AU-C section 500, Audit Evidence, explains what audit evidence is and what the auditor must consider when designing and performing procedures to get it, in a GAAS audit of a nonissuer. SAS No. 142 revised it. SAS 142 applies to audits of periods ending on or after December 15, 2022. It also added the AU-C 200 application material on auditor bias, which SAS No. 146 later revised to point to the examples in AU-C 220.
This page paraphrases the standard. The authoritative text is AU-C 500 in AICPA Professional Standards. A longer walk-through of the concepts is in the audit evidence guide.
What is the objective of AU-C 500?
The auditor's objective is to design and perform audit procedures in a way that enables the auditor to obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base the auditor's opinion.
What counts as audit evidence?
Audit evidence is information used by the auditor in arriving at the conclusions on which the auditor's opinion is based. It includes information in the accounting records and information from other sources, whether obtained in the current audit, in prior audits (subject to conditions) or through the firm's acceptance and continuance procedures. It includes information that supports management's assertions and information that contradicts them. The absence of information, such as management's refusal to give a requested representation, can itself be evidence.
Evidence is cumulative. Most of it comes from procedures performed during the audit.
Sufficient and appropriate
Sufficiency is the quantity of evidence. It depends on the assessed risks of material misstatement (more risk, more evidence) and on the quality of the evidence (better quality, less needed). Appropriateness is the quality: relevance and reliability. More evidence does not make up for poor-quality evidence. See AU-C 200 for the overall objective.
What changed with SAS 142?
SAS 142 was written to reflect how audits are performed now. In summary, its changes are:
- Relevance and reliability are the two attributes the auditor evaluates when assessing whether information is appropriate as evidence.
- Reliability factors are spelled out. The auditor considers the accuracy and completeness of the information, whether it is authentic, and whether it is susceptible to bias (the application material lists these attributes).
- Automated tools and techniques. The application material accepts the use of automated tools in risk assessment and in substantive work, and notes one procedure can serve more than one purpose.
- Information from external sources and information produced by the entity have explicit requirements.
- A skepticism stand-back. The auditor evaluates all audit evidence obtained, including evidence that is inconsistent with other evidence or that contradicts management's assertions, and considers whether the evidence supports or conflicts with the assertions.
- Management's specialists. The guidance on using the work of a management's specialist no longer sits in AU-C 500. It is addressed in AU-C 501, as amended by SAS No. 144.
Relevance and reliability
Relevance is the logical connection to the assertion being tested and the purpose of the procedure. A procedure can be reliable and still irrelevant. Vouching recorded payables to invoices tells nothing about unrecorded ones.
Reliability depends on the source and nature of the information and the circumstances, including controls over its preparation and maintenance where relevant. Common generalizations, which have exceptions:
- evidence from independent external sources is more reliable than from inside the entity
- internally generated information is more reliable when the related controls are effective
- evidence the auditor obtains directly is more reliable than evidence obtained indirectly or by inference
- documents (paper or electronic) are more reliable than oral representations
- original documents are more reliable than copies
These are guides to judgment, not rules. A client bank statement downloaded from the client's own system is external in origin but should be evaluated for how it reached the auditor. See audit evidence guide for more examples.
Information produced by the entity (IPE)
When using information produced by the entity as evidence, the auditor evaluates whether the information is sufficiently accurate and complete for the auditor's purposes. That includes obtaining evidence about accuracy and completeness and, where needed, about the controls over preparation and maintenance of the information. The auditor also evaluates whether the information is sufficiently precise and detailed.
In practice this covers an aged receivables listing used for confirmations or the allowance, a fixed asset register used to test depreciation, a payroll register, or a system report of journal entries used to select entries to test. Tests may include:
- agreeing the report's total to the general ledger
- checking the report parameters, filters and date range
- testing a sample of records to source documents (accuracy) and from source documents to the report (completeness)
- re-performing the report logic or re-running it
- where the system produced it, considering IT general controls over the report and its data
Use the IPE testing worksheet to record the source, the tests and the conclusion. The same rule applies when the auditor uses the information for sampling under AU-C 530, because a sample from an incomplete population says nothing about the whole.
Information from external information sources
External information sources are sources outside the entity that the auditor uses as evidence, such as market data, industry statistics, published rates, valuation services or other third-party databases. The auditor evaluates the relevance and reliability of the information, considering how the information was prepared and whether the source is appropriate for the purpose and free from bias.
The more the auditor depends on the information, the more evidence about its reliability is needed. A published interest rate index is usually low risk. A third-party valuation model that drives a significant estimate is not.
Inconsistent evidence and doubts about reliability
If audit evidence from one source is inconsistent with evidence from another, or the auditor has doubts about the reliability of information to be used as evidence, the auditor determines what changes or additions to the audit procedures are necessary to resolve the matter. The auditor also considers the effect on other aspects of the audit. A contradicting item belongs in the file with its resolution.
Selecting items for testing
When designing tests of controls and tests of details, the auditor determines the means of selecting items to test that are effective for the purpose of the procedure. There are three:
| Means | Use | Conclusion |
|---|---|---|
| Selecting all items (100% examination) | Small populations, or a few large items, or where automated tools make it practical | About the whole population |
| Selecting specific items | Key items, large or unusual items, items that give information about a matter, items to test procedures | Only about items tested, not the rest |
| Audit sampling | Representative testing to draw conclusions about a population | About the population, within sampling risk |
The method is picked using judgment about the assessed risk, the characteristics of the population, and efficiency. One design examines large and unusual items individually and then samples the remainder. See AU-C 530 and the sample size calculator.
Automated tools and techniques
Data analytics, whole-population testing, and scripting can provide evidence for more than one purpose. For example, a journal entry analysis may inform risk assessment, the fraud response and substantive testing at once. The auditor still decides the purpose of each procedure, considers the reliability of the data fed into the tool, and documents what was done so that another experienced auditor could understand it. The application material that AU-C 200 now points to in AU-C 220 names automation bias: the tendency to favor output from automated systems even when other information raises doubts about whether it is fit for purpose.
Performing the procedures and concluding
The auditor's evaluation draws on all the evidence obtained. If the auditor concludes sufficient appropriate evidence has not been obtained, the auditor tries to obtain more. If it cannot be obtained, the effect on the opinion follows AU-C 705.
Documentation
AU-C 230 applies. The file should identify the information used as evidence, its source, how its reliability was evaluated, and the conclusion.
File checks on audit evidence
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Client-prepared listings used as populations with no test of completeness and accuracy
- Reports run with no record of the parameters
- Evidence in the file that contradicts a conclusion, with no discussion
- Data analytics output pasted into the file with no description of source, steps or conclusion
- Reliance on external valuation data with no evaluation of the source
Related
- Audit evidence guide (AU-C 500)
- IPE testing worksheet
- AU-C 530 audit sampling
- AU-C 330 responding to assessed risks
Sources
- AICPA, AU-C Section 500, Audit Evidence (AICPA Professional Standards), as revised by SAS No. 142 (audits of periods ending on or after December 15, 2022)
- AICPA, SAS No. 144, The Auditor's Use of Specialists and Pricing Information From External Information Sources (amends AU-C 501 and 620)
- AICPA, SAS No. 146 (amended AU-C 200 application material on auditor bias to point to the examples in AU-C 220; periods beginning on or after December 15, 2025)
- AICPA, AU-C Sections 200, 220, 230, 330, 501, 530 and 705 (cross-referenced sections)
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error