In an audit, the auditor issues their opinion about the financial statements based on the audit findings and supporting evidence. The auditor just cannot come up with an opinion and they must back their opinion with evidence collected through performing substantive procedures and tests of controls. The evidence should be sufficient and appropriate and meet the other requirements that ISA 500 has listed.
So what does a sufficient and appropriate evidence means? What makes an evidence powerful enough to be considered as Sufficient & Appropriate? To be able to answer these and a lot of other questions regarding audit evidence, we need to know what a sufficient and appropriate audit evidence actually means.
DEFINITION
Sufficient and appropriate audit evidence means an evidence that is sufficient, complete, relevant and reliable enough to support the auditor’s findings regarding the financial statements item in question. For example, if the auditor is performing procedures on the inventory, they cannot just write their conclusion and present it to the users. Instead, they will have to attach references like Goods Received Notes (GDNs), dispatch notes, results of inventory counts and the analysis of the inventory control system of the client.
That being said, a sufficient and appropriate audit evidence is proof of the auditor’s tests and procedures that they have performed on the items of the financial statements and the client’s internal control systems. It can be any piece of information that an auditor gains while auditing the financial statements of the client. The piece of information needs to be sufficient and appropriate as per the auditor’s professional judgment that is influenced by the following THREE factors.
- Materiality of the item
- Risk of material misstatements
- Size and characteristics of the population.
Now a question arises here whether there is a pre-set standard for sufficiency and appropriateness. It depends on the importance of the materiality of the item that is being audited. As a rule of thumb, the more material an item is, the more precise evidence would the auditor need to justify their conclusion regarding the item in question.
In addition, for the evidence to be sufficient and appropriate, the auditor considers factors like the source of the evidence, its relevance, and reliability.
Where did the auditor obtain the evidence? If it has come from the client’s system or any other internal source, the auditor may choose not to rely on the evidence without digging deep into the matter. If, on the other hand, the evidence has been obtained through performing audit procedures or has come from external sources like banks or insurance providers, it’s more likely to be trusted.
To sum it up, if the information has been obtained from a reliable source, is relevant to the matter, and is sufficient enough to be able to draw conclusions about the item, it can be referred to as sufficient and appropriate evidence.
ILLUSTRATION
There are some key points that you need to consider to better understand the logic behind approving evidence as sufficient and appropriate. The following THREE factors determine whether the evidence in question should be considered sufficient and appropriate.
- Quantity of the evidence
- Quality of the evidence
- Risk of material misstatements
Let me illustrate the relationship between the quantity and quality of audit evidence.
If the risk of material misstatement is higher, a greater quantity of audit evidence will be required for the auditor to draw a conclusion about the item and vice versa. The following diagram shows the relationship.
In the same way, the quantity of audit evidence required decreases if the evidence obtained is of greater quality. In simple terms, quality evidence will decrease the quantity of evidence required to support the auditor’s opinion about an item of the financial statements. The following diagram explains the relationship.
The concepts of quantity and quality of evidence are interrelated but the relationship is not necessarily linear. That means, obtaining a greater amount of low-quality evidence may not compensate for a lack of higher quality audit evidence. Ultimately, it all depends on the auditor’s professional judgment.
How Sufficient and Appropriate Audit Evidence is Obtained?
Sufficient and Appropriate evidence is obtained by performing substantive audit procedures and tests of controls. Note that the risk assessment procedures performed on the client’s control system cannot be used as evidence.
That means, the auditor cannot use the information obtained by performing risk assessment procedures. Risk assessment procedures are procedures that an auditor performs in the planning stage of an audit to obtain an understanding of the entity and its environment. These procedures are only used to assess the client’s control risk and structure the audit procedures accordingly.
In addition, merely performing tests of controls won’t result in information that could be considered as “sufficient and appropriate audit evidence”. Tests of controls are used alongside substantive audit procedures to obtain the evidence. However, the auditor can rely on information obtained by merely performing substantive audit procedures but that is not practically possible in an audit. The combination of performing substantive audit procedures and tests of controls results in obtaining evidence that is sufficient and appropriate.
A note on the reliability of Evidence
The one word in which we can sum the definition of sufficient and appropriate audit evidence is reliability. That is exactly the whole point of performing substantive audit procedures and tests of controls. An audit is a reasonable assurance and for the auditor to assure the users, a reliable evidence is needed that supports their opinion.
So, what makes an evidence reliable? The features of a reliable audit evidence include:
- Auditor’s Findings: If an auditor obtains a piece of information as a result of performing substantive audit procedures and tests of controls, it is considered more reliable as compared to information taken from the client’s control system.
- Source of the evidence: Evidence obtained from an external or legitimate source is more reliable than evidence that is internally generated by a client.
- Nature: Written evidence is more reliable than oral evidence. Likewise, an original copy is more trusted than a photocopied document.
- Internal Controls: At times, the auditor can rely on the information generated by the client’s internal control system. It depends on how effective the control system is. If, after performing risk assessment, the control system is found to be effective, the auditor may choose to rely on information generated by the system. Ineffectiveness of the control system will decrease the reliability of internally generated evidence.
