Evidence Collection and Testing Techniques
This domain tests whether you can select procedures that produce sufficient and appropriate evidence, test controls and substantiate balances, and document conclusions that another auditor could review.
Core rules and concepts
- Evidence must be sufficient in quantity and appropriate in relevance and reliability. Direct inspection, observation, reperformance, and external confirmation generally outrank unsupported internal inquiry.
- Inquiry alone is rarely sufficient because it is not corroborated. Use it to orient testing, then corroborate with inspection or reperformance.
- Tests of controls address design and operating effectiveness. Substantive procedures address monetary misstatement through detail testing or analytical procedures.
- Sampling requires a defined population, a documented selection method, and consideration of sampling risk. Results cannot be extrapolated beyond the population tested.
- System-generated reports must be tested for completeness and accuracy before reliance.
Worked example
An auditor concludes segregation of duties is effective after the supervisor says access is restricted. That is inquiry only. Better evidence includes inspecting the system role matrix, observing user administration, testing whether terminated users were removed, and sampling approvals. If access reports come from the system, validate the report logic first. The conclusion is then supported by corroborated evidence rather than assertion.
Traps that cost marks
Treating a documented policy as proof that a control operated; relying on inquiry as sole evidence; sampling a population that omits key locations; and failing to document the source, date, and conclusion for evidence obtained.