COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.
7021 Evaluate the Sufficiency and Appropriateness of Audit Evidence
Apr-2018
Overview
Audit programs developed during the planning phase outline the required evidence and how it will be collected, tested, and analyzed. During the examination phase, the audit team carries out this plan. Before completing the examination phase, the audit team must ensure that there is sufficient appropriate evidence to conclude.
This section explains
-
the requirement to evaluate, before the conclusion of the audit, whether the risk assessment remains appropriate; and
-
the requirement to conclude whether sufficient appropriate audit evidence has been obtained and factors to guide this judgment.
OAG Policy
Before the conclusion of the audit, the engagement leader shall ensure the applied risk assessment remains appropriate. [Nov-2011]
Before the conclusion of the audit, the engagement leader shall consider if sufficient appropriate audit evidence was obtained or if additional audit procedures are needed. [Nov-2011]
If the engagement leader is unable to obtain sufficient appropriate audit evidence, he or she shall consult in accordance with OAG Audit 3081, to evaluate the impact on the assurance engagement report. [Apr-2015]
OAG Guidance
OAG Audit 1051 provides guidance on the concept of “sufficient appropriate audit evidence.”
In an engagement designed to provide a high level of assurance, both positive observations or conclusions and “reservations” (negative observations or conclusions, or modifications of opinion), must be able to withstand critical examination. In determining whether they have gathered evidence of sufficient quantity and appropriate quality, auditors need to be certain that, in their judgment, there is a low risk of making erroneous observations, faulty conclusions, or inappropriate recommendations. In considering whether they have obtained sufficient appropriate audit evidence, auditors consider the level of assurance being provided and the assessment of significance and risk. For example, audits that provide a high level of assurance generally have a higher threshold for what is sufficient appropriate evidence than a review (which provides moderate or limited assurance). Similarly, a high-risk or a significant/material audit component will typically have a higher threshold for what is sufficient appropriate evidence than a lower risk audit component.
An audit is a cumulative and iterative process. As audit work proceeds, information may come to the auditor’s attention that differs from the information used to plan the audit. Initial findings may cause the auditor to re-evaluate the planned audit procedures and the level of evidence gathered, based on a revised consideration of risks. Before the conclusion of the audit, the same principles apply—the engagement leader needs to ensure the initial or revised risk assessment applied in the engagement remains valid. This is necessary since the risk assessment helped direct audit strategy, planned audit procedures, and the level and extent of evidence gathered.
For performance audits and special examinations, analysis of audit evidence can be thought of as building an argument that leads to conclusions that can withstand critical scrutiny. Working from the evidence presented in the completed audit programs, teams build the argument, step by step, for their observations, conclusions, and recommendations. At each step, teams should consider the possibility that their argument could be flawed if they base it on erroneous or incomplete information, or that the logic is not convincing.
Teams consider all relevant evidence, regardless of whether it appears to corroborate or contradict the assertions or audit criteria. Teams should approach the analysis of audit evidence not only with an objective frame of mind, but also with a level of skepticism (OAG Audit 1041). While theories or predictions about what the audit may conclude are essential to planning and conducting the examination, teams should be aware of the possibility that their preliminary conclusions are incorrect, and remain open to alternative interpretations of the evidence. Teams should encourage and be open to having their findings challenged. This is particularly true when the audited entity provides interpretations of the evidence. Rather than resisting or even dismissing these other views, teams should examine the evidence from them.
In making the judgment of whether sufficient appropriate audit evidence has been obtained, the audit team considers the following questions:
-
Has the team obtained audit evidence regarding all relevant assertions and/or criteria (OAG Annual Audit 4032)?
-
Has the team, as part of executing the audit procedures, identified instances where further evidence was required? If yes, has it obtained, documented, and appropriately linked this further work (OAG Annual Audit 4051 and OAG Annual Audit 7016)?
-
Has the team considered the impact of identified issues and/or misstatements on the nature, timing, and extent of further procedures (OAG Annual Audit 9013)?
-
Has the team identified any significant matters and appropriately addressed them (OAG Audit 1141)? Where appropriate, has it consulted and documented the results of these consultations (OAG Audit 3081)?
-
Has the team addressed all required audit procedures (OAG Annual Audit 4023 and OAG Annual Audit 9001)?
Teams also consider whether the resolution of differences of opinion, quality review procedures, and consultations undertaken may impact decisions around the sufficiency and appropriateness of audit evidence (OAG Audit 3082, OAG Audit 3063, OAG Audit 3081).
Additional considerations for performance audits and special examinations
Determining whether more evidence is needed. For performance audits and special examinations, when the evidence does not point clearly to whether a criterion has been met—for example, if some positive and some negative evidence exists—the team may need to investigate further in order to gain the required level of assurance.
This may be required, for example, to
-
determine whether an issue is an isolated instance or represents a systemic problem;
-
determine who is affected by the issue (e.g., other units in the entity, central agencies, or third parties);
-
assess the impact or potential impact of an issue;
-
determine whether the issue can be addressed by the audited entity or whether it results from circumstances beyond its control; and
-
determine whether entity’s management is aware of the issue and whether it has taken corrective action.
If additional evidence needs to be gathered, this may involve additional interviews or review of additional files.
Confirming the absence of evidence. If evidence is not found in an area where the auditor expects to find it, this could be a finding in itself. The auditor first needs to confirm that the evidence should exist. For example, if project X is a capital project over a certain size, government policy requires that a business case be prepared. Therefore, a documented business case should exist. If the auditor requests a copy of the document and the entity cannot provide it, this should be stated in writing.
Fact verification. For performance audits and special examinations, as the audit team gathers and analyzes audit evidence during the examination phase, it meets with entity officials to communicate emerging findings and seek confirmation and validation of facts to ensure the accuracy and completeness of the evidence. It is important that the team does this before providing the draft report to the entity.
Audit teams generally hold a series of meetings with senior entity officials to present and discuss findings to avoid surprises later in the process. Officials may disagree with findings based on a different weighting of the evidence or based on new evidence they provided. There may be a misunderstanding of an issue, or a key factor may have changed since the audit began. In some cases, the entity may fully agree with a finding and want greater emphasis placed on it. Early presentation of findings provides the entity with an opportunity to provide evidence that it believes should be taken into account.