Audit Evidence, Testing, Sampling and Documentation

Introduction and context

A tax audit is a structured process for obtaining and evaluating evidence about a taxpayer’s compliance with tax law, accounting records, filing obligations and relevant administrative requirements. The auditor’s conclusion must be defensible: another suitably competent professional should be able to understand what was tested, why it was tested, what evidence was obtained, how exceptions were evaluated and how the final conclusion was reached.

Tax audit evidence differs from ordinary business evidence because it must often address both financial measurement and legal classification. For example, an invoice may demonstrate that a purchase occurred, but it may not prove that the purchase is deductible, that input tax is recoverable, that the supplier is genuine or that the expense relates to the taxpayer’s business. Effective tax auditing therefore combines accounting evidence, operational evidence, legal analysis and professional judgement.

This chapter explains the nature and quality of audit evidence; the principal evidence-gathering procedures; substantive and control testing; sampling; working papers; audit trails; ethical safeguards; and the use of technology. References to tax law, filing deadlines and audit powers must always be read together with the legislation and professional standards applicable in the relevant jurisdiction.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the meaning and characteristics of sufficient and appropriate audit evidence.
2. Select suitable procedures, including inspection, inquiry, observation, confirmation, recalculation and reperformance.
3. Distinguish tests of controls from substantive procedures and design procedures around tax assertions.
4. Apply risk-based sampling and interpret sampling results cautiously.
5. Prepare complete, clear and reviewable working papers and audit trails.
6. Evaluate contradictory evidence, exceptions, estimates and management representations.
7. Recognise ethical, confidentiality, data-protection and technology-related risks in tax audit work.

1. The nature and quality of audit evidence

Audit evidence consists of information used by the auditor in forming conclusions. It includes accounting records, tax returns, contracts, invoices, bank records, payroll data, correspondence, third-party confirmations, observations, analyses and information obtained from electronic systems.

Evidence has two central quality dimensions:

• Sufficiency is the quantity of evidence. The amount required depends on risk, materiality, population size, reliability of available information and the persuasiveness of other evidence.
• Appropriateness is the quality of evidence, comprising relevance and reliability. Relevant evidence addresses the assertion being tested. Reliable evidence is more likely to support the conclusion accurately and independently.

Quantity cannot compensate indefinitely for poor quality. A large volume of internally generated documents may be less persuasive than a single reliable external confirmation. Conversely, an external confirmation that addresses the wrong period or wrong tax issue may be irrelevant.

1.1 Evidence and tax assertions

Assertions are representations, explicit or implicit, about transactions, balances, disclosures and compliance. Common assertions in tax audit work include:

A well-designed procedure links the assertion, the risk, the evidence source and the conclusion. Testing a bank payment may support occurrence and payment, but it may not establish deductibility or correct tax classification.

1.2 Reliability hierarchy

Reliability is influenced by source, nature and controls over preparation. As a general principle, evidence is often more persuasive when it is:

• obtained directly by the auditor rather than passed through management;
• obtained from an independent external source;
• documentary rather than oral;
• original or securely preserved rather than an uncontrolled copy;
• generated by a system with effective access, change and processing controls; and
• consistent with other independent evidence.

This is not an absolute hierarchy. An external document can be fraudulent, while an internally generated system report may be reliable when strong controls exist. The auditor must evaluate the circumstances rather than apply a mechanical ranking.

2. Principal evidence-gathering procedures

2.1 Inspection

Inspection examines records, documents, tangible assets or electronic information. It may involve inspecting purchase invoices, customs documents, payroll registers, inventory, contracts, tax registrations, board minutes or system logs.

Inspection supports different assertions depending on the item. An invoice may support occurrence and amount; a title document may support rights; a sequence review may help identify completeness gaps. The auditor should record what was inspected, the relevant date or period, identifying details and the conclusion reached.

Inspection of a document does not automatically establish its authenticity. Important or unusual documents may require corroboration through payment records, counterparties, delivery evidence or external confirmation.

2.2 Inquiry

Inquiry seeks information from knowledgeable persons inside or outside the organisation. It is useful for understanding processes, identifying unusual transactions and explaining variances. Inquiry alone is ordinarily weaker than documentary or external evidence because responses may be mistaken, incomplete or biased.

Effective inquiry is specific. Instead of asking whether all sales were recorded, the auditor might ask who controls credit notes, how manual invoices are generated, what happens when goods are returned and whether any sales channels bypass the accounting system. Responses should be documented with the respondent’s role, date, subject, significant wording and corroborating procedures.

2.3 Observation

Observation involves watching a process being performed, such as a stock count, cash count, access approval or destruction of obsolete records. It provides evidence about performance at the time observed, but it does not prove that the process operated consistently before or after the observation. The auditor should consider whether staff changed their behaviour because they were being observed.

2.4 External confirmation

Confirmation obtains information directly from an independent third party. Examples include confirming bank balances, customer balances, supplier relationships, loan terms, tax payments or the existence of a transaction.

A positive confirmation requests a response whether the information is correct or incorrect. A negative confirmation requests a response only when the recipient disagrees. Positive confirmations are generally more persuasive for higher-risk matters, but non-response is not evidence that the balance is correct. Alternative procedures may include examining subsequent cash receipts, contracts, delivery records or independent statements.

The auditor should control the confirmation process: select recipients, prepare requests, send them directly, maintain control over responses and investigate unusual channels or responses. Electronic confirmation systems require attention to identity, authorisation and data security.

2.5 Recalculation

Recalculation checks mathematical accuracy in documents or records. Examples include recomputing depreciation, payroll withholding, indirect tax, interest, apportionment percentages, foreign-exchange translation or tax provision schedules.

For an amount calculated as a tax rate applied to a taxable base, the basic relationship is:

The taxable base and rate must be defined by the applicable law. The formula assumes that the transaction is within the tax base, the rate is applicable to the relevant period and no exemptions, thresholds, credits or special rules alter the result. Recalculation of arithmetic does not establish that the base or rate was legally selected correctly.

2.6 Reperformance

Reperformance means independently executing a control or procedure originally performed by the taxpayer or its staff. An auditor may reperform a reconciliation, approval check, tax-code validation, exception report or calculation workflow. Reperformance can provide strong evidence about whether a control operated for the selected item, although testing one instance does not prove consistent operation throughout the period.

3. Designing audit tests

Audit testing should proceed from risk and assertions rather than from documents that happen to be readily available. A practical design sequence is:

1. Identify the tax obligation and relevant legal requirements.
2. Identify inherent and control risks.
3. Determine the assertions affected.
4. Set materiality or another appropriate significance threshold.
5. Select procedures capable of addressing the risk.
6. Define the population, sampling unit and exception criteria.
7. Perform the work and record results.
8. Evaluate exceptions individually and in aggregate.
9. Extend testing or revise the conclusion where necessary.

3.1 Tests of controls

A test of controls evaluates whether a control was designed appropriately and operated effectively. Examples include checking whether tax-sensitive journal entries require approval, whether changes to tax codes are authorised, whether invoices are sequentially controlled and whether monthly tax reconciliations are reviewed.

The auditor must distinguish design from operating effectiveness. A written policy demonstrates design, not actual operation. Evidence of operation may include dated approvals, system logs, review notes and reperformance.

3.2 Substantive procedures

Substantive procedures detect material misstatements or non-compliance directly. They include detailed tests of transactions and balances, analytical procedures and legal or documentary evaluation. A substantive test of deductible expenses may inspect invoices, verify business purpose, trace payment and assess whether the expense is excluded by tax law.

Analytical procedures compare plausible relationships, such as taxable sales to reported indirect tax, payroll costs to employee numbers or fuel expense to vehicle usage. Unexpected relationships are risk indicators, not proof of error. They require investigation and corroboration.

4. Sampling in tax audit

Sampling allows the auditor to draw a conclusion about a population by testing less than all items. It is appropriate when the population is sufficiently defined, items have a reasonable chance of selection and the auditor can evaluate the results. It is not appropriate to use sampling to avoid testing individually significant, unusual or high-risk items.

4.1 Population and sampling unit

The population is the complete set from which the sample is drawn, such as all sales invoices issued during a period. The sampling unit might be an invoice, employee, payment, customer account or monetary unit. The auditor must establish completeness of the population before selecting a sample. A sample drawn from an incomplete report cannot support a conclusion about the complete population.

4.2 Statistical and non-statistical approaches

Statistical sampling uses random selection and probability theory to quantify sampling risk. Non-statistical sampling may use professional judgement, systematic selection or directed testing, but it must still be planned rationally and documented. Neither approach permits careless selection or ignores contradictory evidence.

For a simple attribute sample, the observed exception rate is:

The rate describes the sample. It is not automatically the true population rate. Statistical inference requires an appropriate design, random selection and consideration of confidence, tolerable deviation and expected deviation.

For monetary misstatement testing, an auditor may project identified errors, but the method depends on the sampling design and the distribution of errors. Projection is not appropriate merely because it produces a convenient estimate. Individually material items should normally be tested separately rather than hidden within a projected sample error.

4.3 Key sampling concepts

• Tolerable deviation rate: the maximum control deviation rate the auditor is willing to accept while relying on the control.
• Expected deviation rate: the rate the auditor expects before testing, based on prior work, known problems and process knowledge.
• Tolerable misstatement: the maximum misstatement acceptable for a population or account without changing the audit conclusion.
• Sampling risk: the possibility that the sample conclusion differs from the conclusion that would result from testing the entire population.
• Non-sampling risk: the risk of reaching an incorrect conclusion because of poor procedure design, misinterpretation, failure to recognise an exception or clerical error.

If the sample reveals more exceptions than expected, the auditor may increase the sample, perform alternative procedures, revise reliance on controls, investigate the full population or report a compliance issue. The response depends on the nature and significance of the exceptions.

4.4 Practical selection methods

A robust plan often combines directed testing of significant or unusual items with a representative sample of the remaining population.

5. Working papers and defensible documentation

Working papers are the records of planning, procedures, evidence, reasoning and conclusions. They are not merely an administrative archive; they are the principal means by which the audit team demonstrates professional care and enables review.

A good working paper permits an experienced reviewer, having no prior connection with the engagement, to understand:

• the objective of the procedure;
• the population and period covered;
• the source of the information;
• the items selected and method of selection;
• the work performed;
• the exceptions identified;
• the evidence supporting explanations;
• the judgement applied; and
• the conclusion and any follow-up action.

5.1 Essential documentation fields

A working paper should normally identify the taxpayer, engagement, period, preparer, preparation date, reviewer, review date, source documents, cross-references, procedures and conclusion. Electronic files should preserve version history and restrict unauthorised alteration.

A useful exception record includes:

5.2 Audit trail

An audit trail links the final tax conclusion back to source evidence. For example, a reported input-tax amount should be traceable from the return to the general ledger, from the ledger to transaction listings, from selected transactions to invoices and from invoices to payment or receipt evidence where relevant.

A strong trail supports both vouching, which moves from recorded amounts to supporting evidence, and tracing, which moves from source evidence to recorded amounts to test completeness. Both directions are important. Vouching may detect fictitious or unsupported entries; tracing may detect omitted transactions.

5.3 Documentation of professional judgement

Judgements should explain alternatives considered and the reason for the conclusion. For a doubtful expense, documentation might identify the statutory rule, describe the business purpose evidence, evaluate contrary indicators and explain why the item was accepted, adjusted or referred for specialist review. Merely writing accepted or appears reasonable is not a sufficient rationale for a significant issue.

6. Evaluating contradictions and management representations

Evidence may conflict. A sales ledger may show one amount while bank deposits show another; a supplier may deny an invoice; or staff explanations may contradict system logs. The auditor should not select the evidence that supports a preferred conclusion. The conflict should be investigated by obtaining more reliable or independent evidence and considering whether the contradiction indicates fraud, error, system weakness or an incomplete population.

Management representations can clarify intent, estimates and processes, but they should not replace evidence that is reasonably available from other sources. A representation should be documented, attributed to the appropriate person and evaluated for consistency. Important representations may be obtained in written form, but written form does not make an unreliable statement reliable.

7. Case study: testing deductible expenditure

The following is an illustrative case. It does not represent a specific jurisdiction.

Background

Delta Components Ltd claims a large deduction for professional and subcontracting costs in its annual tax computation. The ledger contains 2,400 transactions with a total value of 18,000,000 currency units. The tax team identifies risks relating to personal expenditure, duplicate invoices, non-existent suppliers, capital expenditure treated as revenue and withholding obligations.

Problem

The finance manager provides a spreadsheet showing that all transactions were reviewed. However, the spreadsheet has no evidence of review, several supplier bank accounts changed during the year and the ledger includes a manual journal posted on the final day of the tax period.

Analysis and approach

The auditor defines the population as all transactions coded to professional and subcontracting costs during the period and reconciles the population total to the general ledger. Individually high-value items and the final-day journal are selected for directed testing. A random sample is selected from the remaining transactions.

For each selected item, the auditor inspects the invoice and contract, confirms the supplier where risk is high, verifies evidence of service delivery, traces payment to the bank statement, evaluates business purpose and checks the tax treatment. The auditor also reperforms the review control for selected months and compares supplier master-file changes with approval logs.

The audit identifies:

• one duplicate invoice recorded twice;
• two invoices lacking evidence that services were delivered;
• a private travel cost coded as professional fees;
• an equipment installation cost incorrectly treated as a revenue deduction; and
• three supplier records changed without documented approval.

The duplicate and private cost are quantified directly. The equipment item is evaluated under the applicable capital-versus-revenue rules. The unsupported service invoices are not automatically treated as fraudulent; the auditor seeks contracts, correspondence, deliverables and independent confirmation before reaching a conclusion. Supplier-master weaknesses lead to expanded testing and a control deficiency assessment.

Outcome

Delta agrees to adjust the duplicate, private cost and capital item. One service invoice is supported by independent evidence and retained; the other is disallowed pending further evidence. The company strengthens supplier-change approvals, separates preparation from review and introduces exception reporting for manual journals.

Learning points

The case demonstrates that a transaction’s accounting entry is only one part of tax evidence. Occurrence, business purpose, classification, completeness and legal entitlement require different procedures. It also shows why control testing, substantive testing, directed selection and representative sampling should be integrated rather than used in isolation.

8. Ethics, governance and technology

Tax auditors must maintain objectivity, confidentiality, professional competence and due care. They should avoid conflicts of interest, inappropriate pressure to achieve a preferred tax outcome and unauthorised disclosure of taxpayer information. Independence requirements may differ according to whether the work is an external audit, internal tax review, advisory engagement or authority examination, but the need for unbiased evaluation remains.

Data protection requires lawful access, minimisation of copied information, secure transfer, retention controls and restricted access. Sensitive payroll, identity, banking and tax data should not be placed in unsecured personal storage or unapproved generative-AI tools.

Technology can improve evidence collection through computer-assisted audit techniques, continuous transaction monitoring, duplicate detection, exception analytics, process mining and secure electronic confirmations. AI may assist with document classification or anomaly detection, but it does not replace professional judgement. Risks include hallucinated explanations, biased models, incomplete training data, privacy breaches and inability to reproduce results. Any AI-assisted procedure should preserve the source data, prompt or configuration where relevant, validation steps, human review and final reasoning.

Contemporary tax compliance increasingly involves digital invoicing, real-time reporting, automated withholding, platform transactions, cryptocurrency and cross-border data exchange. These developments increase the importance of system controls, data lineage, access management and reconciliations between commercial systems and tax submissions.

9. Best-practice checklist

Before finalising an evidence file, the tax professional should ask:

1. Is the population complete and reconciled to the relevant return or ledger?
2. Does every significant risk have a procedure linked to a tax assertion?
3. Is the evidence both sufficient and appropriate?
4. Were individually significant and unusual items tested separately?
5. Are sampling methods, selection criteria and exceptions documented?
6. Were contradictory explanations investigated rather than simply recorded?
7. Can every material conclusion be traced to reliable evidence?
8. Are legal assumptions and jurisdiction-specific rules identified?
9. Is the file understandable to an independent reviewer?
10. Are confidentiality, retention, access and technology risks controlled?

Challenges and limitations

Evidence gathering is limited by incomplete records, weak systems, inaccessible third parties, legal privilege, time pressure and deliberate concealment. Sampling creates unavoidable sampling risk, while analytics may produce false positives or miss carefully structured errors. Documentary evidence may be authentic but legally irrelevant, and oral evidence may be insightful but difficult to corroborate.

Professional judgement is therefore unavoidable. The appropriate response is not to seek absolute certainty but to obtain evidence proportionate to risk, document limitations, escalate unresolved matters and communicate clearly. Where evidence remains insufficient, the auditor should not express an unqualified conclusion merely because additional work is inconvenient.

Chapter Summary

Audit evidence is information used to support a tax audit conclusion. Its quality depends on sufficiency, relevance and reliability. Evidence must be connected to assertions such as occurrence, completeness, accuracy, cut-off, classification and entitlement.

Inspection, inquiry, observation, confirmation, recalculation and reperformance provide different kinds of assurance and have different limitations. Tests of controls assess whether controls operate effectively, while substantive procedures address misstatements or non-compliance directly. Sampling requires a defined population, appropriate selection and careful evaluation of sampling and non-sampling risk. Individually significant and unusual items require special attention.

Defensible working papers explain the objective, source, selection, procedures, exceptions, judgement and conclusion. A complete audit trail links the tax return to ledgers, transactions and source evidence. Ethical conduct, confidentiality, data protection and careful governance are essential, especially when digital systems and AI tools are used. The central professional principle is that conclusions must be proportionate to the quality of evidence and capable of independent review.

Key Terms

Audit evidence: Information used to support audit findings and conclusions.

Sufficiency: The quantity of evidence obtained.

Appropriateness: The relevance and reliability of evidence.

Assertion: A representation about a transaction, balance, disclosure or compliance matter.

Inspection: Examination of documents, records, assets or electronic information.

Inquiry: Seeking information from knowledgeable persons.

Observation: Watching a process or control being performed.

External confirmation: Evidence obtained directly from an independent third party.

Recalculation: Checking the mathematical accuracy of a computation.

Reperformance: Independently executing a procedure or control.

Test of controls: A procedure evaluating the operation of a control.

Substantive procedure: A procedure designed to detect misstatement or non-compliance directly.

Population: The complete set of items from which a sample is selected.

Sampling unit: The individual item selected for testing.

Sampling risk: The risk that a sample conclusion differs from a full-population conclusion.

Tolerable misstatement: The maximum acceptable misstatement for a population or account.

Audit trail: A traceable link from a reported conclusion to underlying evidence.

Vouching: Moving from recorded amounts to supporting evidence.

Tracing: Moving from source evidence to recorded amounts to test completeness.

Working paper: A documented record of audit planning, procedures, evidence and conclusions.

Review Questions

Short Answer Questions

1. Distinguish sufficiency from appropriateness of audit evidence.
2. Why is inquiry generally corroborated by other evidence?
3. What is the difference between recalculation and reperformance?
4. Define sampling risk and non-sampling risk.
5. Identify four features of a defensible working paper.

Long Answer Questions

1. Explain how tax assertions guide the design of audit procedures.
2. Compare inspection, observation, confirmation and inquiry, including their principal limitations.
3. Explain the difference between tests of controls and substantive procedures, using tax examples.
4. Discuss how an auditor should respond when sample exceptions exceed expectations.
5. Explain why an audit trail should support both vouching and tracing.

Analytical / Application Questions

1. A taxpayer’s input-tax claim agrees with the ledger, but invoices are missing for several high-value purchases. Design an evidence plan and explain the conclusions that can and cannot yet be reached.
2. A sample of 80 payroll records contains four withholding errors. Explain what additional information is needed before concluding that the population is misstated.
3. An AI tool identifies unusual supplier payments but cannot explain its model. Evaluate how the auditor may use the output while preserving reliability, human judgement and confidentiality.

Multiple Choice Questions with Answers

Question 1

Which characteristic describes the quality, rather than the quantity, of audit evidence?

A. Sufficiency

B. Appropriateness

C. Population size

D. Sampling interval

Correct Answer: B. Appropriateness

Question 2

Which procedure is most directly designed to check the arithmetic accuracy of a tax computation?

A. Observation

B. Inquiry

C. Recalculation

D. Confirmation

Correct Answer: C. Recalculation

Question 3

Tracing primarily helps an auditor test which assertion?

A. Completeness

B. Occurrence

C. Valuation only

D. Presentation only

Correct Answer: A. Completeness

Question 4

What is the principal purpose of a test of controls?

A. To determine whether a control operated effectively

B. To prove that every transaction is legally deductible

C. To replace all substantive procedures

D. To calculate the tax rate

Correct Answer: A. To determine whether a control operated effectively

Question 5

Which item would normally merit directed testing rather than reliance only on a representative sample?

A. A routine low-value invoice

B. An individually significant unusual journal

C. A randomly selected ordinary payment

D. A recurring utility bill with no exceptions

Correct Answer: B. An individually significant unusual journal

Question 6

A sample contains 6 exceptions in 120 tested items. What is the observed exception rate?

A. 2%

B. 5%

C. 6%

D. 20%

Correct Answer: B. 5%

Question 7

Which statement about a negative confirmation is correct?

A. The recipient must respond whether the balance is correct or incorrect

B. The recipient responds only if the recipient disagrees with the information

C. It is always stronger than a positive confirmation

D. Non-response proves the balance is correct

Correct Answer: B. The recipient responds only if the recipient disagrees with the information

Question 8

Which document feature most directly supports independent review?

A. A conclusion with no source references

B. A list of staff names only

C. The objective, procedures, evidence, exceptions and conclusion

D. A copy of the tax return without annotations

Correct Answer: C. The objective, procedures, evidence, exceptions and conclusion

Question 9

What does reperformance involve?

A. Asking management to repeat its explanation

B. Independently executing a control or procedure

C. Inspecting only the original invoice

D. Estimating the likely tax rate

Correct Answer: B. Independently executing a control or procedure

Question 10

What is the most appropriate view of an AI-generated anomaly in a tax audit?

A. It is conclusive evidence of fraud

B. It can be ignored because software is never reliable

C. It is a risk indicator requiring validation and professional judgement

D. It replaces the need to document audit procedures

Correct Answer: C. It is a risk indicator requiring validation and professional judgement