Audit evidence must meet specific standards of sufficiency and appropriateness to ensure the validity and reliability of audit findings and conclusions. Auditors are tasked with obtaining enough high-quality evidence to reasonably support their audit objectives, making use of relevant, reliable, and valid criteria while considering the scope and coverage of the audit.
Key Insights
- Audit evidence sufficiency pertains to the quantity of evidence needed to support audit findings and conclusions, taking into account the audit universe and scope.
- The appropriateness of audit evidence involves its relevance, reliability, and validity, ensuring that it logically relates to the audit objectives and supports the findings accurately.
- The reliability of computer-based data used in audits depends on the adequacy of system controls; auditors must test data reliability if it is critical to their findings and conclusions.
This lesson is a preview from our Government Auditor Level I Certificate Program. Enroll in a course for detailed lessons, live instructor support, and project-based training.
This is a lesson preview only. For the full lesson, purchase the course here.
GAGAS requires auditors to obtain sufficient appropriate evidence to provide a reasonable basis for addressing audit objectives and supporting findings and conclusions. This requirement is outlined in GAGAS paragraph 8.90.
Sufficiency refers to the quantity of evidence needed to support findings and conclusions related to audit objectives (GAGAS 8.99).
Appropriateness refers to the quality of evidence and includes its relevance, reliability, and validity (GAGAS 8.102).
Sufficiency of Evidence
In determining sufficiency, auditors must obtain enough evidence to persuade intended users of the validity of findings, the reasonableness of conclusions, and the value of recommendations when applicable. Statistical sampling methods may be used to help establish sufficiency.
Sufficiency is judged relative to the audit universe, meaning the population within the audit scope. The universe may consist of locations, individuals, transactions, programs, or outputs.
Auditors generally have three options when determining coverage:
- Examine the entire universe.
- Sample the universe.
- Limit findings to the portion examined.
The audit scope should provide enough relevant evidence to answer the audit objectives without overstating or generalizing beyond the evidence obtained. Sufficiency ensures that findings are properly supported and not exaggerated.
Relevance of Evidence
Evidence must be logically related to the audit objectives and the specific issues being examined. Evidence is relevant if it helps answer the audit objectives.
Relevant evidence should relate to:
- The overall audit objectives
- The audit subject
- The time period under review
- The specific performance aspects being examined
- The finding element to which it pertains
Auditors must also confirm that the criteria used remain current and applicable. Laws, regulations, policies, directives, and best practices can become outdated, so their continued relevance should be affirmed before relying on them.
Elements of a Finding
Evidence typically supports one or more elements of a finding: criteria, condition, cause, and effect.
- Condition: Evidence must pertain to the audit subject, performance aspects, and relevant time period. Outdated information may not be relevant unless needed for historical context.
- Effect: Evidence on effect should logically extend from and be consistent with the condition.
- Cause: Evidence on cause must demonstrate a clear causal relationship to the condition. The cause should be correctable, and auditors should support it with evidence rather than speculation.
When identifying causes, auditors may use benchmarking or comparisons to best practices. Auditors must also demonstrate that corrective action is warranted and that the benefits outweigh the costs.
Appropriateness of Evidence
Appropriateness addresses the quality of evidence and includes relevance, reliability, and validity.
Validity refers to whether the evidence provides a reasonable and meaningful basis for measuring what is being evaluated.
Reliability refers to the consistency and dependability of evidence. Reliable evidence is sufficiently complete and free from significant error so that a reasonable person would not doubt the finding or conclusion based on it.
Reliable evidence is often described as accurate, complete, and authentic. Some error may exist, but it must not be significant enough to undermine confidence in the results.
A useful guiding question is: Are we reasonably confident that our evidence presents a picture that is not significantly different from reality and that our analysis techniques are appropriate?
Computerized Data and Information Systems
When audit evidence relies on computerized data, auditors must determine whether information systems controls are adequate to support the audit objectives.
Auditors should understand:
- General controls
- Application controls
- User controls
The extent of testing depends on how the data will be used. If computerized data serve as the sole support for findings and conclusions, more extensive testing is required. If system controls appear adequate, testing may be more limited.
Assessing the Reliability of Data
Auditors can use practical questions to assess the reliability of data, including:
- Do individuals who receive the data actually use it?
- Do users believe the data are accurate and reliable for their purposes?
- Do users review the data to identify errors?
- If errors are identified, is there a process for reporting and correcting them?
- Are corrections confirmed and re-reviewed?
These inquiries help determine whether the data environment supports valid and reliable reporting.
Summary
To comply with GAGAS evidence standards, auditors must obtain evidence that is both sufficient in quantity and appropriate in quality. Evidence must be relevant, reliable, and valid, and it must logically support the audit objectives and findings. When properly applied, these standards ensure that audit conclusions are well supported and credible.
