COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

1052 Audit procedures for obtaining audit evidence
Dec-2022

Overview

Auditors design detailed audit procedures to obtain sufficient appropriate audit evidence. Procedures can include inspection, observation, confirmation, recalculation, reperformance, and analytical procedures, often in some combination.

This section further explains

audit procedures for obtaining audit evidence, and
specific types of audit procedures.

CPA Canada Copyright

CPA Canada Assurance Standards

Office

Annual Audit

Performance Audit, Special Examination, and Other Assurance Engagements

CAS 500.A14 As required by, and explained further in, CAS 315 and CAS 330, audit evidence to draw reasonable conclusions on which to base the auditor’s opinion is obtained by performing:

(a) Risk assessment procedures; and

(b) Further audit procedures, which comprise:

(i) Tests of controls, when required by the CASs or when the auditor has chosen to do so; and

(ii) Substantive procedures, including tests of details and substantive analytical procedures.

CAS 500.A15 The audit procedures described in paragraphs A18-A29 below may be used as risk assessment procedures, tests of controls or substantive procedures, depending on the context in which they are applied by the auditor. As explained in CAS 330, audit evidence obtained from previous audits may, in certain circumstances, provide appropriate audit evidence where the auditor performs audit procedures to establish its continuing relevance.

CAS 500.A16 The nature and timing of the audit procedures to be used may be affected by the fact that some of the accounting data and other information may be available only in electronic form or only at certain points or periods in time. For example, source documents, such as purchase orders and invoices, may exist only in electronic form when an entity uses electronic commerce, or may be discarded after scanning when an entity uses image processing systems to facilitate storage and reference.

CAS 500.A17 Certain electronic information may not be retrievable after a specified period of time, for example, if files are changed and if backup files do not exist. Accordingly, the auditor may find it necessary as a result of an entity’s data retention policies to request retention of some information for the auditor’s review or to perform audit procedures at a time when the information is available.

CAS 500.A18 Inspection involves examining records or documents, whether internal or external, in paper form, electronic form, or other media, or a physical examination of an asset. Inspection of records and documents provides audit evidence of varying degrees of reliability, depending on their nature and source and, in the case of internal records and documents, on the effectiveness of the controls over their production. An example of inspection used as a test of controls is inspection of records for evidence of authorization.

CAS 500.A19 Some documents represent direct audit evidence of the existence of an asset, for example, a document constituting a financial instrument such as a stock or bond. Inspection of such documents may not necessarily provide audit evidence about ownership or value. In addition, inspecting an executed contract may provide audit evidence relevant to the entity’s application of accounting policies, such as revenue recognition.

CAS 500.A20 Inspection of tangible assets may provide reliable audit evidence with respect to their existence, but not necessarily about the entity’s rights and obligations or the valuation of the assets. Inspection of individual inventory items may accompany the observation of inventory counting.

CAS 500.A21 Observation consists of looking at a process or procedure being performed by others, for example, the auditor’s observation of inventory counting by the entity’s personnel, or of the performance of controls. Observation provides audit evidence about the performance of a process or procedure, but is limited to the point in time at which the observation takes place, and by the fact that the act of being observed may affect how the process or procedure is performed. See CAS 501 for further guidance on observation of the counting of inventory.

CAS 500.A22 An external confirmation represents audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium. External confirmation procedures frequently are relevant when addressing assertions associated with certain account balances and their elements. However, external confirmations need not be restricted to account balances only. For example, the auditor may request confirmation of the terms of agreements or transactions an entity has with third parties; the confirmation request may be designed to ask if any modifications have been made to the agreement and, if so, what the relevant details are. External confirmation procedures also are used to obtain audit evidence about the absence of certain conditions, for example, the absence of a “side agreement” that may influence revenue recognition. See CAS 505 for further guidance.

CAS 500.A23 Recalculation consists of checking the mathematical accuracy of documents or records. Recalculation may be performed manually or electronically.

CAS 500.A24 Reperformance involves the auditor’s independent execution of procedures or controls that were originally performed as part of the entity’s internal control.

CAS 500.A25 Analytical procedures consist of evaluations of financial information through analysis of plausible relationships among both financial and non-financial data. Analytical procedures also encompass such investigation as is necessary of identified fluctuations or relationships that are inconsistent with other relevant information or that differ from expected values by a significant amount. See CAS 520 for further guidance.

CAS 500.A26 Inquiry consists of seeking information of knowledgeable persons, both financial and non-financial, within the entity or outside the entity. Inquiry is used extensively throughout the audit in addition to other audit procedures. Inquiries may range from formal written inquiries to informal oral inquiries. Evaluating responses to inquiries is an integral part of the inquiry process.

CAS 500.A27 Responses to inquiries may provide the auditor with information not previously possessed or with corroborative audit evidence. Alternatively, responses might provide information that differs significantly from other information that the auditor has obtained, for example, information regarding the possibility of management override of controls. In some cases, responses to inquiries provide a basis for the auditor to modify or perform additional audit procedures.

CAS 500.A28 Although corroboration of evidence obtained through inquiry is often of particular importance, in the case of inquiries about management intent, the information available to support management’s intent may be limited. In these cases, understanding management’s past history of carrying out its stated intentions, management’s stated reasons for choosing a particular course of action, and management’s ability to pursue a specific course of action may provide relevant information to corroborate the evidence obtained through inquiry.

CAS 500.A29 In respect of some matters, the auditor may consider it necessary to obtain written representations from management and, where appropriate, those charged with governance to confirm responses to oral inquiries. See CAS 580 for further guidance.

Obtaining Evidence

CSAE 3001.53R Based on the practitioner’s understanding (see paragraph 51R) the practitioner shall: (Ref: Para. A110-A114)

(a) Identify and assess the risks of significant deviation; and

(b) Design and perform procedures to respond to the assessed risks and to obtain reasonable assurance to support the practitioner’s conclusion. In addition to any other procedures on the underlying subject matter that are appropriate in the engagement circumstances, the practitioner’s procedures shall include obtaining sufficient appropriate evidence as to the operating effectiveness of relevant controls over the underlying subject matter when:

(i) The practitioner intends to rely on the operating effectiveness of those controls in determining the nature, timing and extent of other procedures, or

(ii) Procedures other than testing of controls cannot alone provide sufficient appropriate evidence.

Revision of Risk Assessment in a Reasonable Assurance Engagement

CSAE 3001.54R The practitioner’s assessment of the risks of significant deviation may change during the course of the engagement as additional evidence is obtained. In circumstances where the practitioner obtains evidence which is inconsistent with the evidence on which the practitioner originally based the assessment of the risks of significant deviation, the practitioner shall revise the assessment and modify the planned procedures accordingly. (Ref: Para. A114)

The Nature, Timing and Extent of Procedures (Ref: Para. 53(L)–54(R))

CSAE 3001.A110 The practitioner chooses a combination of procedures to obtain reasonable assurance or limited assurance, as appropriate. The procedures listed below may be used, for example, for planning or performing the engagement, depending on the context in which they are applied by the practitioner:

Inspection;
Observation;
Confirmation;
Recalculation;
Reperformance;
Analytical procedures; and
Inquiry.

CSAE 3001.A111 Factors that may affect the practitioner’s selection of procedures include the nature of the underlying subject matter; the level of assurance to be obtained; and the information needs of the intended users and the engaging party, including relevant time and cost constraints.

CSAE 3001.A112 In some cases, a subject-matter-specific CSAE may include requirements that affect the nature, timing and extent of procedures. For example, a subject-matter-specific CSAE may describe the nature or extent of particular procedures to be performed or the level of assurance expected to be obtained in a particular type of engagement. Even in such cases, determining the exact nature, timing and extent of procedures is a matter of professional judgment and will vary from one engagement to the next.

CSAE 3001.A113 In some engagements, the practitioner may not identify any areas where a significant deviation is likely to arise. Irrespective of whether any such areas have been identified, the practitioner designs and performs procedures to obtain a meaningful level of assurance.

CSAE 3001.A114 An assurance engagement is an iterative process, and information may come to the practitioner’s attention that differs significantly from that on which the determination of planned procedures was based. As the practitioner performs planned procedures, the evidence obtained may cause the practitioner to perform additional procedures.

OAG Policy

Auditors shall design detailed audit programs, setting out the procedures that are appropriate to obtain sufficient appropriate audit evidence through the selected use of

inspection
observation
external confirmation
recalculation
reperformance
analytical procedures
inquiry [Nov-2011]

Audit programs shall be reviewed and approved before the start of the execution/examination phase. Any changes to an approved audit program shall be reviewed and approved on a timely basis. [Nov-2011]

OAG Guidance

Note: CAS 500—Audit Evidence, contains significant guidance explaining what constitutes audit evidence. It deals with the auditor’s responsibility to design and perform audit procedures to obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base the auditor’s opinion.

Audit procedures for obtaining audit evidence

The evidence-gathering process involves the following steps:

designing the audit procedures;
carrying out the audit procedures;
analyzing evidence and drawing conclusions, which may also involve evaluating performance against the audit criteria; and
making decisions about whether additional information is required and can be obtained (go back to step 1) or whether sufficient appropriate evidence exists.

Audit procedures typically focus on the key risk areas identified through a risk assessment.

Alternative procedures may be performed during the examination stage as teams encounter unforeseen difficulties in gathering sufficient appropriate audit evidence. Auditors have to be alert to any signs that the evidence-gathering process may not be achieving the level of assurance required for the assurance engagement and take appropriate corrective action. If there are any amendments to the approved audit program, communicate these changes, on a timely basis, with the senior members of the audit team, obtain approval for the changes and include appropriate information on the nature, timing, and extent of alternative procedures performed.

Related Guidance:

See OAG Annual Audit 5011 for guidance on risk assessment and related activities.

See OAG Annual Audit 6051 for guidance on developing and executing a controls test plan and OAG Annual Audit 5034 for guidance on walk-through procedures.

See OAG Annual Audit 6056 for guidance on using audit evidence obtained in previous audits.

See OAG Annual Audit 7015 for guidance on appropriate timing for performance of audit procedures and using audit information obtained during an interim period.

See OAG Annual Audit 7031 for guidance on substantive analytics.

See OAG Annual Audit 7041 for guidance on tests of detail.

Inspection. Inspection of documents and records provides varying degrees of reliability, depending on the nature and source of the documents. Inspection of physical assets provides highly reliable evidence of existence and some indication of value (if it does not appear damaged or obsolete) but not necessarily of ownership or value.

Observation. Observation of the application of a client’s or entity’s policy or procedure provides assurance of that procedure at a given point in time, but not necessarily of its performance at other times during the year.

See OAG Annual Audit 7062 for guidance on observation of inventory counting.

External confirmation. Confirmation is a written request addressed to third parties.

See OAG Annual Audit 7050 for guidance on external confirmations.

Recalculation. Computation or recalculation provides a high level of assurance regarding arithmetical accuracy.

See OAG Annual Audit 7591 for guidance on use of computer-assisted audit techniques (CAATs).

Reperformance. Reperformance techniques may be performed manually or through the use of computer-assisted audit techniques (CAATs).

Related guidance:

See OAG Annual Audit 6051 for guidance on testing controls without using CAATs.

See OAG Annual Audit 7591 for guidance on use of CAATs.

Analytical procedures

Analytical procedures are used throughout the audit process and are conducted for the following primary and secondary purposes:

Primary

Risk assessment—to obtain a robust understanding of the entity in a way that helps us to direct our attention to potential indicators of risks of material misstatement/significant deviation, assess those risks and to design audit procedures focused on potential material misstatements/significant deviation
Substantive procedures—to obtain audit evidence or to identify potential misstatements/errors or significant deviation as a substitute for or to supplement tests of details
Overall conclusion—to assist in considering whether information presented in the audit report or in the financial statements is consistent with our understanding of the entity

Secondary

Entity communications—to develop more meaningful entity communications through a deeper understanding of the relevant business and audit issues.

Related guidance:

See OAG Annual Audit 5012.2 for guidance on use of risk assessment analytical procedures.

See OAG Annual Audit 7030 for guidance on use of substantive analytical procedures.

See OAG Annual Audit 9021 for guidance on use of overall conclusion analytical procedures.

Auditors use analytical procedures at various stages of the audit for different purposes. They use preliminary analytical procedures when planning the audit to confirm the planned audit approach or to identify new risk areas that need to be addressed during the audit. At the reporting phase of the audit, auditors use analytical procedures to assess whether the opinion/report taken as a whole is reasonable and consistent with their knowledge of the subject matter and the expected results where applicable.

Inquiry

Inquiry involves

considering the knowledge, objectivity, experience, responsibility, and qualifications of the individual to be interviewed;
asking clear and concise questions;
using open or closed questions appropriately;
listening actively and effectively;
maintaining a skeptical mindset; and
evaluating the interviewee’s responses based on our understanding of the entity and other audit procedures performed, and asking follow-up questions.

Inquiries can often be efficiently combined with other testing procedures such as observation and will frequently be followed up by further audit procedures to obtain sufficient appropriate evidence.

Related guidance:

See OAG Annual Audit 9052 for guidance on written representations.

1052 Audit procedures for obtaining audit evidence Dec-2022

Overview

CPA Canada Assurance Standards

OAG Policy

OAG Guidance

Audit procedures for obtaining audit evidence

Analytical procedures

Inquiry

Related Sections

1052 Audit procedures for obtaining audit evidence
Dec-2022