Information Gathering, Analysis, and Audit Evidence
Evidence items ask whether a conclusion is supported. You are tested on sufficiency and reliability, sampling logic, and documentation.
Core rules
- Standard 2310: information must be sufficient (factual, adequate, convincing), reliable (the best attainable), relevant and useful.
- Reliability hierarchy, strongest first: the auditor's direct observation and reperformance, original documents, external confirmations, independent third-party data, then internal documents, then oral testimony and hearsay.
- Standard 2320 requires analysis and evaluation so conclusions rest on evidence; Standard 2330 requires workpapers recording objectives, scope, procedures, evidence obtained, analysis and conclusions, and requires review.
- Statistical sampling quantifies sampling risk; judgmental sampling does not. Attribute sampling suits compliance rates; monetary unit sampling suits overstated balances. Fix the population, sampling unit, confidence level, tolerable deviation and expected error before testing.
- Analytics can test full populations only after validating completeness and accuracy with record counts, control totals and date ranges.
Worked example
You test 40 purchase orders and find three lacking a documented second approval. The sample alone cannot support a population statement. Reasoning: rerun the approval test in the ERP across all 9,800 purchase orders, reconcile the extract record count to the ledger, and document the query, run date and parameters. If the full-population exception rate is material, the finding is supportable; if not, the three exceptions are reported as isolated.
Traps
Ranking testimony above documents; believing more evidence is automatically better; discarding negative results; accepting an auditee's spreadsheet without verifying its source and completeness.