 2026. Facts checked. We searched for the standard audit procedures (inquiry, observation, confirmation, recalculation, reperformance, analytical procedures) and the sufficiency and appropriateness tests. The definitions we confirmed come from a PCAOB standard and study material. We did not open the ICAI Standards on Auditing, and we do not cite any standard numbers.
The two tests
| Test | Meaning | Plain question |
|---|---|---|
| Appropriateness | Quality: reliable and relevant | Can I trust it, and does it relate to what I am testing? |
| Sufficiency | Quantity: enough of it | Is there enough to be confident in the conclusion? |
You need both. A large pile of weak evidence is still weak. One excellent document does not prove a whole population.
Types of evidence
These are the common ways auditors gather evidence.
| Procedure | What you do | Example |
|---|---|---|
| Inspection | Examine records, documents or physical assets | Read a signed purchase order |
| Observation | Watch a process being done | Watch a stock count |
| Inquiry | Ask people | Ask the store keeper how returns are handled |
| Confirmation | Get a direct reply from a third party | Ask a vendor to confirm the balance |
| Recalculation | Check the arithmetic | Recompute depreciation |
| Reperformance | Do the control yourself | Redo a bank reconciliation |
| Analytical procedures | Compare data and look for odd patterns | Compare monthly expenses to the trend |
What makes evidence more reliable
These are general rules of thumb that hold in most situations.
- Source. Evidence from an independent outside party, such as a bank statement or confirmation, beats evidence made inside the company.
- Directness. What you see or test yourself beats what you are told.
- Control environment. Records from a system with strong controls are more reliable than records from a weak system.
- Form. Original documents beat photocopies, scans or screenshots.
- Timing. Evidence from close to the event is better than reconstructions made later.
Limits of each type
- Inquiry is a starting point. On its own, it is rarely enough to support a conclusion. Always try to back it with something else.
- Observation shows only one moment. People may behave differently when watched.
- Documents can be forged, altered or created after the event.
- System reports are only as good as the data and the logic behind them. Check how the report was produced.
How much is enough
There is no magic number. The amount of evidence you need depends on:
- The risk. Higher risk needs more evidence.
- The importance of the area to the organisation.
- The size and variety of the population.
- The quality of the evidence. Better quality can reduce the quantity needed.
- Your plan for sampling and how you selected items.
Document your sampling logic. Our sampling plan generator helps you set sample sizes and record the reasoning.
A worked example
You are testing whether goods receipts are matched to purchase orders before payment.
- You inquire with the accounts payable manager. That gives you the process in words.
- You walk through one transaction from order to payment. That tests your understanding.
- You inspect a sample of paid invoices for matching documents. That is the main test.
- You get vendor statements for a few high-value vendors and compare the balances. That is third-party evidence.
- You run an analysis of payments above order value across the full year. That covers the whole population.
Each step adds a different kind of comfort. Together they support the conclusion.
When evidence is not enough
Sometimes you cannot get what you need. Options:
- Extend the test with more items.
- Find another source that covers the same point.
- Tell management what is missing and ask for it.
- Limit your conclusion and say so in the report.
- Escalate if management does not co-operate. Our evidence escalation tracker helps you track open requests.
Documenting evidence
Every working paper should show what you tested, how, the period covered, the source, who did it and who reviewed it. Someone who was not on the audit should be able to follow your steps and reach the same conclusion.
Common mistakes
- Treating a management representation as proof.
- Using screenshots without showing where they came from.
- Testing only samples that the auditee chose.
- Failing to record what you did when a test found no exceptions.
- Collecting more evidence of the same kind rather than a different kind.
Frequently Asked Questions
What is the difference between sufficient and appropriate evidence?
Sufficient is about quantity. Appropriate is about quality. You need both for a sound conclusion.
Is an email from the auditee valid evidence?
It is evidence, but weak. It comes from the party being audited. Back it up with a document or system record.
Can analytics replace sampling?
It can cover a whole population for certain tests, such as duplicates or gaps in sequence. You still need to follow up on exceptions with documents.
How do I handle evidence from the ERP?
Understand how the report was produced, check its completeness, and test a sample back to source records.
How long should evidence be kept?
Follow your audit charter, firm policy and any legal requirement that applies. We have not set a period here.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error