COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

7021 Evaluate the Sufficiency and Appropriateness of Audit Evidence
Apr-2018

Overview

Audit programs developed during the planning phase outline the required evidence and how it will be collected, tested, and analyzed. During the examination phase, the audit team carries out this plan. Before completing the examination phase, the audit team must ensure that there is sufficient appropriate evidence to conclude.

This section explains

the requirement to evaluate, before the conclusion of the audit, whether the risk assessment remains appropriate; and
the requirement to conclude whether sufficient appropriate audit evidence has been obtained and factors to guide this judgment.

CPA Canada Copyright

CPA Canada Assurance Standards

Office

Annual Audit

Performance Audit, Special Examination, and Other Assurance Engagements

CAS 200.11 In conducting an audit of financial statements, the overall objectives of the auditor are:

(a) To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and

(b) To report on the financial statements, and communicate as required by the CASs, in accordance with the auditor’s findings.

CAS 330.25 Based on the audit procedures performed and the audit evidence obtained, the auditor shall evaluate before the conclusion of the audit whether the assessments of the risks of material misstatement at the assertion level remain appropriate. (Ref: Para. A62-A63)

Evaluating the Sufficiency and Appropriateness of Audit Evidence (Ref: Para. 25-27)

CAS 330.A62 An audit of financial statements is a cumulative and iterative process. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing or extent of other planned audit procedures. Information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based. For example:

The extent of misstatements that the auditor detects by performing substantive procedures may alter the auditor’s judgment about the risk assessments and may indicate a significant deficiency in internal control.
The auditor may become aware of discrepancies in accounting records, or conflicting or missing evidence.
Analytical procedures performed at the overall review stage of the audit may indicate a previously unrecognized risk of material misstatement.

In such circumstances, the auditor may need to reevaluate the planned audit procedures, based on the revised consideration of assessed risks of material misstatement and the effect on the significant classes of transactions, account balances, or disclosures and their relevant assertions. CAS 315 contains further guidance on revising the auditor’s risk assessment.

CAS 330.A63 The auditor cannot assume that an instance of fraud or error is an isolated occurrence. Therefore, the consideration of how the detection of a misstatement affects the assessed risks of material misstatement is important in determining whether the assessment remains appropriate.

CAS 330.26 The auditor shall conclude whether sufficient appropriate audit evidence has been obtained. In forming an opinion, the auditor shall consider all relevant audit evidence, regardless of whether it appears to corroborate or to contradict the assertions in the financial statements. (Ref: Para. A64)

CAS 330.A64 The auditor’s judgment as to what constitutes sufficient appropriate audit evidence is influenced by such factors as the following:

Significance of the potential misstatement in the assertion and the likelihood of its having a material effect, individually or aggregated with other potential misstatements, on the financial statements.
Effectiveness of management’s responses and controls to address the risks.
Experience gained during previous audits with respect to similar potential misstatements.
Results of audit procedures performed, including whether such audit procedures identified specific instances of fraud or error.
Source and reliability of the available information.
Persuasiveness of the audit evidence.
Understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control.

CAS 330.27 If the auditor has not obtained sufficient appropriate audit evidence related to a relevant assertion about a class of transactions, account balance or disclosure, the auditor shall attempt to obtain further audit evidence. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor shall express a qualified opinion or disclaim an opinion on the financial statements.

Forming the Assurance Conclusion

CSAE 3001.68 The practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary in the circumstances, attempt to obtain further evidence. The practitioner shall consider all relevant evidence, regardless of whether it appears to corroborate or to contradict the measurement or evaluation of the underlying subject matter against the applicable criteria. If the practitioner is unable to obtain necessary further evidence, the practitioner shall consider the implications for the practitioner’s conclusion in paragraph 69. (Ref:
Para. A147-A153)

CSAE 3001.69 The practitioner shall form a conclusion about whether the underlying subject matter is free from significant deviation. In forming that conclusion, the practitioner shall consider the practitioner’s conclusion in paragraph 68 regarding the sufficiency and appropriateness of evidence obtained and an evaluation of whether identified deviations are significant, individually or in the aggregate. (Ref: Para. A5, A120 and A154-A155)

CSAE 3001.70 If the practitioner is unable to obtain sufficient appropriate evidence, a scope limitation exists and the practitioner shall express a qualified conclusion, disclaim a conclusion, or withdraw from the engagement, where withdrawal is possible under applicable law or regulation, as appropriate. (Ref: Para. A156-A158)

CSAE 3001.83 If the practitioner identifies information that is inconsistent with the practitioner’s final conclusion regarding a significant matter, the practitioner shall document how the practitioner addressed the inconsistency.

Significance

CSAE 3001.49 The practitioner shall consider significance when: (Ref: Para. A90-A98)

(b) Evaluating whether the underlying subject matter is free from significant deviation.

Forming the Assurance Conclusion

Sufficiency and Appropriateness of Evidence (Ref: Para. 14(j), 68)

CSAE 3001.A147 Evidence is necessary to support the practitioner’s conclusion and assurance report. It is cumulative in nature and is primarily obtained from procedures performed during the course of the engagement. It may, however, also include information obtained from other sources such as previous engagements (provided the practitioner has determined whether changes have occurred since the previous engagement that may affect its relevance to the current engagement) or a firm’s quality policies or procedures for acceptance and continuance of client relationships and assurance engagements. Evidence may come from sources inside and outside the appropriate party(ies). Also, information that may be used as evidence may have been prepared by an expert employed or engaged by the appropriate party(ies). Evidence comprises both information that supports and corroborates aspects of the underlying subject matter, and any information that contradicts aspects of the underlying subject matter. In addition, in some cases, the absence of information (for example, refusal by the appropriate party(ies) to provide a requested representation) is used by the practitioner and, therefore, also constitutes evidence. Most of the practitioner’s work in forming the assurance conclusion consists of obtaining and evaluating evidence.

CSAE 3001.A148 The sufficiency and appropriateness of evidence are interrelated. Sufficiency is the measure of the quantity of evidence. The quantity of evidence needed is affected by the risks of the underlying subject matter containing a significant deviation (the higher the risks, the more evidence is likely to be required) and also by the quality of such evidence (the higher the quality, the less may be required). For certain types of direct engagements such as performance audits, there may also be a higher risk of concluding that there is a significant deviation when that is not the case. The appropriateness of the practitioner’s decision regarding whether a matter identified is a significant deviation is affected by the quantity and quality of evidence obtained.

CSAE 3001.A149 Appropriateness is the measure of the quality of evidence; that is, its relevance and its reliability in providing support for the practitioner’s conclusion. The reliability of evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained. Generalizations about the reliability of various kinds of evidence can be made; however, such generalizations are subject to important exceptions. Even when evidence is obtained from sources external to the appropriate party(ies), circumstances may exist that could affect its reliability. For example, evidence obtained from an external source may not be reliable if the source is not knowledgeable or objective. While recognizing that exceptions may exist, the following generalizations about the reliability of evidence may be useful:

Evidence is more reliable when it is obtained from sources outside the appropriate party(ies).
Evidence that is generated internally is more reliable when the related controls are effective.
Evidence obtained directly by the practitioner (for example, observation of the application of a control) is more reliable than evidence obtained indirectly or by inference (for example, inquiry about the application of a control).
Evidence is more reliable when it exists in documentary form, whether paper, electronic, or other media (for example, a contemporaneously written record of a meeting is ordinarily more reliable than a subsequent oral representation of what was discussed).

CSAE 3001.A150 The practitioner ordinarily obtains more assurance from consistent evidence obtained from different sources or of a different nature than from items of evidence considered individually. In addition, obtaining evidence from different sources or of a different nature may indicate that an individual item of evidence is not reliable. For example, corroborating information obtained from a source independent of the appropriate party(ies) may increase the assurance the practitioner obtains from a representation from the appropriate party(ies). Conversely, when evidence obtained from one source is inconsistent with that obtained from another, the practitioner determines what additional procedures are necessary to resolve the inconsistency.

CSAE 3001.A151 In terms of obtaining sufficient appropriate evidence, it is generally more difficult to obtain assurance about the underlying subject matter covering a period than about underlying subject matter at a point in time. In addition, conclusions provided on processes ordinarily are limited to the period covered by the engagement; the practitioner provides no conclusion about whether the process will continue to function in the specified manner in the future.

CSAE 3001.A152 Whether sufficient appropriate evidence has been obtained on which to base the practitioner’s conclusion is a matter of professional judgment.

CSAE 3001.A153 In some circumstances, the practitioner may not have obtained the sufficiency or appropriateness of evidence that the practitioner had expected to obtain through the planned procedures. In these circumstances, the practitioner considers that the evidence obtained from the procedures performed is not sufficient and appropriate to be able to form a conclusion on the underlying subject matter. The practitioner may:

Extend the work performed; or
Perform other procedures judged by the practitioner to be necessary in the circumstances.

Where neither of these is practicable in the circumstances, the practitioner will not be able to obtain sufficient appropriate evidence to be able to form a conclusion. This situation may arise even though the practitioner has not become aware of a matter(s) that causes the practitioner to believe the underlying subject matter may have a significant deviation, as addressed in paragraph 54L.

Evaluating the Sufficiency and Appropriateness of Evidence
(Ref: Para. 69)

CSAE 3001.A154 An assurance engagement is a cumulative and iterative process. As the practitioner performs planned procedures, the evidence obtained may cause the practitioner to change the nature, timing or extent of other planned procedures. Information may come to the practitioner’s attention that differs significantly from that expected and upon which planned procedures were based. For example:

The extent of deviations that the practitioner identifies may alter the practitioner’s professional judgment about the reliability of particular sources of information.
The practitioner may become aware of discrepancies in relevant information, or inconsistent or missing evidence.
If analytical procedures were performed towards the end of the engagement, the results of those procedures may indicate a previously unrecognized risk of significant deviation.

In such circumstances, the practitioner may need to reevaluate the planned procedures.

CSAE 3001.A155 The practitioner’s professional judgment as to what constitutes sufficient appropriate evidence is influenced by such factors as the following:

Importance of a potential deviation and the likelihood of its having a significant effect, individually or when aggregated with other potential deviations, on the practitioner’s report.
Effectiveness of the appropriate party(ies)’s responses to address the known risk of significant deviation.
Experience gained during previous assurance engagements with respect to similar potential deviations.
Results of procedures performed, including whether such procedures identified specific deviations.
Source and reliability of the available information.
Persuasiveness of the evidence.
Understanding of the appropriate party(ies) and its environment.

OAG Policy

Before the conclusion of the audit, the engagement leader shall ensure the applied risk assessment remains appropriate. [Nov-2011]

Before the conclusion of the audit, the engagement leader shall consider if sufficient appropriate audit evidence was obtained or if additional audit procedures are needed. [Nov-2011]

If the engagement leader is unable to obtain sufficient appropriate audit evidence, he or she shall consult in accordance with OAG Audit 3081, to evaluate the impact on the assurance engagement report. [Apr-2015]

OAG Guidance

OAG Audit 1051 provides guidance on the concept of “sufficient appropriate audit evidence.”

In an engagement designed to provide a high level of assurance, both positive observations or conclusions and “reservations” (negative observations or conclusions, or modifications of opinion), must be able to withstand critical examination. In determining whether they have gathered evidence of sufficient quantity and appropriate quality, auditors need to be certain that, in their judgment, there is a low risk of making erroneous observations, faulty conclusions, or inappropriate recommendations. In considering whether they have obtained sufficient appropriate audit evidence, auditors consider the level of assurance being provided and the assessment of significance and risk. For example, audits that provide a high level of assurance generally have a higher threshold for what is sufficient appropriate evidence than a review (which provides moderate or limited assurance). Similarly, a high-risk or a significant/material audit component will typically have a higher threshold for what is sufficient appropriate evidence than a lower risk audit component.

An audit is a cumulative and iterative process. As audit work proceeds, information may come to the auditor’s attention that differs from the information used to plan the audit. Initial findings may cause the auditor to re-evaluate the planned audit procedures and the level of evidence gathered, based on a revised consideration of risks. Before the conclusion of the audit, the same principles apply—the engagement leader needs to ensure the initial or revised risk assessment applied in the engagement remains valid. This is necessary since the risk assessment helped direct audit strategy, planned audit procedures, and the level and extent of evidence gathered.

For performance audits and special examinations, analysis of audit evidence can be thought of as building an argument that leads to conclusions that can withstand critical scrutiny. Working from the evidence presented in the completed audit programs, teams build the argument, step by step, for their observations, conclusions, and recommendations. At each step, teams should consider the possibility that their argument could be flawed if they base it on erroneous or incomplete information, or that the logic is not convincing.

Teams consider all relevant evidence, regardless of whether it appears to corroborate or contradict the assertions or audit criteria. Teams should approach the analysis of audit evidence not only with an objective frame of mind, but also with a level of skepticism (OAG Audit 1041). While theories or predictions about what the audit may conclude are essential to planning and conducting the examination, teams should be aware of the possibility that their preliminary conclusions are incorrect, and remain open to alternative interpretations of the evidence. Teams should encourage and be open to having their findings challenged. This is particularly true when the audited entity provides interpretations of the evidence. Rather than resisting or even dismissing these other views, teams should examine the evidence from them.

In making the judgment of whether sufficient appropriate audit evidence has been obtained, the audit team considers the following questions:

Has the team obtained audit evidence regarding all relevant assertions and/or criteria (OAG Annual Audit 4032)?
Has the team, as part of executing the audit procedures, identified instances where further evidence was required? If yes, has it obtained, documented, and appropriately linked this further work (OAG Annual Audit 4051 and OAG Annual Audit 7016)?
Has the team considered the impact of identified issues and/or misstatements on the nature, timing, and extent of further procedures (OAG Annual Audit 9013)?
Has the team identified any significant matters and appropriately addressed them (OAG Audit 1141)? Where appropriate, has it consulted and documented the results of these consultations (OAG Audit 3081)?
Has the team addressed all required audit procedures (OAG Annual Audit 4023 and OAG Annual Audit 9001)?

Teams also consider whether the resolution of differences of opinion, quality review procedures, and consultations undertaken may impact decisions around the sufficiency and appropriateness of audit evidence (OAG Audit 3082, OAG Audit 3063, OAG Audit 3081).

Additional considerations for performance audits and special examinations

Determining whether more evidence is needed. For performance audits and special examinations, when the evidence does not point clearly to whether a criterion has been met—for example, if some positive and some negative evidence exists—the team may need to investigate further in order to gain the required level of assurance.

This may be required, for example, to

determine whether an issue is an isolated instance or represents a systemic problem;
determine who is affected by the issue (e.g., other units in the entity, central agencies, or third parties);
assess the impact or potential impact of an issue;
determine whether the issue can be addressed by the audited entity or whether it results from circumstances beyond its control; and
determine whether entity’s management is aware of the issue and whether it has taken corrective action.

If additional evidence needs to be gathered, this may involve additional interviews or review of additional files.

Confirming the absence of evidence. If evidence is not found in an area where the auditor expects to find it, this could be a finding in itself. The auditor first needs to confirm that the evidence should exist. For example, if project X is a capital project over a certain size, government policy requires that a business case be prepared. Therefore, a documented business case should exist. If the auditor requests a copy of the document and the entity cannot provide it, this should be stated in writing.

Fact verification. For performance audits and special examinations, as the audit team gathers and analyzes audit evidence during the examination phase, it meets with entity officials to communicate emerging findings and seek confirmation and validation of facts to ensure the accuracy and completeness of the evidence. It is important that the team does this before providing the draft report to the entity.

Audit teams generally hold a series of meetings with senior entity officials to present and discuss findings to avoid surprises later in the process. Officials may disagree with findings based on a different weighting of the evidence or based on new evidence they provided. There may be a misunderstanding of an issue, or a key factor may have changed since the audit began. In some cases, the entity may fully agree with a finding and want greater emphasis placed on it. Early presentation of findings provides the entity with an opportunity to provide evidence that it believes should be taken into account.

7021 Evaluate the Sufficiency and Appropriateness of Audit Evidence Apr-2018