Audit Execution and Evidence Collection

Introduction

An audit becomes valuable not when an audit plan is approved, but when auditors obtain, evaluate, and communicate reliable evidence about how an organization actually operates. Audit execution is therefore the point at which audit criteria are compared with observable practice. It requires disciplined interaction with people, processes, documents, records, technology, and physical conditions.

In quality management, evidence collection is not a search for mistakes or an attempt to accumulate the largest possible number of documents. It is a structured inquiry into whether processes are planned, implemented, controlled, measured, and improved. The auditor must reach conclusions that are defensible, proportionate to the evidence, and useful to process owners and decision-makers.

This chapter explains the execution of on-site, hybrid, and remote audits. It focuses on opening meetings, interviews, observation, document and record review, process tracing, site verification, sampling, triangulation, traceability, and evidence sufficiency. It also considers professional judgment, audit ethics, technology, and the limitations of different evidence sources.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Conduct an effective audit opening meeting.
2. Select and apply appropriate interview, observation, document-review, and site-verification techniques.
3. Trace processes across inputs, activities, outputs, controls, and records.
4. Apply sampling and triangulation without overstating conclusions.
5. Assess the relevance, reliability, sufficiency, and traceability of audit evidence.
6. Adapt audit execution to on-site, hybrid, and remote environments.
7. Record objective evidence and formulate clear, fair, and evidence-based findings.

1. The Logic of Audit Execution

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Audit criteria may include a quality standard, regulatory requirement, contractual condition, internal procedure, customer specification, or organizational objective.

The relationship among criteria, evidence, and findings can be represented as follows:

Audit criteria → Audit evidence → Evaluation → Audit finding → Conclusion

A criterion states what should exist or occur. Evidence indicates what does exist or occur. Evaluation compares the two. A finding expresses conformity, nonconformity, or an opportunity for improvement, depending on the audit mandate and reporting rules. A conclusion is a broader judgment about the effectiveness, adequacy, or suitability of the audited system or process.

A useful distinction is between an audit trail and an audit finding. The audit trail is the route followed by the auditor through people, information, records, transactions, and physical activities. A finding is the evaluated result of that trail. A well-designed audit trail reduces the risk that the auditor forms a conclusion from an isolated or unrepresentative observation.

Evidence quality

Evidence should be assessed using four related questions:

• Relevance: Does the evidence address the audit criterion?
• Reliability: Is the source credible, authentic, and sufficiently independent?
• Sufficiency: Is there enough evidence to support the conclusion?
• Traceability: Can another competent person follow the evidence back to its source and understand how the finding was reached?

Evidence is not automatically strong because it is written, digital, or produced by a senior employee. A controlled record may be reliable for demonstrating that an entry was made, but it may not prove that the underlying activity was performed correctly. Conversely, direct observation may demonstrate actual practice, but it is limited to the period observed.

2. The Opening Meeting

The opening meeting establishes the working relationship between the audit team and the audited organization. It should be purposeful rather than ceremonial. Its primary function is to confirm the audit framework and create conditions for honest, efficient cooperation.

The lead auditor normally confirms:

• the purpose, scope, and criteria of the audit;
• the audit team and responsibilities;
• the process owners and guides or escorts;
• the audit timetable, locations, and communication arrangements;
• methods of evidence collection, including interviews, sampling, and observation;
• arrangements for access to personnel, systems, records, and facilities;
• confidentiality, safety, security, and privacy requirements;
• procedures for communicating emerging issues;
• the classification and treatment of potential findings;
• the method and timing of daily updates and the closing meeting.

The opening meeting should also clarify what the audit will not cover. Ambiguous scope creates conflict later, particularly where processes cross organizational or departmental boundaries.

Conduct of the meeting

A professional opening meeting is concise and respectful. The auditor should explain that the audit evaluates processes and evidence rather than personal worth. This distinction is important because fear can encourage concealment, rehearsed answers, or excessive dependence on selected representatives.

The auditor should avoid promising a favorable result, implying that every issue will become a nonconformity, or suggesting that the audit is an inspection of individual performance. Questions should be invited, particularly about access, operational constraints, safety, and confidentiality.

In a remote or hybrid audit, the opening meeting should additionally confirm:

• platform access and backup communication channels;
• screen-sharing and recording rules;
• identity verification for participants;
• methods for showing physical areas or equipment;
• secure transfer and retention of documents;
• arrangements for interruptions, bandwidth failure, and time-zone differences.

Recording an online meeting or screen session should not be assumed to be permissible. Consent, privacy legislation, organizational policy, and contractual restrictions must be considered.

3. Interviewing as an Audit Technique

Interviews provide access to knowledge that may not be visible in documents or during a short observation. They are especially useful for understanding decision rules, informal controls, exceptions, escalation routes, and the reasons behind process variation.

An effective interview usually moves from broad to specific questions:

1. “Please describe how this activity is normally performed.”
2. “Who is responsible for each step?”
3. “What information or criteria do you use?”
4. “What happens when the expected result is not achieved?”
5. “Can you show me a recent example?”
6. “How do you know that the process is effective?”

This sequence allows the auditor to compare explanation with practice and records without prematurely suggesting an answer.

Good interviewing practice

Auditors should use open questions initially, followed by probing questions. They should listen actively, avoid interrupting, distinguish facts from opinions, and summarize important statements for confirmation. Questions should be neutral. “How is obsolete material prevented from use?” is generally more useful than “You do prevent obsolete material from use, don’t you?”

Interview evidence should normally be corroborated. A person’s statement can establish awareness or reported practice, but it does not necessarily establish implementation or effectiveness. If an employee states that calibration status is checked before use, the auditor may inspect a recent instrument, observe the check, and examine associated records.

Interviewing should include people who perform the work, not only supervisors. Operators, inspectors, planners, maintenance personnel, and support staff may reveal process realities that formal descriptions omit. However, the auditor must avoid turning interviews into interrogations. Respectful treatment improves evidence quality and protects psychological safety.

Interview limitations

Interviewees may misunderstand a question, describe the desired rather than actual process, rely on memory, or alter behavior because they feel observed. The auditor should therefore record the statement accurately and identify it as interview evidence until it is corroborated. Differences between accounts are not automatically evidence of nonconformity; they may indicate unclear procedures, role ambiguity, or normal variation requiring further investigation.

4. Observation and Site Verification

Observation provides direct evidence of activities, conditions, interactions, and controls. It is particularly important where performance depends on physical arrangement, human behavior, equipment status, environmental conditions, or real-time decisions.

Examples include observing:

• material identification and segregation;
• use of approved work instructions;
• line clearance before production;
• inspection and testing activities;
• cleanliness and environmental controls;
• handling of nonconforming outputs;
• access control and protection of records;
• maintenance, calibration, and equipment status;
• emergency, safety, or contamination controls.

Observation should be planned around process risk. A brief walk-through is not equivalent to a systematic site verification. The auditor should identify what is being verified, where it should be found, what acceptable condition looks like, and what evidence will be recorded.

Site-verification discipline

The auditor should distinguish between a condition and an interpretation. “Three containers in the staging area had no status labels at 10:20 a.m.” is an observation. “The organization has no identification system” is an interpretation that requires broader evidence.

Site verification should consider:

• location and time;
• equipment or material identification;
• relevant process stage;
• observed condition;
• responsible role, where relevant;
• applicable criterion;
• photographs or other records, when authorized.

Photography can improve accuracy but creates privacy, security, intellectual-property, and data-protection risks. Images should be necessary, authorized, securely stored, and limited to the audit purpose.

5. Document and Record Review

Documents describe intended arrangements, while records provide evidence of activities or results. The distinction is not absolute: a completed electronic form may function as both a record and evidence of a control, while a procedure may include historical revision information.

Reviewing documented information

The auditor should examine whether documents are:

• approved and current;
• available where needed;
• understandable and usable;
• protected against unauthorized change;
• appropriately controlled for revision and distribution;
• consistent with actual practice;
• retained or disposed of according to requirements.

Document review should not become an administrative exercise in which the existence of a procedure is treated as proof of implementation. The central question is whether documented arrangements are suitable and whether they are followed or consciously controlled when exceptions occur.

Reviewing records

Records may include inspection results, training evidence, maintenance histories, customer complaints, corrective-action records, batch files, supplier evaluations, audit trails, test results, and performance dashboards.

For each record, the auditor should consider:

• authenticity and origin;
• date, product, process, or transaction reference;
• completeness and legibility;
• authorization or review status;
• evidence of required actions;
• links to deviations, approvals, or follow-up;
• retention and protection;
• consistency with other records and with observed practice.

Electronic records require additional attention to access rights, version control, timestamps, audit trails, system interfaces, and the possibility of retrospective alteration. A screenshot may show a current display but may not preserve metadata, history, or the identity of the person who made a change.

6. Process Tracing and Traceability

Process tracing follows an item, transaction, customer requirement, or information flow through the organization. It is one of the strongest methods for connecting documented requirements with actual performance.

A forward trace begins with an input and follows it toward the output. For example, an auditor may trace a customer order through contract review, planning, procurement, production, inspection, release, delivery, and complaint handling. A backward trace begins with a delivered product, complaint, or completed record and works back toward its origin.

The basic traceability chain is:

Requirement → Input → Process activity → Control → Output → Record → Feedback or improvement

A trace is complete only when the auditor can identify the relevant linkages and determine whether information remains accurate as it moves between stages. Breaks may occur when identifiers are changed, records are duplicated manually, software systems do not interface correctly, or responsibilities transfer between departments.

Process-tracing questions

At each stage, the auditor can ask:

• What is the input?
• What requirement governs the activity?
• Who performs and authorizes it?
• What resources and competence are needed?
• What control prevents or detects error?
• What output is produced?
• What record demonstrates completion or acceptance?
• What happens when the output is unsuitable?
• How is information transferred to the next stage?

Process tracing is more informative than examining departments in isolation because quality failures often arise at interfaces. A purchasing department may have an effective supplier process, while production receives incomplete or ambiguous specifications. An inspection department may identify defects, while the disposition process fails to prevent unintended use.

7. Sampling and the Limits of Generalization

Auditors rarely examine every transaction, record, product, or employee. Sampling is therefore necessary, but it introduces uncertainty. The sample must be selected in a way that is appropriate to the audit objective and the risk of the process.

A sample may be selected using:

• judgmental sampling, emphasizing risk, change, complexity, complaints, or unusual results;
• random sampling, giving units a known and generally equal opportunity of selection;
• systematic sampling, selecting every kth unit after a defined starting point;
• stratified sampling, dividing the population into relevant groups and sampling each group;
• haphazard sampling, selecting conveniently without a defined probability basis.

No sampling method automatically guarantees representativeness. Judgmental sampling is often appropriate for risk-based audits, but it does not support claims about the exact prevalence of a condition in the whole population. Random sampling can reduce selection bias, but it may miss rare, high-consequence events unless the sample design accounts for risk.

Sample-size reasoning

For an approximate estimate of a population proportion under simple random sampling, a commonly used planning expression is:

Here, n₀ is the preliminary sample size, z is the standard normal multiplier associated with the desired confidence level, p is the anticipated proportion, and e is the tolerated margin of sampling error. The expression assumes a probability sample, independence, and an adequately defined population. It is not a universal audit sample-size rule.

If the population is finite, a finite-population adjustment may be used:

where N is the population size and n is the adjusted sample size. In audit practice, sample size must also reflect consequence, process maturity, prior results, changes, population homogeneity, time available, and the objective of the audit. Statistical formulas should not create false precision where the population definition or selection method is weak.

Illustrative calculation

Suppose a large population is being sampled to estimate a proportion, with anticipated proportion p = 0.50, tolerated error e = 0.05, and a 95% confidence multiplier z ≈ 1.96. Then:

The preliminary sample size is therefore approximately 385 units. This calculation is illustrative, not a substitute for an audit sampling plan. If the population is small, risk is high, or the sample is judgmental, a different approach is required.

Auditors must distinguish “no issue found in the sample” from “no issue exists in the population.” The first statement is supportable when the sample and work are documented; the second usually exceeds the evidence.

8. Triangulation and Evidence Sufficiency

Triangulation means examining a question through multiple evidence sources, methods, observers, locations, or time periods. In audit execution, it is used to test consistency and reduce dependence on a single potentially biased source.

For example, a control over training competence may be examined through:

1. the competence requirement or procedure;
2. the employee’s explanation of the task;
3. training and authorization records;
4. direct observation of performance;
5. evidence of process results or errors.

Agreement among sources increases confidence, although it does not prove perfection. Disagreement is diagnostically useful. It may reveal an outdated procedure, inconsistent implementation, inaccurate records, inadequate training, or a poorly defined requirement.

Evidence is sufficient when a competent auditor, using the documented evidence and audit criteria, could reasonably reach the same conclusion. Sufficiency is therefore a matter of professional judgment, not merely volume. Ten repetitive records from one shift may be less persuasive than a smaller but well-designed set covering different shifts, products, operators, and process conditions.

A practical sufficiency test is:

• Have the relevant criteria been identified?
• Has the evidence been obtained from more than one appropriate source where necessary?
• Does the evidence cover the scope and risk of the conclusion?
• Have contradictory data been investigated?
• Can the evidence be independently retraced?
• Is the conclusion stated no more broadly than the evidence permits?

9. Recording Objective Evidence and Findings

Working notes should be factual, concise, dated, and linked to the criterion. They should distinguish direct observation, document review, interview statements, analytical inference, and auditor judgment.

A strong finding normally contains four elements:

1. Requirement: What criterion applies?
2. Evidence: What was observed, reviewed, or confirmed?
3. Condition: What actually occurred or failed to occur?
4. Significance: Why does the difference matter, where significance is required by the reporting system?

For example:

The internal procedure requires verification of measuring equipment before use. During observation on 14 March, instrument M-217 was in use on Line 3 without a current status label. The equipment register showed the last verification as expired on 28 February, and no approved extension was available. This evidence indicates that the required pre-use control was not effectively implemented for the sampled instrument.

The wording avoids speculation about cause. Root cause analysis belongs to the corrective-action process unless the audit mandate specifically includes it. Findings should also avoid exaggerated terms such as “always,” “never,” or “systematic” unless the evidence supports them.

10. On-Site, Hybrid, and Remote Audits

On-site audits

On-site audits permit direct access to people, facilities, equipment, materials, and physical conditions. Their limitations include travel constraints, observer effects, restricted access, and the possibility that activities are temporarily staged for the audit.

Remote audits

Remote audits can be effective for document review, interviews, data analysis, and observation of digitally mediated processes. Their limitations include weak visibility of physical conditions, unreliable connectivity, difficulty authenticating records, and limited control over what is shown to the auditor.

Remote evidence should be strengthened by requesting live navigation rather than preselected screenshots, examining system audit trails, using time-stamped demonstrations, interviewing multiple roles, and arranging follow-up verification where physical confirmation is material.

Hybrid audits

Hybrid audits combine local and remote participants. They require explicit coordination. A remote auditor may not hear informal conversations, see the full physical context, or know whether a camera is being directed selectively. The local team should therefore state what is visible, what is not visible, and who controls the device. Sensitive or high-risk activities may require on-site verification even when much of the audit is conducted remotely.

Technology can support audit execution through secure evidence rooms, workflow systems, data analytics, electronic signatures, process-mining tools, and automated exception reports. Artificial intelligence may assist in classifying records, identifying anomalies, or searching large document sets. However, AI outputs are not audit conclusions. They require validation, explainability, protection of confidential information, and human professional judgment.

11. Professional Judgment, Ethics, and Governance

Auditors must preserve impartiality, confidentiality, professional competence, and independence appropriate to the audit. Conflicts of interest should be disclosed before or during the audit. An auditor who designed or operated a process may be unable to evaluate it objectively, depending on the organization’s rules and the nature of the audit.

Evidence handling raises governance issues. Personal data, health information, customer information, trade secrets, and security-sensitive material should be accessed only when necessary and handled according to applicable law and policy. Auditors should minimize copies, use approved storage, restrict access, and securely dispose of working material.

Ethical risks include accepting gifts, coaching interviewees toward preferred answers, revealing confidential information, selectively ignoring adverse evidence, and allowing management pressure to alter findings. A fair auditor is neither an advocate for the auditee nor an adversary. The auditor’s duty is to evaluate evidence against agreed criteria.

12. Illustrative Case: Hybrid Audit of a Medical-Device Assembly Process

Background

A medical-device manufacturer conducted a hybrid internal audit of its final assembly and release process. The audit criteria included internal work instructions, customer specifications, competence requirements, equipment-control procedures, and requirements for nonconforming product.

Problem

The organization reported strong first-pass yield and no recent customer complaints. However, a prior audit had identified weaknesses in training records and component traceability. The audit team needed to determine whether controls were effective rather than relying on favorable performance indicators.

Analysis and approach

The lead auditor held an opening meeting with production, quality, engineering, and information-technology representatives. One auditor attended the facility, while another joined remotely. The team selected three finished-device orders using risk-based judgment: one recent order, one order involving a new operator, and one order associated with a changed component supplier.

The team traced each order backward from release records to inspection results, assembly records, component identification, and supplier documentation. It interviewed operators and the release approver, observed line clearance, reviewed electronic records, and compared the current work instruction with the version available at the workstation.

Triangulation produced mixed evidence. Operators correctly described the critical assembly steps, and final inspection records were complete. However, the workstation displayed an obsolete instruction revision. In addition, one component container had a legible internal identifier but no supplier lot reference. The enterprise system contained the supplier lot information, but the link had been entered manually after production rather than captured at receipt.

Finding and response

The evidence supported two findings. First, controlled work instructions were not consistently available at the point of use. Second, component traceability was incomplete at the physical staging point, creating a risk that material could be associated with the wrong supplier lot.

The audit team did not conclude that released devices were defective. That conclusion would have exceeded the evidence. Instead, it reported a control weakness, requested containment and impact assessment, and recommended examination of other orders and staging areas.

Outcome

Management quarantined the affected component inventory, verified lot identity against receiving records, removed obsolete workstation copies, and implemented electronic point-of-use access to current instructions. A follow-up review sampled orders from different shifts and confirmed improved traceability. The organization also changed the system interface so that the supplier lot was required before material could be issued.

Learning points

The case demonstrates that favorable outcomes do not prove effective controls. Process tracing revealed an interface weakness that department-level review might have missed. Triangulation connected interviews, observation, documents, electronic data, and physical conditions. Most importantly, the auditors stated the conclusion within the limits of the evidence.

13. Challenges and Best Practices

Common challenges include restricted access, incomplete records, language differences, confirmation bias, audit fatigue, poor sampling, excessive reliance on procedures, technology failure, and disagreement over finding wording. These challenges can be reduced through careful planning and disciplined execution.

Best practices include:

• begin with process risk and audit objectives, not a checklist alone;
• follow samples across interfaces and shifts where relevant;
• test both intended arrangements and actual performance;
• corroborate important interview statements;
• record evidence while it is fresh;
• investigate contradictions rather than selecting the convenient explanation;
• keep conclusions proportional to the sample and scope;
• communicate emerging concerns without prejudging the final finding;
• protect confidential and personal information;
• use technology to extend human judgment, not replace it;
• conduct follow-up based on risk and the significance of the finding.

Chapter Summary

Audit execution converts audit planning into defensible knowledge about process performance. The opening meeting establishes scope, criteria, responsibilities, access, and communication arrangements. Interviews reveal knowledge and informal practice, while observation and site verification provide direct evidence of activities and conditions. Document and record review distinguishes intended arrangements from evidence of implementation.

Process tracing connects requirements, inputs, activities, controls, outputs, and records across organizational interfaces. Sampling makes audit work feasible but limits the breadth of conclusions; auditors must not generalize beyond the design and quality of the sample. Triangulation strengthens confidence by comparing different evidence sources and exposes contradictions that require investigation.

Evidence must be relevant, reliable, sufficient, and traceable. Findings should identify the requirement, objective evidence, actual condition, and significance without speculation or exaggeration. On-site, remote, and hybrid audits each offer benefits and limitations, and technology—including AI—must remain subject to security, privacy, validation, and professional judgment. Effective auditors combine methodological discipline with fairness, skepticism, ethical conduct, and respect for the people whose processes they examine.

Key Terms

Audit evidence: Verifiable records, statements of fact, or other information relevant to audit criteria.

Audit trail: The logical route followed through processes, people, records, and systems during an audit.

Audit criterion: A requirement, policy, procedure, standard, specification, or expectation used for comparison.

Audit finding: The result of evaluating evidence against audit criteria.

Opening meeting: The initial formal discussion that establishes the audit framework and working arrangements.

Objective evidence: Information that can be verified and is based on fact rather than unsupported opinion.

Triangulation: Comparison of evidence from multiple sources, methods, observers, or time periods.

Traceability: The ability to follow the history, application, location, or relationship of an item or information.

Process tracing: Following an item, transaction, requirement, or information flow through connected process stages.

Site verification: Direct examination of physical conditions, activities, equipment, materials, or locations.

Judgmental sampling: Selection based on auditor judgment, risk, experience, or defined characteristics.

Random sampling: Selection in which population units have a known chance of selection.

Stratified sampling: Division of a population into groups followed by sampling within those groups.

Evidence sufficiency: The extent to which evidence supports a reasonable and defensible conclusion.

Documented information: Information that an organization controls and maintains, including documents and records.

Nonconformity: Failure to fulfill a specified requirement.

Hybrid audit: An audit using both on-site and remote participation or methods.

Professional judgment: Informed evaluation based on competence, evidence, criteria, and experience.

Confirmation bias: The tendency to favor evidence that supports an existing belief or expectation.

Review Questions

Short Answer Questions

1. What are the four principal qualities of useful audit evidence?
2. Why should interview statements normally be corroborated?
3. Distinguish between a document and a record in audit practice.
4. What is the purpose of process tracing?
5. State two limitations of remote auditing.

Long Answer Questions

1. Explain how an auditor should plan and conduct an effective opening meeting.
2. Compare interviews, observation, document review, and record review as evidence-collection methods.
3. Explain sampling risk and discuss how audit risk should influence sample selection.
4. Describe how triangulation can reveal weaknesses that are not visible from a single evidence source.
5. Discuss the ethical, privacy, and governance responsibilities involved in handling audit evidence.

Analytical / Application Questions

1. During an audit, an operator describes a control accurately, but three sampled records are incomplete and the control is not observed during the audit. What additional evidence should be obtained, and how should the auditor avoid overstating the finding?
2. A remote auditor sees a favorable production dashboard, while a local team member reports recurring rework. Design a triangulation plan to evaluate the contradiction.
3. An organization has a current procedure, complete records, and acceptable final-product results, but process tracing reveals that material identifiers are manually re-entered between two systems. Analyze the risks and propose an evidence-based audit conclusion.

Multiple Choice Questions with Answers

Question 1

Which sequence best represents the logic of an audit?

A. Finding → criterion → evidence → conclusion

B. Criterion → evidence → evaluation → finding → conclusion

C. Evidence → interview → procedure → sampling → conclusion

D. Conclusion → observation → criterion → finding

Correct Answer: B. Criterion → evidence → evaluation → finding → conclusion

Question 2

Which interview question is most open and neutral?

A. You always verify the equipment before use, don’t you?

B. Why did you fail to follow the procedure?

C. Please describe how this activity is normally performed.

D. Is the supervisor responsible for this control?

Correct Answer: C. Please describe how this activity is normally performed.

Question 3

What does triangulation primarily achieve?

A. It eliminates the need for sampling.

B. It guarantees that a process is effective.

C. It compares multiple evidence sources to strengthen evaluation.

D. It replaces the audit criteria with interview results.

Correct Answer: C. It compares multiple evidence sources to strengthen evaluation.

Question 4

Which statement best distinguishes a record from a procedure?

A. A record describes intended arrangements, while a procedure proves implementation.

B. A procedure describes intended arrangements, while a record provides evidence of an activity or result.

C. A record is always electronic, while a procedure is always paper-based.

D. A procedure is confidential, while a record is public.

Correct Answer: B. A procedure describes intended arrangements, while a record provides evidence of an activity or result.

Question 5

An auditor observes three unlabelled containers at 10:20 a.m. Which is the most objective statement?

A. The organization has no identification system.

B. Operators never identify materials correctly.

C. Three containers in the staging area had no status labels at 10:20 a.m.

D. The material-control process is completely ineffective.

Correct Answer: C. Three containers in the staging area had no status labels at 10:20 a.m.

Question 6

Which sampling method divides a population into relevant groups before selecting units?

A. Haphazard sampling

B. Systematic sampling

C. Stratified sampling

D. Convenience sampling

Correct Answer: C. Stratified sampling

Question 7

Using n₀ = z²p(1−p)/e², what is the approximate preliminary sample size when z = 1.96, p = 0.50, and e = 0.05?

A. 96

B. 196

C. 285

D. 385

Correct Answer: D. 385

Question 8

Which evidence source most directly demonstrates what is occurring at the time of the audit?

A. A current organizational chart

B. Direct observation

C. An old training presentation

D. A general management statement

Correct Answer: B. Direct observation

Question 9

What should an auditor do when evidence sources contradict one another?

A. Select the source that supports the preferred conclusion.

B. Ignore the contradiction if final results are acceptable.

C. Investigate the contradiction and obtain further appropriate evidence.

D. Automatically issue the most severe finding.

Correct Answer: C. Investigate the contradiction and obtain further appropriate evidence.

Question 10

Which statement about AI-generated audit analysis is most appropriate?

A. AI output is automatically objective evidence.

B. AI can replace the auditor’s professional judgment.

C. AI may assist analysis, but its output requires validation and governance.

D. AI removes privacy and confidentiality risks.

Correct Answer: C. AI may assist analysis, but its output requires validation and governance.