Definition
Sufficiency is the quantity of evidence. Appropriateness is its quality, meaning its relevance to the assertion being tested and its reliability. The two work together: AU-C 200 notes that the higher the risk of material misstatement, the more evidence is needed, and the better the quality, the less may be required. Gathering more weak evidence does not make up for evidence that is poor in quality.
Why it matters in an audit or review
AU-C 200 requires the auditor to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low level, and every conclusion in the file is measured against that. An opinion issued without it is unsupported even if no misstatement later surfaces. Sufficiency is a matter of professional judgment, so the file should show why the work was enough for the risk, not only what was done.
Example
Two auditors test a $2.1 million (illustrative) inventory balance. One counts 15 high-value items and traces them to the perpetual records. The other reads management's own count summary and recomputes its totals. The first has less volume but better quality: direct, physical, independent of the client's records.
Common mistakes
- Adding sample items to a weak procedure when the procedure itself does not address the assertion.
- Concluding "no exceptions" without stating the population, the criteria, or what would have counted as an exception.
FAQ
Who decides when evidence is sufficient?
The engagement team, using professional judgment, with the partner responsible for the final conclusion.
Sources
- AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor
- AICPA, AU-C Section 500, Audit Evidence
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error