Audit Evidence, Testing and Sampling
Domain 4 is about evidence quality and honest evaluation of results: is what you gathered enough, is it relevant, and does your sample support the conclusion you intend to write?
Sufficiency and appropriateness
- Sufficiency is quantity; appropriateness is relevance plus reliability.
- Reliability ranking: the auditor's own reperformance or observation, external confirmations, internally generated evidence from a well-controlled system, then inquiry alone, which is never sufficient on its own.
- Workpapers must let an experienced auditor who has not done the work re-perform it and reach the same conclusion. Retain extracts, queries, parameters and reviewer sign-off.
Designing tests
- Tests of controls use attribute sampling. Expected deviation rate, tolerable deviation rate and confidence drive sample size; the closer the expected rate sits to the tolerable rate, the larger the sample.
- Substantive work includes analytics, stratification and monetary unit sampling, which weights selection toward larger items.
- Analytics over a full population still needs validation that the extract is complete and accurate, and recalculation of key derived fields.
Evaluating and projecting
- Project attribute deviations to the population as a rate. Never convert an attribute deviation into a monetary misstatement.
- Compare the upper deviation limit with the tolerable rate. If it exceeds it, the control cannot be relied on and substantive work must expand.
- An exception called isolated must be evidenced as isolated: same root cause, no systemic pattern.
- Document the conclusion, the basis for it, and any change from the planned approach.
Worked example
From 3,000 purchase orders you select 60. Two show no evidence of approval. At 90% confidence the upper deviation limit is roughly 9-10%, above the 5% tolerable rate, so the approval control cannot be relied on for the period. The correct response is to expand substantive testing over purchase orders and report a control deficiency stating the population affected, not to draw another 20 items until the result looks acceptable.
Traps
- Inquiry plus a screenshot as sole evidence of a configuration.
- Selecting only high-risk items, then generalising to the population.
- Ignoring IT-dependent manual controls, where the system report may be incomplete.
- Accepting a report produced by the auditee without testing its logic.