ACCT90014 · Auditing And Assurance Services
Audit Evidence
An opinion is only as strong as the evidence under it. Audit evidence is the information the auditor uses to test management’s assertions about transactions, balances and disclosures, and ASA 500 sets two non-negotiable tests: the evidence must be sufficient (enough of it — a quantity judgement) and appropriate (the right quality — relevant and reliable). Reliability is the part of appropriateness you can rank on sight: evidence is more reliable the more independent of the client its source is, the more directly the auditor obtains it, and the more it exists in durable documentary form — memorise that ladder. ASA 500 names seven procedure types (inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, inquiry), and the exam asks you to pick the right one for an assertion and to distinguish the look-alike pairs. The most-drilled distinction is vouching vs tracing — testing records→source catches overstatement (occurrence), testing source→records catches understatement (completeness). The chapter closes on the two families that target detection risk: tests of controls (did the control work?) vs substantive procedures (is the balance itself misstated?), and on sampling — testing less than 100% and the sampling vs non-sampling risk it carries.
What this chapter covers
- 01Sufficient & appropriate evidence (ASA 500): quantity and quality
- 02The reliability hierarchy: source independence, directness, documentary form
- 03The seven ASA 500 procedures and the assertion each suits
- 04Vouching vs tracing — the direction drill (overstatement vs understatement)
- 05External confirmations and analytical procedures
- 06Tests of controls vs substantive procedures — two families, one DR target
- 07Audit sampling: statistical vs non-statistical; sampling vs non-sampling risk
Worked example: rank the evidence and pick the procedure
- +2(a) Most reliable: the customer’s confirmation reply — obtained directly by the auditor from a source independent of the client, in documentary form.
- +1(a) Then: the client’s aged ledger — documentary but internally generated, so less reliable than independent external evidence.
- +1(a) Least reliable: the verbal assurance — oral inquiry from within the client; weakest of the three and never sufficient on its own.
- +2(b) External confirmation best tests existence: it asks an independent debtor to confirm the balance, providing direct, independent evidence that the receivable is real — the gold-standard procedure for receivables existence.
Key terms
- Sufficient appropriate evidence
- The ASA 500 standard for audit evidence: sufficient = enough of it (quantity, driven by risk and materiality); appropriate = the right quality (relevant to the assertion and reliable). Both are needed to support the opinion.
- Reliability hierarchy
- The ranking of evidence quality: more reliable when from a source independent of the client, when obtained directly by the auditor, and when in durable documentary (rather than oral) form. Lets the auditor rank evidence on sight.
- Vouching
- Testing from the recorded item back to the supporting source document (records→source). It tests occurrence and catches overstatement — the dominant direction for revenue and assets.
- Tracing
- Testing from a source document forward to the records (source→records). It tests completeness and catches understatement — the dominant direction for payables and liabilities.
- External confirmation
- Direct written evidence obtained from a third party (e.g. a debtor, a bank). Gold-standard for existence because the reply reaches the auditor directly from a source independent of the client.
Audit Evidence FAQ
What makes audit evidence 'appropriate'?
Appropriateness is the quality measure: evidence must be both relevant (it actually tests the assertion at risk) and reliable. Reliability rises with independence of the source, how directly the auditor obtains it, and whether it is in documentary form. Appropriateness pairs with sufficiency (quantity) — you need both under ASA 500.
How do I remember vouching vs tracing?
Follow the arrow. Vouching goes from the record back to the source (records→source) and tests occurrence — it catches overstatement, so it is the revenue/asset direction. Tracing goes from the source forward to the record (source→records) and tests completeness — it catches understatement, so it is the payables/liability direction. Same documents, opposite questions.
Why is inquiry alone never enough?
Inquiry is oral evidence from within the client, the lowest rung of the reliability hierarchy, so it cannot by itself support a conclusion. The standard treats it as corroborative: useful to direct other procedures, but it must be backed by more reliable evidence such as inspection, recalculation or external confirmation.
What is the difference between sampling and non-sampling risk?
Sampling risk is the risk that the conclusion from a sample differs from the conclusion from testing the whole population — an unavoidable consequence of testing less than 100%, reducible by larger or better-designed samples. Non-sampling risk is the risk of a wrong conclusion for any other reason (e.g. an inappropriate procedure or a missed error), reduced by good planning, supervision and review.
Exam move
Anchor everything on ASA 500's two tests — sufficient (quantity) and appropriate (relevance + reliability). Memorise the reliability ladder (independence of source, directness, documentary form) so you can rank any three items on sight, a recurring exam move. Learn the seven procedures by the assertion each best serves, and drill the look-alike pairs — especially vouching vs tracing — until the direction-of-testing rule is reflex. Be able to separate the two procedure families (tests of controls answer 'did the control work?'; substantive procedures answer 'is the balance misstated?') and state how sampling vs non-sampling risk threaten the conclusion. Tie each procedure you name to the assertion it tests.
