IA 2017 - 09
Audit Evidence and Working Papers
AUDIT EVIDENCE
❖ Gathering sufficient appropriate evidence requires extensive
interaction and communication with auditee personnel
throughout the engagement. Such interactions and
communication are critical to conducting the engagement
effectively and efficiently.
❖ Professional skepticism means the internal auditors take
nothing for granted; they continuously question what they hear
and see and critically assess audit evidence. They do not assume
by default that auditee personnel are either honest or
dishonest.
❖ Internal auditors’ conclusions and advice must be formed at a
reasonable cost within a reasonable length of time to add
economic value. Accordingly, internal auditors strive to obtain
sufficient appropriate evidence to provide a reasonable basis for
formulating their conclusion and advice. This concept is referred
to by internal auditors as reasonable assurance.
❖ Audit evidence is persuasive if it enables the internal auditor to
formulate well-founded conclusions and advice confidently.
2310 – Identifying Information
Internal auditors must identify sufficient, reliable, relevant, and
useful information to achieve the engagement’s objectives.
Interpretation:
Sufficient information is factual, adequate, and convincing so that a
prudent, informed person would reach the same conclusions as the
auditor. Reliable information is the best attainable information
through the use of appropriate engagement techniques. Relevant
information supports engagement observations and
recommendations and is consistent with the objectives for the
engagement. Useful information helps the organization meet its
goals.
❖ Audit risk is the risk of reaching invalid conclusions and/or
providing faulty advice based on the audit work conducted.
❖ Guidelines in identifying persuasive evidence:
▪ Evidence obtained from independent third parties is more
reliable than evidence obtained from auditee personnel.
▪ Evidence produced by a process or system with effective
controls is more reliable than evidence produced by a
process or system with ineffective controls.
▪ Evidence obtained directly by the internal auditor is more
reliable than evidence obtained indirectly.
▪ Documented evidence is more reliable than
undocumented evidence.
▪ Timely evidence is more reliable than untimely evidence.
▪ Corroborated evidence is more sufficient than
uncorroborated or contradictory evidence.
▪ Larger samples produce more sufficient evidence than
smaller samples.
❖ Reliability of Documentary Evidence
▪ High: documents prepared by the internal auditor and
documents sent directly from a third party to the internal
auditor
▪ Medium: documents created by a third party, sent directly
to the organization, and requested from the organization
by the internal auditor and documents created by the
organization, sent to a third party, returned to the
organization, and requested from the organization by the
internal auditor
▪ Low: documents created by the organization and
requested from the organization by the internal auditor
❖ Levels of Persuasiveness of Evidence
a. An auditor’s physical examination provides the most
persuasive form of evidence.
b. Direct observation by the auditor.
c. Information originating from a third party is less persuasive
than information gathered by the auditor but more
persuasive than information originating from the client.
d. Information originating with the client can be somewhat
persuasive in documentary form, especially if it is subject
to effective internal control. But client oral testimony is the
least persuasive of all.
AUDIT PROCEDURES
❖ Audit procedures are specific tasks performed by the internal
auditor to gather the evidence required to achieve the
prescribed audit objectives.
❖ They are applied during the audit process to:
▪ Obtain a thorough understanding of the auditee, including
the auditee’s objectives, risks, and controls.
▪ Test the design and adequacy and operating effectiveness
of the targeted area’s system of internal controls.
▪ Analyze plausible relationships among different elements
of data.
▪ Directly test recorded financial and nonfinancial
information for errors and fraud.
▪ Obtaining sufficient appropriate evidence to achieve the
prescribed audit objectives involves determining the
nature, extent, and timing of audit procedures to perform.
❖ Nature of audit procedures. The nature of audit procedures
relates to the types of tests the internal auditor performs to
achieve his or her objectives.
❖ Extent of audit procedures. The extent of audit procedures
pertains to how much audit evidence the internal auditor must
obtain to achieve his or her objectives.
❖ Timing of audit procedures. The timing of audit procedures
pertains to when the tests are conducted and the period of time
covered by the tests.
Page 1 of 2

MANUAL AUDIT PROCEDURES
❖ Inquiry entails asking questions of auditee personnel or third
parties and obtaining their oral or written responses. Inquiry
produces indirect evidence, which by itself is rarely persuasive.
❖ Observation entails watching people, procedures, or processes.
Observation is generally considered more persuasive than
inquiry in the sense that the internal auditor is obtaining direct
evidence.
❖ Inspection entails studying documents and records and
physically examining tangible resources. Inspection of
documents and records provides direct evidence of their
contents.
❖ Vouching entails tracking information backward from one
document or record to previously prepared documents or
records, or to a tangible resource. Vouching is performed
specifically to test the validity of documented or recorded
information.
❖ Tracing entails tracking information forward from one
document, record, or tangible resource to a subsequently
prepared document or record. Tracing is performed specifically
to test the completeness of documented or recorded
information.
❖ Reperformance entails redoing controls or other procedures.
❖ Analytical procedures entail assessing information obtained
during an engagement by comparing the information with
expectation identified or developed by the internal auditor. A
basic premise underlying the use of analytical procedures in
internal auditing is that the internal auditor may reasonably
expect certain relationships among different pieces of
information to continue in the absence of known conditions to
the contrary. Common analytical procedures performed by
internal auditors include:
▪ Analysis of common-size financial statements
▪ Ratio analysis
▪ Trend analysis
▪ Analysis of future-oriented information
▪ External benchmarking
▪ Internal benchmarking
❖ Confirmation entails obtaining direct written verification of the
accuracy of information from independent third parties. There
are two types of confirmation requests: positive confirmations
ask recipients to respond regardless of whether or not they
believe the information provided to them is correct, and
negative confirmations ask recipients to respond only when
they believe the information provided to them is incorrect.
COMPUTER-ASSISSTED AUDIT TECHNIQUES
1220.A2
In exercising due professional care, internal auditors must consider
the use of technology-based audit and other data analysis
techniques.
IA 2017 - 09
Audit Evidence and Working Papers
❖ ISACA defines a technology-based audit technique, or CAAT, as
“any automated audit technique, such as generalized audit
software (GAS), test data generators, computerized audit
programs and specialized audit utilities.”
❖ Some of the more common CAATs are:
▪ Generalized audit software (GAS)
▪ Utility software
▪ Test data
▪ Application software testing and mapping
▪ Audit expert systems
▪ Continuous auditing
WORKING PAPERS
2330 – Documenting Information
Internal auditors must document sufficient, reliable, relevant, and
useful information to support the engagement results and
conclusions.
❖ Because of the many purposes working papers serve, it is
difficult to overstate their importance. For example, working
papers:
▪ Aid in planning and performing the engagement.
▪ Facilitate supervision of the engagement and review of the
work completed.
▪ Indicate whether engagement objectives were achieved.
▪ Provide the principal support for the internal auditors’
communications to the auditee, senior management, the
board of directors, and appropriate third parties.
▪ Serve as a basis for evaluating the internal audit function’s
quality assurance program.
▪ Contribute to the professional development of the internal
audit staff.
▪ Demonstrate the internal audit function’s compliance with
The IIA’s Standards.
2330.A1
The chief audit executive must control access to engagement records.
The chief audit executive must obtain the approval of senior
management and/or legal counsel prior to releasing such records to
external parties, as appropriate.
2330.A2
The chief audit executive must develop retention requirements for
engagement records, regardless of the medium in which each record
is stored. These retention requirements must be consistent with the
organization’s guidelines and any pertinent regulatory or other
requirements.
References:
Internal Auditing Assurance & Advisory Services, Reding, Sobel, Anderson,
Head, Ramamoorti, Salamasick, Riddle
Page 2 of 2