CORAA

SIA 320 — Internal Audit Evidence

ICAI Internal Audit Standards Board · October 2022 compendium · 300 series
Reviewed 1 October 2026

SIA 320 is about the evidence behind the internal auditor's conclusions. Evidence has to be sufficient, appropriate and reliable, so that it shows the procedures were performed as planned, supports supervision and review, and lets the auditor form an opinion that can be defended on its own.

This page covers SIA 320 as it stands in ICAI’s October 2022 compendium. ICAI’s February 2026 compendium, applicable from 1 April 2026, renumbers the standards, so check the current number and text in that compendium before citing it in a report.

Same number, different title in the current set
In ICAI’s February 2026 compendium, the current set, SIA 320 is titled Issuing Assurance Reports. This page covers SIA 320 as it stands in the October 2022 compendium: Internal Audit Evidence. Only the titles of the February 2026 set are listed here; its text is not summarised on this site. See both title lists side by side.

What the internal auditor has to do

  • Obtain evidence that is sufficient in quantity and appropriate in quality, relevance and reliability.
  • Take evidence from reliable and consistent sources.
  • Record evidence so that someone else can reproduce the work and review it independently.
  • Cross-reference the evidence to the internal audit programme.

Key requirements of SIA 320

Paragraph numbers refer to SIA 320 as it appears in ICAI’s Compendium of Standards on Internal Audit (as on 1 October 2022). The points below are close paraphrases, not quotations.

  • Evidence shall be sufficient, which is about quantity, and appropriate, which is about quality, relevance and reliability.(para 3.1, 4.1)
  • Evidence is recorded so that the work is reproducible and can be reviewed independently.(para 3.3, 4.3)
  • Evidence is cross-referenced to the Internal Audit Programme.(para 4.4(b))
  • The types of evidence listed are checking, inspection, observation, inquiry, confirmation, computation, re-performance, analytical review and an expert's work.(para 4.1)
  • The technique used to gather evidence, such as sampling, is outside the scope of SIA 320. Sampling is dealt with in SIA 5.(para 1.3)

How SIA 320 shows up in the internal audit file

  • For each test in the programme, the evidence obtained and where it came from.
  • A cross-reference from each piece of evidence to the programme step it supports.
  • Enough detail of what was examined for a reviewer to repeat the test.

Common mistakes in practice

  • Relying on what the process owner said, with nothing inspected or re-performed. By convention, inquiry is the weakest form of testing.
  • Evidence filed without any link to the programme step it supports.
  • Citing SIA 320 as the authority for a sampling method. Para 1.3 leaves sampling technique out of its scope.

The file checklist and the mistakes above are practice points drawn from the requirements of the standard. They are not text from the standard.

Related standards

SIA 330 · Internal Audit DocumentationSIA 310 · Planning the Internal Audit AssignmentSIA 5 · SamplingSIA 6 · Analytical ProceduresSIA 240 · Using the Work of an Expert

How this relates to global frameworks

The IIA's Global Internal Audit Standards (effective 9 January 2025) are a separate set from a different body, and there is no paragraph-for-paragraph match. The closest IIA principle is Conduct Engagement Work.

Status and source

This standard is described here as it stands in the October 2022 compendium, which is the earlier set. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). That compendium renumbers the standards, so check the current number and text there before citing this standard in a report. ICAI's compendium page does not say whether the standards are mandatory or recommendatory, so we do not describe any standard as mandatory. The effective-date clause in each 2019 standard said it applied to internal audits beginning on or after a date to be notified by the Council of ICAI.

These pages summarise each standard as it stands in ICAI's Compendium of Standards on Internal Audit (as on 1 October 2022), working from an extract of that document. They are summaries and close paraphrases, not the text of the standards. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). For that current set we have only the titles, taken from the Board's 2025-26 annual report; its text is available from ICAI through a registration form on the compendium page and is not summarised here. ICAI's compendium page does not say whether the standards are mandatory or recommendatory, so we do not describe any standard as mandatory. Before you cite a number, a paragraph or a status in a report, check the February 2026 compendium. internalaudit.icai.org

Free working files for SIA 320

Take the working versions with you

Editable formats and tools from CORAA’s internal audit library that put SIA 320 into practice. Free to use.

Fieldwork testing tracker →Walkthrough memo generator →Evidence escalation tracker →Internal audit AI prompt library →

SIA 320 — frequently asked

What is SIA 320?

SIA 320, Internal Audit Evidence, is a Standard on Internal Audit issued by the Internal Audit Standards Board of ICAI. SIA 320 is about the evidence behind the internal auditor's conclusions. Evidence has to be sufficient, appropriate and reliable, so that it shows the procedures were performed as planned, supports supervision and review, and lets the auditor form an opinion that can be defended on its own.

What are the types of internal audit evidence under SIA 320?

SIA 320 para 4.1 lists checking, inspection, observation, inquiry, confirmation, computation, re-performance, analytical review and an expert's work. Whatever the type, paras 3.1 and 4.1 require the evidence to be sufficient and appropriate.

Is SIA 320 mandatory?

ICAI's compendium page does not say whether the Standards on Internal Audit are mandatory or recommendatory, so we do not describe SIA 320 as mandatory. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). SIA 320 as described on this page is from the earlier October 2022 compendium. The February 2026 compendium renumbers the standards, so check the current number and text there before citing it in a report.

What should the internal audit file show for SIA 320?

For each test in the programme, the evidence obtained and where it came from. A cross-reference from each piece of evidence to the programme step it supports. Enough detail of what was examined for a reviewer to repeat the test.

Is SIA 320 the same standard in the February 2026 compendium?

The number is the same but the title is not. In ICAI's February 2026 compendium, which ICAI lists as applicable from 1 April 2026, SIA 320 is titled "Issuing Assurance Reports". This page covers SIA 320 as it stands in the October 2022 compendium, titled "Internal Audit Evidence". Only the titles of the February 2026 set are listed here; check its text in that compendium before citing it.

← Previous
SIA 310 — Planning the Internal Audit Assignment
Next →
SIA 330 — Internal Audit Documentation