Sufficient appropriate audit evidence under AU-C 500

In this lesson you will

Define sufficiency and appropriateness of audit evidence.
Evaluate relevance and reliability of information, including information produced by the entity.
Apply AU-C 500.10 when evidence is inconsistent or doubtful.

Evidence is evaluated, not just collected

AU-C 500 was rewritten by SAS 142, effective for audits of financial statements for periods ending on or after December 15, 2022. Its objective in AU-C 500.05 is to evaluate information to be used as audit evidence, including the results of procedures, to inform your overall conclusion under AU-C 330 about whether sufficient appropriate evidence has been obtained.

AU-C 500.06 defines the terms:

Audit evidence is information used by the auditor in arriving at the conclusions on which the opinion is based. It is information to which audit procedures have been applied, and it corroborates or contradicts assertions.
Appropriateness is the quality of evidence: its relevance and reliability.
Sufficiency is the quantity of evidence. More is needed when risks are higher, and better quality can reduce the quantity needed, but quantity cannot make up for poor quality.

Relevance and reliability

AU-C 500.07 requires you to evaluate information to be used as evidence by considering its relevance and reliability, including its source, and whether it corroborates or contradicts assertions.

Relevance is about the logical connection to the assertion. Confirming a receivable tests existence; it says little about whether the customer can pay.

Reliability depends on the nature and source of the information and the circumstances in which it was obtained (AU-C 500.A22). AU-C 500.A27 lists the attributes that affect it: accuracy, completeness, authenticity and susceptibility to management bias. The application material gives working guidance:

Evidence from external parties is generally more reliable because it is less susceptible to management bias (AU-C 500.A22), but the source itself may be unreliable. A bank confirmation differs from a vendor statement the client forwards to you.
Information you obtain directly, such as observing a control, may be more reliable than information obtained by inquiry or inference (AU-C 500.A23).
A contemporaneous written record may be more reliable than a later oral representation (AU-C 500.A24).
Tested controls over the preparation of information can establish its reliability (AU-C 500.A25).

Information produced by the entity

AU-C 500.08 requires your evaluation to include whether information is sufficiently precise and detailed for your purpose, and obtaining evidence about its accuracy and completeness as necessary. Aging reports, sales registers, payroll registers and system queries all fall here. If you sample from a population report, you need comfort that the report includes every item and that the amounts are right. Typical procedures:

Reconcile the report total to the general ledger.
Test the logic or parameters used to generate it.
Test general IT controls and the relevant application controls, or test the data directly.
Trace items from source documents to the report and back.

When evidence conflicts

AU-C 500.10 requires you to determine whether modifications or additions to procedures are necessary to resolve inconsistencies in, or doubts about the reliability of, audit evidence. A confirmation that disagrees with the loan agreement, or a document that looks altered, triggers this. Fraud indicators bring in AU-C 240.13 as well.

AU-C 330.28 then requires you to consider all audit evidence, whether it corroborates or contradicts the assertions, when concluding on sufficiency. Files that list only supporting evidence fail this.

Common findings

Client reports used for sampling with no test of completeness and accuracy.
Inquiry used as the only evidence for a significant assertion.
External information (a market index, a pricing service) used without considering its source and suitability.
Contradictory evidence noted and then ignored in the conclusion.

The audit evidence guide and the confirmations guide go deeper on source reliability.

Worked example

Testing a client aging report before sampling

Granite Peak Electric Co. provides an accounts receivable aging with 1,214 invoices totaling $3,512,700. The team plans to select confirmations from it.

Step 1, agree to the ledger. The general ledger control account is $3,486,200. Difference: $3,512,700 - $3,486,200 = $26,500, with the aging higher than the ledger. Management explains it as unapplied cash. The team obtains the unapplied cash detail, which totals $26,500 of customer receipts posted to the control account but not yet matched to invoices. The aging lists open invoices gross and omits those credits. The team asks for a corrected report that applies the credits to customer balances, so it agrees to $3,486,200.

Step 2, completeness of the report. The team selects 15 invoices from the December sales journal and traces each to the aging. All 15 appear.

Step 3, accuracy. The team selects 15 items from the aging and agrees invoice date, customer and amount to the invoice. One invoice dated October 15 with 60-day terms sits in the 0-30 day column, although it is 77 days old at December 31. IT confirms the report ages from due date, not invoice date. The team documents the parameter and adjusts its valuation testing to use invoice date.

Conclusion: the corrected aging is complete and accurate enough to sample from, with the aging-basis issue carried to the allowance work.

Self-check

Answer each question before you open the answer.

What two qualities make up the appropriateness of audit evidence?
Show answer
Relevance and reliability (AU-C 500.06). Sufficiency is the separate measure of quantity.
Can more evidence compensate for low-quality evidence?
Show answer
No. Higher-quality evidence can reduce the quantity needed, but obtaining more of an unreliable type does not make it reliable.
What does AU-C 500.08 require for a client-prepared report you plan to use?
Show answer
Evaluating whether it is precise and detailed enough for your purpose and obtaining evidence about its accuracy and completeness as necessary, for example by reconciling it to the ledger and testing how it was generated.
A bank confirmation shows a loan balance $50,000 higher than the client’s loan agreement schedule. What does AU-C 500.10 require?
Show answer
Determine whether procedures need to be modified or added to resolve the inconsistency, such as obtaining the lender’s statement and amendments. The auditor cannot simply accept the client schedule.

Sources

AICPA Statements on Auditing Standards, currently effective (AU-C sections)

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error