Audit Evidence, Sampling, and Documentation
Evidence must be sufficient, reliable, and traceable
This domain covers how the auditor builds a defensible file. Evidence should be relevant to the control tested, reliable given its source, and sufficient in quantity. Reliability generally increases from oral inquiry to management-provided documents to auditor-obtained system output to direct observation and re-performance. Candidates should be able to explain why an internally generated screenshot with no system context is weak, while an export with timestamps, system identifiers, and an unbroken chain of custody is strong.
Sampling requires a defined population, a documented selection method, and a conclusion tied to the results. Attribute sampling is common for control testing: define the population, choose a confidence and tolerable deviation rate, select items, and evaluate exceptions. The trap is a population that excludes key items, or a sample selected by the auditee. Another trap is generalizing from a handful of judgmentally chosen items as if the result were statistical.
Documentation should let an experienced auditor who was not on the engagement reperform the work: the criteria, the procedure, the evidence reference, the result, and the conclusion. Workpapers should be reviewed and signed off, and superseded versions retained.
Worked example. Testing 25 access-removal cases, the auditor finds 3 exceptions. Rather than concluding "mostly effective," the auditor evaluates whether the deviation rate exceeds the tolerable threshold, investigates the root cause, and expands the sample or reports a control deficiency accordingly.
Rule of thumb: if a reviewer cannot trace your conclusion back to a specific artifact and a specific criterion, the evidence is not yet sufficient.