Engagement Execution
Evidence must be sufficient and appropriate
Execution is where the engagement is actually performed: gathering information, testing controls and transactions, applying analytical procedures, interviewing, sampling, and documenting results in workpapers. The governing test is whether evidence is sufficient (enough of it) and appropriate (relevant to the objective and reliable in source). Reliability ranks roughly this way: the auditor's direct observation and inspection, and third-party confirmations, are stronger than internally generated documents, which are stronger than oral representations. Originals beat copies, and independent external evidence beats evidence produced by the area being audited. Management representations can support a conclusion but never replace other evidence.
Every conclusion must be traceable to documented evidence. Workpapers record the procedure performed, the population and sample selection, the criteria, the results including exceptions, and the conclusion - reviewable by a supervisor who did not do the work. Sampling risk and tolerable error drive sample size: higher risk and lower tolerable error demand more evidence.
Traps that show up in questions
- Confusing tests of controls (is the control operating?) with substantive tests (is the balance correct?).
- Selecting a convenience sample and calling it representative.
- Failing to investigate or document exceptions and how they were resolved.
- Writing workpapers after the fact from memory.
- Accepting an analytical comparison with a large unexplained variance.
- Letting the engagement client decide which items get tested.
Rule of thumb: if a reviewer cannot repeat your step from the workpaper and reach the same conclusion, the evidence is not documented.
Worked example: for inventory existence, a signed third-party warehouse confirmation plus auditor observation is stronger evidence than a large client-prepared count sheet.