Audit and Assurance: Evidence, Risk-Based Planning, and Reporting
The assurance mindset
Assurance provides an independent opinion on whether controls are designed and operating effectively. Audit work follows a cycle: plan (understand the process, assess risk), design procedures, gather sufficient appropriate evidence, evaluate findings, and report. Risk-based auditing concentrates effort where risk is highest, not where sampling is easiest.
Concepts to master
- Sufficiency and appropriateness of evidence: enough of it, and reliable in nature. External evidence generally outranks internal; documentary outranks verbal; direct observation outranks inquiry alone.
- Testing design vs. operating effectiveness: a well-written control can still fail in practice.
- Sampling and exceptions: an exception requires root-cause analysis and evaluation of whether it is isolated or systemic; it is not simply written off.
- Findings structure: condition (what is), criteria (what should be), cause (why), effect (so what), recommendation (action).
- Follow-up: prior findings must be tracked to closure and verified, not merely reported as "management agrees."
Traps in questions
Questions often present a manager's assurance as sufficient evidence - inquiry alone rarely is. Another trap is recommending a control where the real fix is a process or accountability change. Also watch for scope limitations: if audit cannot obtain evidence, the correct response is to disclose the limitation, not to soften the conclusion silently.
Worked example / rule of thumb
Testing 40 purchase orders, an auditor finds 6 without documented approval. Correct handling: characterize the population, investigate whether the approval control is designed poorly or bypassed, quantify exposure, and draft a finding with condition, criteria, cause, effect, and recommendation. Rule of thumb: no finding without criteria, no conclusion without evidence.