Audit Evidence Under AU-C 500: Sufficiency, Appropriateness and Reliability

Every audit opinion rests on one thing: sufficient appropriate audit evidence. Risk assessment tells you where to look, materiality tells you how precise to be, and procedures are how you look. Evidence is what you end up with, and it is what a reviewer, peer reviewer or regulator will judge the file on.

This guide explains audit evidence for a nonissuer audit under AU-C 500, Audit Evidence, as revised by SAS No. 142, which is effective for audits of financial statements for periods ending on or after December 15, 2022. It paraphrases the standard; read AU-C 500 in AICPA Professional Standards before relying on any point.

What is audit evidence?

Audit evidence is information the auditor uses to reach the conclusions on which the opinion is based. It includes information from the entity's accounting records and from other sources, whether obtained in the current audit, in prior audits (subject to conditions) or through the firm's acceptance and continuance procedures.

Two points about the definition matter in practice:

• Evidence can contradict as well as support. Information that is inconsistent with management's assertions is still audit evidence and must be considered, not set aside.
• Absence of information can be evidence. For example, management's refusal to provide a requested representation tells the auditor something.

SAS 142 put more emphasis on the auditor evaluating evidence with professional skepticism, considering all evidence obtained, whether it corroborates or contradicts management's assertions. It also acknowledges that audit procedures increasingly use automated tools and techniques, such as data analytics, and that one procedure can serve more than one purpose.

Sufficiency and appropriateness

The two dimensions work together.

More evidence does not make up for poor evidence. Fifty internally generated spreadsheets do not substitute for a bank confirmation when the assertion is existence of cash.

Relevance

Relevance is about the logical connection between the evidence and the assertion being tested. The direction of testing matters:

• To test existence of receivables, start from the recorded balance and obtain evidence that the customer owes the amount (confirmation, subsequent cash receipts).
• To test completeness of payables, start outside the recorded balance, such as payments and invoices after year end, and check whether they were recorded.

A procedure can be highly reliable and still irrelevant. Vouching recorded payables to invoices proves they exist; it says nothing about invoices that were never recorded. See audit assertions for how assertions drive procedure design.

Reliability

Reliability depends on the source and nature of the information and the circumstances in which it is obtained, including the controls over its preparation and maintenance where relevant.

Auditing literature has long offered generalizations about reliability that remain useful, subject to exceptions:

• Evidence is more reliable when obtained from independent sources outside the entity.
• Evidence generated internally is more reliable when the related controls are effective.
• Evidence obtained directly by the auditor (for example, observation of a control) is more reliable than evidence obtained indirectly or by inference (for example, inquiry about the control).
• Evidence in documentary form, whether paper or electronic, is more reliable than evidence obtained orally.
• Original documents are more reliable than photocopies, scans or other reproductions, the reliability of which may depend on the controls over their conversion and maintenance.

SAS 142 added application material on attributes of information, such as its source, accuracy, completeness, authenticity and susceptibility to management bias, to consider when evaluating reliability. The generalizations above still help explain why one source is better than another, but they are not absolute. An external source can be unreliable if it is not independent or knowledgeable, and a document can be inauthentic.

When reliability is in doubt

If evidence from one source is inconsistent with evidence from another, or the auditor has doubts about the reliability of information, the auditor determines what modifications or additions to procedures are needed to resolve the matter and considers the effect, if any, on other aspects of the audit. The auditor is not expected to authenticate documents as an expert but should not ignore conditions that suggest a document is not genuine.

Audit procedures that produce evidence

AU-C 500 describes the procedures used to obtain evidence. Risk assessment procedures, tests of controls and substantive procedures all draw on them.

Inquiry alone is rarely sufficient. It is useful and often required, but for most assertions it needs corroboration from another procedure. Observation is limited to the point in time it occurs and can change behavior while being observed.

Information produced by the entity

Much of the evidence in a small-firm audit file is a report the client ran: an AR aging, a fixed asset register, a sales report by customer, a payroll register. When the auditor uses information produced by the entity (often called IPE), AU-C 500 requires the auditor to evaluate whether it is sufficiently reliable for the auditor's purposes. That includes, as necessary in the circumstances:

• obtaining audit evidence about the accuracy and completeness of the information
• evaluating whether the information is sufficiently precise and detailed for the auditor's purposes

Worked example: AR aging

The auditor plans to select receivables for confirmation from the aging and to use the aging buckets to test the allowance.

If the aging buckets are wrong, the allowance test built on them is wrong, even if every confirmation comes back clean. The IPE testing worksheet gives a format for recording these steps once and referencing them from every workpaper that uses the report.

Using the work of a management's specialist

When information prepared using the work of a management's specialist is used as audit evidence, such as a real estate appraisal, actuarial valuation or inventory specialist's report, AU-C 501 (moved there from AU-C 500 by SAS 142) requires the auditor, to the extent necessary considering the significance of that work, to:

• evaluate the competence, capabilities and objectivity of the specialist
• obtain an understanding of the specialist's work
• evaluate the appropriateness of the specialist's work as audit evidence for the relevant assertion

Selecting items for testing

AU-C 500 describes three ways to select items:

• Selecting all items (100 percent examination), appropriate for small populations of large items, or when data analytics allow testing an entire population for a defined attribute.
• Selecting specific items, such as high-value items, unusual items, or items that provide information about the entity. This is not sampling, and results cannot be projected to the remainder.
• Audit sampling, under AU-C 530, where conclusions are drawn about the whole population from a sample.

The method chosen affects what you can conclude. A targeted selection of the twenty largest receivables gives evidence about those twenty; the untested remainder needs its own evidence or must be shown to be immaterial in aggregate, measured against AU-C 320 performance materiality.

Evaluating whether evidence is sufficient and appropriate

Near the end of the audit, the auditor concludes whether sufficient appropriate audit evidence has been obtained. That evaluation draws together:

• whether the risk assessment still holds, given the evidence found (AU-C 330 addresses this)
• whether contradictory evidence was resolved
• whether misstatements identified point to further misstatements, under AU-C 450
• whether evidence on significant risks is persuasive enough

If sufficient appropriate evidence cannot be obtained, the auditor considers the effect on the opinion, which may lead to a qualified opinion or a disclaimer.

Documentation

AU-C 230 requires documentation sufficient for an experienced auditor to understand the nature, timing and extent of procedures, the results and the evidence obtained, and the significant judgments made. For evidence specifically, record the source of each document (client-prepared or obtained directly), how IPE reliability was addressed, and identifying characteristics of items tested.

Common evidence problems

• Client reports used without testing completeness and accuracy.
• Inquiry as the only evidence for a significant assertion.
• Wrong direction of testing, such as vouching recorded payables to address completeness.
• Contradictory evidence ignored, for example a confirmation exception closed without investigation.
• Copies relied on where the circumstances called for originals or direct confirmation.
• Specific-item selections projected as if they were a sample.

Frequently asked questions

What is sufficient appropriate audit evidence?

Sufficiency is the quantity of evidence, driven by risk and evidence quality. Appropriateness is the quality, meaning its relevance to the assertion and its reliability. Both are needed to support the auditor's conclusions.

What did SAS 142 change about audit evidence?

SAS 142 replaced AU-C 500 for periods ending on or after December 15, 2022. It emphasizes evaluating evidence with professional skepticism, considering evidence that contradicts management's assertions, assessing attributes of information such as source and susceptibility to bias, and the use of automated tools and techniques.

Is external evidence always more reliable than internal evidence?

Generally, but not always. External evidence is less reliable if the source is not independent or knowledgeable, and internal evidence can be reliable when the controls over its preparation are effective and tested.

What is information produced by the entity?

It is information the entity prepares, such as reports, listings and analyses, that the auditor uses as evidence. The auditor must evaluate whether it is reliable enough, including its accuracy, completeness, precision and level of detail.

Is inquiry sufficient audit evidence?

Inquiry alone is ordinarily not sufficient to address an assertion or to test the operating effectiveness of controls. It should be corroborated with inspection, observation, confirmation, recalculation, reperformance or analytical procedures.

Sources

• AICPA, AU-C Section 500, Audit Evidence (as revised by SAS No. 142; effective for audits of financial statements for periods ending on or after December 15, 2022)
• AICPA, AU-C Section 501, Audit Evidence: Specific Considerations for Selected Items (management's specialist requirements, as amended by SAS No. 142 and SAS No. 144)
• AICPA, AU-C Section 505, External Confirmations
• AICPA, AU-C Section 530, Audit Sampling
• AICPA, AU-C Section 230, Audit Documentation

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error