Audit Evidence
Sufficiency and appropriateness
Evidence must be both sufficient (quantity) and appropriate (relevance and reliability). Reliability hierarchy: external evidence > internal; original > copy; auditor-obtained > client-provided; documentary > oral. Confirmations under ISA 505 are strong when the auditor controls the process; negative confirmations are appropriate only when risk is low and the population is large and homogeneous. Analytical procedures (ISA 520) are used in risk assessment, as substantive procedures, and in the overall review; they are less effective where controls are weak or transactions are complex.
Sampling (ISA 530)
Understand sampling risk vs non-sampling risk, statistical vs non-statistical sampling, and the effect of tolerable misstatement and expected misstatement on sample size. Trap: increasing the sample size reduces sampling risk but never eliminates non-sampling risk (human error). Projected misstatement from a sample must be evaluated against tolerable misstatement.
Documentation (ISA 230)
Working papers must enable an experienced auditor with no prior connection to the engagement to understand what was done, why, and what was concluded. The file is assembled within 60 days of the report date; after that, changes require documentation of why.
Worked rule of thumb
If the client refuses to allow external confirmation of receivables, the auditor performs alternative procedures (subsequent cash receipts, shipping documents). If alternatives are unavailable and the balance is material, this is a scope limitation - consider a qualified opinion or disclaimer.