Audit Evidence, Procedures, and Sampling

Introduction

An audit conclusion is credible only when it is supported by sufficient and appropriate audit evidence. Auditors do not normally examine every transaction or balance. Instead, they design procedures that obtain persuasive evidence about material assertions, select representative items, evaluate results, and document the reasoning that supports the audit opinion.

This chapter introduces the main sources and procedures used to obtain audit evidence: inspection, observation, external confirmation, inquiry, recalculation, reperformance, and analytical procedures. It also explains the basic principles of audit sampling and shows how evidence quality, sampling risk, professional judgment, ethics, and technology influence audit work.

The discussion is based on widely accepted principles in international auditing standards, including the principle that evidence must be both sufficient and appropriate. Local legislation, professional standards, and regulatory requirements should always be consulted in practice.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain the meaning and purpose of audit evidence.
2. Distinguish sufficiency from appropriateness.
3. Assess the relevance and reliability of different evidence sources.
4. Describe and apply major audit procedures.
5. Link procedures to financial statement assertions.
6. Explain basic audit sampling concepts and calculate a simple sampling interval.
7. Evaluate exceptions, misstatements, and contradictory evidence.
8. Recognize ethical, technological, and professional issues in evidence gathering.

1. The Nature and Purpose of Audit Evidence

Audit evidence consists of information used by the auditor in arriving at the conclusions on which the audit opinion is based. It includes information contained in accounting records and information obtained from other sources.

Examples include:

• invoices, receipts, contracts, and bank statements;
• journal entries and general ledger records;
• physical examination of inventory or assets;
• written responses from customers, suppliers, banks, or lawyers;
• explanations provided by management and employees;
• recalculations and independent estimates;
• comparisons, ratios, trend analysis, and other analytical results.

Evidence is obtained to evaluate management’s assertions about the financial statements. Common assertions include:

A procedure is useful only when it addresses a relevant assertion. For example, inspecting a fixed asset may provide evidence of existence, but it does not by itself prove ownership or correct valuation.

Sufficient and Appropriate Evidence

Sufficiency refers primarily to the quantity of evidence. The amount required depends on factors such as:

• the assessed risk of material misstatement;
• the materiality of the item;
• the quality and reliability of available evidence;
• the auditor’s experience with the entity;
• the results of previous procedures.

Appropriateness refers to the quality of evidence. It has two important dimensions:

• Relevance: whether the evidence helps address the specific audit objective or assertion.
• Reliability: whether the evidence can be trusted.

High-quality evidence may reduce the quantity needed, but it does not eliminate the need for professional judgment. A large quantity of weak evidence is not necessarily persuasive.

2. Relevance and Reliability of Evidence

Evidence is relevant when it relates directly to the assertion being tested. A bank confirmation is highly relevant to the existence and completeness of a bank balance, but less directly relevant to the valuation of obsolete inventory.

Reliability is influenced by the source, nature, and circumstances in which evidence is obtained. The following general principles are useful:

1. Evidence obtained from an independent external source is often more reliable than evidence generated internally.
2. Evidence obtained directly by the auditor is often more reliable than evidence obtained indirectly.
3. Documentary evidence is often more reliable than oral explanations, although documents may be incomplete or falsified.
4. Original documents are generally more reliable than copies, scanned documents, or unofficial reproductions.
5. Internal evidence is more reliable when related controls are operating effectively.
6. Evidence is stronger when different sources or procedures produce consistent results.

These are general tendencies, not absolute rules. An external confirmation may be unreliable if the auditor does not control the confirmation process or if the respondent lacks relevant knowledge. A management-generated report may be reliable when strong controls ensure completeness and accuracy.

Evidence and Professional Skepticism

Professional skepticism means maintaining a questioning mind and critically assessing audit evidence. The auditor should not assume that management is dishonest, but neither should the auditor accept explanations without appropriate support. Contradictory evidence, unusual transactions, missing documents, and delays in providing information may indicate increased risk.

The auditor should ask:

• What assertion does this evidence support?
• Who prepared or supplied it?
• Could it be biased, incomplete, or altered?
• Does it agree with other evidence?
• What evidence would contradict it?
• Is additional work necessary?

3. Core Audit Procedures

3.1 Inspection

Inspection involves examining records, documents, or tangible assets. Documentary inspection may involve checking purchase invoices, payroll records, loan agreements, board minutes, or title documents. Physical inspection may involve examining inventory, equipment, cash, or property.

Inspection can provide evidence about existence, authorization, ownership, accuracy, and classification. Its limitations must be recognized. Inspecting an asset does not prove that the entity owns it, that it is correctly valued, or that all assets have been recorded.

For example, an auditor inspecting a vehicle may observe its registration number and physical condition. To address rights, the auditor may also inspect the purchase agreement and registration documents. To address valuation, the auditor may examine depreciation calculations and impairment indicators.

3.2 Observation

Observation involves watching a process or procedure being performed by others. An auditor may observe an inventory count, cash count, segregation-of-duties control, or opening of mail containing customer payments.

Observation provides evidence about the performance of a process at a particular time. It is especially useful for evaluating whether an inventory count is conducted according to instructions. However, people may change their behavior when they know they are being observed. Observation also provides evidence only for the period observed; it does not prove that the procedure operated consistently throughout the year.

During an inventory observation, the auditor may:

• assess whether counting instructions are followed;
• inspect the condition of inventory;
• perform independent test counts;
• record the last and first goods-received and goods-dispatched numbers;
• identify damaged, obsolete, or slow-moving items;
• investigate movements during the count.

3.3 External Confirmation

External confirmation is audit evidence obtained through a direct written response from a third party. Common confirmations include bank balances, trade receivables, legal claims, loan terms, and inventories held by third parties.

The auditor should control the confirmation process by selecting the confirming party, preparing or approving the request, sending it directly, and receiving the response directly. A non-response is not equivalent to confirmation. The auditor should perform alternative procedures, such as inspecting subsequent cash receipts or underlying contracts.

Positive confirmation requests ask the respondent to reply whether the information is correct or incorrect. Negative confirmation requests ask the respondent to reply only if the information is incorrect. Positive confirmations generally provide stronger evidence, particularly where risk is high or balances are significant. Negative confirmations may be appropriate when assessed risk is low, many small homogeneous balances exist, and the auditor expects few errors.

A confirmation response must also be evaluated for authenticity and reliability. Electronic responses may require attention to the respondent’s identity, email domain, system security, and the possibility of interception or manipulation.

3.4 Inquiry

Inquiry involves seeking information from knowledgeable persons inside or outside the entity. It may be formal, such as a written request to the legal adviser, or informal, such as asking an accounts clerk why an unusual journal entry was posted.

Inquiry is useful for understanding processes, identifying risks, and explaining unexpected results. However, inquiry alone usually provides less persuasive evidence than independent documentary or externally obtained evidence. Important oral explanations should be corroborated and documented, including the person questioned, date, subject, response, and any supporting evidence.

3.5 Recalculation

Recalculation means checking the mathematical accuracy of documents or records. Examples include recalculating:

• invoice extensions and totals;
• depreciation expense;
• payroll deductions;
• interest expense;
• inventory quantities multiplied by unit costs;
• tax computations;
• provisions based on contractual percentages.

For a simple straight-line depreciation calculation, assuming no residual-value change or impairment:

Cost and residual value are monetary amounts, and useful life is normally expressed in years. The formula applies to the straight-line method and does not apply unchanged to reducing-balance or units-of-production methods.

Recalculation tests numerical accuracy, not necessarily the reasonableness of the underlying assumptions. An auditor may correctly recalculate a provision that is based on an unreasonable expected loss rate.

3.6 Reperformance

Reperformance is the auditor’s independent execution of a control or procedure originally performed by the entity. For example, the auditor may independently match a sample of purchase orders, goods-received notes, and invoices to test a three-way matching control.

Reperformance is often strong evidence about whether a control operated for the selected items. It does not automatically prove that the control operated throughout the year. The auditor must consider the period covered, the selection method, the competence of the person who performed the original control, and whether the auditor’s reproduction used the same information available at the time.

3.7 Analytical Procedures

Analytical procedures involve evaluating financial information by studying plausible relationships among financial and non-financial data. They include comparisons, ratio analysis, trend analysis, reasonableness tests, and investigations of unexpected relationships.

Examples include:

• comparing current-year gross margin with prior years;
• comparing payroll expense with headcount;
• comparing electricity expense with production volume;
• comparing receivable days with credit terms;
• estimating interest expense from average borrowings and interest rates.

A common ratio is the gross profit margin:

The ratio is meaningful only when revenue and gross profit are measured consistently and when comparisons are made with appropriate periods, budgets, or industry information.

Analytical procedures are used at three stages:

1. Planning: to identify unusual relationships and areas of risk.
2. Substantive testing: to obtain evidence where relationships are sufficiently predictable.
3. Overall review: to assess whether the financial statements are consistent with the auditor’s understanding of the entity.

An analytical expectation should be sufficiently precise to identify a likely material misstatement. If an expected expense is 500,000 and the acceptable difference is 20,000, an actual expense of 548,000 requires investigation. The appropriate threshold depends on materiality and risk; it should not be selected arbitrarily.

4. Matching Procedures to Assertions

Audit procedures should be designed from the audit objective, not selected merely because they are familiar. The direction of testing is important.

For completeness of liabilities, an auditor may begin with external evidence such as subsequent payments, unpaid invoice files, goods-received notes, and supplier statements, then trace items into the accounting records. For existence of recorded assets, the auditor may begin with the ledger and vouch selected entries to supporting documents or physical assets.

No single procedure normally addresses every assertion. A well-designed audit combines procedures so that weaknesses in one form of evidence are addressed by another.

5. Audit Documentation and Evidence Evaluation

Audit documentation should enable an experienced auditor, having no previous connection with the audit, to understand the work performed, evidence obtained, significant matters identified, and conclusions reached. Documentation commonly records:

• the objective and assertion tested;
• the population and selection method;
• items examined;
• exceptions identified;
• evidence obtained;
• discussions and explanations;
• the auditor’s conclusion and follow-up work.

A conclusion such as “checked and satisfactory” is usually inadequate because it does not explain what was checked or why the result was satisfactory. Good documentation is clear, dated, cross-referenced, and sufficiently detailed without becoming irrelevant paperwork.

When evidence conflicts, the auditor should not simply select the evidence that supports management’s preferred conclusion. The conflict should be investigated, the reliability of each source evaluated, and procedures expanded when necessary. If sufficient appropriate evidence cannot be obtained, the matter may affect the audit opinion.

6. Basic Audit Sampling

Meaning and Purpose

Audit sampling is the application of audit procedures to less than 100% of items within a population, such that every sampling unit has a chance of selection. The objective is to provide a reasonable basis for conclusions about the population.

A population is the complete set of data from which a sample is selected, such as all sales invoices during the year. A sampling unit is an individual item, such as one invoice or one customer balance. The sample is the selected group of units.

Sampling is appropriate when testing all items would be inefficient or unnecessary. However, some items may be examined completely, especially individually material or high-risk items. Sampling is not a substitute for sound audit planning.

Sampling Risk and Non-sampling Risk

Sampling risk is the risk that the conclusion based on the sample differs from the conclusion that would have been reached if the entire population had been tested. It includes:

• concluding that a control is effective when it is not; and
• concluding that a material misstatement exists when the population is not materially misstated.

Non-sampling risk arises from causes unrelated to sample size, such as applying an inappropriate procedure, misunderstanding evidence, failing to recognize an exception, or making a recording error. Increasing sample size does not eliminate non-sampling risk.

Statistical and Non-statistical Sampling

Statistical sampling uses random selection and probability theory to evaluate sampling risk. Non-statistical sampling uses professional judgment without formally quantifying sampling risk. Both can be appropriate if properly designed and applied. Haphazard selection is not the same as careless selection; the auditor should avoid conscious bias and give items a reasonable opportunity for selection.

Common selection methods are:

• Random selection: every unit has a known chance of selection.
• Systematic selection: select items at a calculated interval after a random start.
• Haphazard selection: select without a deliberate pattern, while avoiding bias.
• Block selection: select a contiguous group of items; this may be less representative if transactions are clustered.
• Targeted selection: select specific high-value, unusual, or risky items. This is useful but does not by itself support a conclusion about the entire population.

Simple Sampling Interval

For a systematic sample, a basic interval can be calculated as:

Population size and sample size must be expressed in the same unit, such as number of invoices. The calculation assumes a suitable ordered population and a sampling design in which the interval is appropriate. A random start between 1 and the interval should normally be selected before choosing every interval-th item.

Worked example. An auditor has 2,400 sales invoices and plans to select 60 invoices systematically.

If the random start is 17, the selected positions are 17, 57, 97, 137, and so on, until 60 items have been selected. The random start prevents the selection from always beginning at the same point. The auditor must still consider whether periodic patterns in the population could make systematic selection unrepresentative.

This simple interval is not a complete statistical sample-size formula. A formal sample size may also depend on tolerable misstatement, expected misstatement, confidence or risk level, population variability, and whether monetary-unit or attribute sampling is used.

Attribute Sampling for Controls

Attribute sampling is commonly used to test whether a control was applied. Each selected item is classified according to whether the control deviation occurred.

Important terms are:

• Tolerable deviation rate: the maximum deviation rate the auditor is willing to accept while still relying on the control.
• Expected deviation rate: the deviation rate the auditor expects to find.
• Observed deviation rate: deviations found in the sample divided by sample size.

The observed deviation rate is:

For example, if 4 deviations are found in a sample of 80 purchase transactions:

The observed rate is not automatically the final conclusion. The auditor must consider sampling risk, the nature and cause of deviations, whether deviations are isolated or systematic, and the effect on reliance on the control. A deviation may also indicate a financial misstatement even when the control conclusion is acceptable.

Substantive Sampling and Projection

When testing monetary misstatements, the auditor may project sample misstatements to the population. A simple ratio projection is:

This approach is suitable only under appropriate assumptions, such as a meaningful relationship between the tested sample and the population. It is not a universal rule for every sampling design. The auditor must also consider sampling risk, individually significant items, and the possibility that misstatements are concentrated in particular strata.

If a population is divided into strata, high-value or high-risk items may be tested separately while the remaining items are sampled. This can improve efficiency, but conclusions must be drawn carefully for each stratum and the population as a whole.

7. Illustrative Case: Testing Revenue and Receivables

Background

This illustrative case concerns Meridian Office Supplies, a wholesaler with annual revenue of 18 million currency units. The entity offers customers 30-day credit terms. Management reports that revenue increased by 28%, while the market is believed to have grown by approximately 8%.

Problem

The auditor identifies risks relating to fictitious sales, premature revenue recognition, and uncollectible receivables. Management explains that a large December promotion caused the growth.

Analysis

The auditor performs the following procedures:

1. Compares monthly sales with the prior year and identifies an unusual spike in the final week of December.
2. Selects sales invoices immediately before and after year-end and agrees them to dispatch records to test cut-off.
3. Confirms a sample of customer balances using positive confirmation requests.
4. For non-responses, examines cash received after year-end and correspondence with customers.
5. Inspects credit notes issued after year-end for evidence that December sales were subsequently reversed.
6. Recalculates invoice totals and discounts.
7. Observes that several dispatch documents were prepared in January for goods invoiced in December.
8. Discusses the exceptions with the sales manager and obtains warehouse records.

Approach and Solution

The evidence indicates that some sales were recorded before dispatch. The auditor expands cut-off testing, examines all large December invoices, and evaluates whether the misstatements are isolated or systematic. The auditor also reassesses the allowance for doubtful debts because overdue receivables increased significantly.

Analytical procedures provide an important warning, but they do not prove the amount of misstatement. Confirmation, inspection, subsequent-receipt testing, and cut-off work provide more direct evidence. If management refuses to correct material premature revenue recognition, the matter may affect the audit opinion.

Outcome

Management agrees to reverse the premature sales and increases the receivables allowance. The auditor documents the original risk assessment, procedures performed, exceptions, management’s corrections, and the final conclusion.

Learning Points

• An unexpected trend is a risk indicator, not proof of fraud.
• Procedures should address specific assertions.
• Non-responses to confirmations require alternative procedures.
• Cut-off testing is particularly important around the reporting date.
• Evidence from several independent procedures is more persuasive than one management explanation.

8. Limitations, Ethics, and Technology

Audit evidence has inherent limitations. Documents may be incomplete, estimates may involve uncertainty, and management may deliberately conceal information. Audits provide reasonable, not absolute, assurance. Sampling also means that some errors may remain undetected.

Auditors must maintain confidentiality, independence, professional competence, and due care. Evidence must not be fabricated, altered, selectively omitted, or obtained through improper disclosure of confidential information. Confirmation requests should protect personal and commercial data. Access to client systems should be authorized and appropriately controlled.

Technology has changed evidence collection. Data analytics can test entire populations, identify duplicate payments, detect unusual journal entries, and examine transactions near year-end. Optical character recognition can extract information from invoices, while automated tools can compare purchase orders, receiving reports, and invoices.

Testing an entire digital population does not automatically eliminate audit risk. The auditor must understand data extraction, completeness, accuracy, system interfaces, access controls, and the logic of the analytic routine. Artificial intelligence may help classify transactions or identify anomalies, but it can produce false positives, reflect biased training data, or obscure the reasoning behind a result. Human judgment, professional skepticism, and documentation remain essential.

9. Best-Practice Checklist

A competent evidence process should:

1. Begin with risks, assertions, materiality, and audit objectives.
2. Select procedures that are relevant to those objectives.
3. Consider both the quality and quantity of evidence.
4. Obtain independent evidence where risk is significant.
5. Control external confirmation procedures.
6. Corroborate inquiry with documentary or other reliable evidence.
7. Investigate exceptions rather than ignoring them.
8. Use a defensible method for selecting samples.
9. Distinguish sampling risk from non-sampling risk.
10. Document the population, sample, procedures, results, and conclusion.
11. Reassess risk when evidence is contradictory or unexpected.
12. Protect confidential information and comply with applicable standards.

Chapter Summary

Audit evidence is the information supporting an auditor’s conclusions. Its sufficiency concerns quantity, while its appropriateness concerns relevance and reliability. Evidence quality depends on its source, form, independence, control environment, and consistency with other evidence.

The principal audit procedures are inspection, observation, external confirmation, inquiry, recalculation, reperformance, and analytical procedures. Each procedure has particular strengths and limitations, and each should be linked to relevant financial statement assertions. No single procedure normally proves every assertion.

Audit sampling allows the auditor to draw conclusions about a population without examining every item. Sampling risk differs from non-sampling risk, and selection must be designed to reduce bias. A basic systematic sampling interval is population size divided by sample size, but formal sample design requires consideration of risk, materiality, expected error, and the sampling approach.

Professional skepticism, careful documentation, ethical conduct, data security, and informed use of technology are essential. Auditors must investigate contradictory evidence and recognize that even sophisticated procedures provide reasonable rather than absolute assurance.

Key Terms

Audit evidence: Information used by the auditor to support audit conclusions.

Sufficiency: The quantity of audit evidence.

Appropriateness: The quality of audit evidence, including relevance and reliability.

Relevance: The connection between evidence and the audit objective or assertion.

Reliability: The degree to which evidence can be trusted.

Assertion: A representation by management about an element of the financial statements.

Inspection: Examination of records, documents, or physical assets.

Observation: Watching a process or procedure being performed.

External confirmation: Evidence obtained directly from an independent third party.

Inquiry: Seeking information from knowledgeable persons.

Recalculation: Checking the mathematical accuracy of records or documents.

Reperformance: Independently executing a procedure or control.

Analytical procedures: Evaluation of financial information through plausible relationships and comparisons.

Population: The complete set of items from which a sample is selected.

Sampling unit: An individual item in the population.

Sampling risk: The risk that a sample-based conclusion differs from a full-population conclusion.

Non-sampling risk: Audit risk caused by factors other than sample size.

Tolerable deviation rate: The maximum control deviation rate the auditor is willing to accept.

Cut-off: Recording transactions in the correct accounting period.

Professional skepticism: A questioning mind and critical assessment of audit evidence.

Review Questions

Short Answer Questions

1. Distinguish between sufficiency and appropriateness of audit evidence.
2. State two factors that influence the reliability of audit evidence.
3. What is the difference between observation and reperformance?
4. Why does a confirmation non-response not prove that a balance is correct?
5. Define sampling risk and non-sampling risk.

Long Answer Questions

1. Explain the main audit procedures and discuss the strengths and limitations of each.
2. Describe how an auditor can test the existence, completeness, valuation, and cut-off assertions for inventory.
3. Explain how professional skepticism affects the evaluation of management explanations.
4. Discuss the factors an auditor should consider when designing a sample.
5. Explain how analytical procedures are used during planning, substantive testing, and the overall review.

Analytical / Application Questions

1. An entity reports a 35% increase in December sales, but dispatch records show that several goods were shipped in January. Identify the relevant assertions and propose further audit procedures.
2. An auditor selects 100 purchase invoices and finds 3 deviations from the required approval control. Calculate the observed deviation rate and explain why this result alone is insufficient for a final conclusion.
3. A population contains 3,000 invoices and the auditor plans a systematic sample of 75 items. Calculate the sampling interval, describe how a random start should be used, and identify one limitation of systematic selection.

Multiple Choice Questions with Answers

Question 1

Which characteristic primarily concerns the quality of audit evidence?

A. Sufficiency

B. Appropriateness

C. Population size

D. Sample interval

Correct Answer: B. Appropriateness

Question 2

Which procedure is most directly designed to obtain evidence from a customer about a receivable balance?

A. External confirmation

B. Observation

C. Recalculation

D. Inventory inspection

Correct Answer: A. External confirmation

Question 3

What is a key limitation of observing an inventory count?

A. It cannot provide any evidence about inventory

B. It proves ownership of all inventory

C. It provides evidence mainly for the period observed

D. It automatically proves valuation is correct

Correct Answer: C. It provides evidence mainly for the period observed

Question 4

An auditor independently repeats a three-way match control. Which procedure is being used?

A. Inquiry

B. Reperformance

C. Confirmation

D. Analytical procedure

Correct Answer: B. Reperformance

Question 5

A population contains 2,400 invoices and the planned sample is 60 invoices. What is the basic sampling interval?

A. 24

B. 40

C. 60

D. 144

Correct Answer: B. 40

Question 6

Four deviations are found in a sample of 80 transactions. What is the observed deviation rate?

A. 2%

B. 4%

C. 5%

D. 20%

Correct Answer: C. 5%

Question 7

Which procedure is especially useful for identifying unusual relationships between payroll expense and employee numbers?

A. Analytical procedure

B. Physical inspection

C. Positive confirmation

D. Title inspection

Correct Answer: A. Analytical procedure

Question 8

Which assertion is most directly addressed by tracing receiving reports to recorded supplier invoices?

A. Existence of sales

B. Completeness of liabilities

C. Rights to cash

D. Classification of equity

Correct Answer: B. Completeness of liabilities

Question 9

What does non-sampling risk include?

A. Selecting fewer items than the population contains

B. A conclusion differing because of random selection

C. Misunderstanding or incorrectly applying audit evidence

D. Using a random start in systematic sampling

Correct Answer: C. Misunderstanding or incorrectly applying audit evidence

Question 10

A confirmation non-response is received for a significant receivable. What should the auditor generally do?

A. Treat the balance as confirmed

B. Ignore the balance

C. Perform appropriate alternative procedures

D. Automatically record the balance as fraudulent

Correct Answer: C. Perform appropriate alternative procedures