7060 Substantiation
Aug-2021

Overview

Substantiation is not a concept referred to in CSAE 3001. The CSAE 3001 requires that the audit team prepares audit documentation and that sufficient appropriate evidence be obtained to provide the engagement leader with a reasonable basis to support the conclusions expressed in the report (OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence and OAG Audit 7040 Audit conclusion).

Substantiation is prepared by linking the evidence gathered throughout the audit and the audit documentation that includes logical deductions, judgments, and conclusions to the statements identified. It helps the presenter of the report to quickly locate the source and substance of supporting evidence when needed, such as when debriefing the entity’s management of audit findings, briefing the Auditor General on the draft audit report, acting as a witness at parliamentary committee hearings, or answering queries from the media.

OAG Policy

Statements requiring substantiation in the audit report shall be identified by audit team members and reviewed by the engagement leader. [Aug-2021]

OAG Guidance

Substantiation provides a link or connection between (1) the evidence gathered throughout the audit and the audit documents, such as audit programs and working papers that include logical deductions, judgments, and conclusions and (2) the statements in the audit report. Using the guidance provided below, auditors use professional judgment to determine the statements of the report that would require this link for the purpose of facilitating an easy and straightforward retrieval of underlying information.

The substantiation process

The audit team is responsible for identifying the statements for substantiation in the report. Each of these statements is linked (or connected) to the relevant audit documentation that supports it, for example, evidence collected throughout the audit, audit programs that present conclusions, and working papers that present logical deductions and professional judgments. At the time of performing this exercise, the audit evidence had already been gathered and evaluated (OAG Audit 1051 Sufficient appropriate audit evidence and OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence), and conclusions have been reached and documented. Only in those rare instances when the auditor is not able to connect a statement to existing audit documentation, the rationale supporting the statement is added as part of the substantiation process and will be part of the audit documentation.

Further, if in exceptional circumstances new evidence is brought to the attention of the audit team after substantiation has been performed, this new evidence will be incorporated into the audit documentation.

Roles and responsibilities for substantiation

The preparation and review of substantiation is a team effort and involves all members of the team, as team members have an in-depth understanding on the areas they worked on. The substantiation is prepared by team members and consists of links to audit programs, source documents, evidence, and working papers, including those that explain how the source documents logically support the findings and conclusions (OAG Audit 7030 Drafting the audit report). The specific responsibilities of each team member are defined below:

Auditors

  • Auditors prepare substantiation to support the statements in the findings and conclusions. As explained below, in rare circumstances, statements requiring substantiation may be found in other sections of the report. The auditors indicate which statements they have prepared and reference those statements to evidence already obtained.

Audit Director

  • The audit director reviews the substantiation prepared by audit team members for the principal’s (PX) draft and submits it to the engagement leader for the final review before the PX draft is issued to the audited entity.

  • The audit director also reviews the substantiation adjusted by the audit team members for the transmission draft and submits it to the engagement leader for the final review before the transmission draft is issued to the audited entity. The substantiation is adjusted only if

    • significant changes to the report affected statements in such way that the link between the audit evidence and documentation is broken

    • statements requiring substantiation were added in the report

Engagement Leader

  • The engagement leader documents a review of the substantiation of statements in the report.
  • Before issuing the PX draft, the engagement leader reviews the substantiation.
  • Before issuing the transmission draft, the engagement leader reviews the adjusted substantiation.

Internal Specialists

  • Internal specialists may review the substantiation for the statements related to their area of expertise.

Principles for substantiation

The following principles outline the format and approach that can be followed in the preparation and review of substantiation.

When thinking about substantiation, the auditor should understand the difference between

  • linking (or mapping) evidence to audit work such as audit programs and working papers, which is done to support the engagement leader in reviewing the completeness and appropriateness of audit evidence to reduce the risk of error in the report

  • linking (or mapping) evidence or audit documentation to the audit report statements (that is, substantiation), which is done to facilitate an easier and quicker response if the facts are questioned when the report is presented to third parties

1. Ensure the preconditions for substantiation are met

In order to perform an efficient and useful substantiation, the following preconditions should be met:

  • Audit teams should clear issues, observations, facts, findings, information received in a timely manner. Clearance with the audited entity should happen and be documented periodically throughout the engagement. Further, it should be performed at the right level (such as the operational or management levels) using the appropriate format (such as emails or periodic status meetings).

  • The sufficiency and appropriateness of audit evidence should be evaluated throughout the audit and be finalized before commencing the substantiation. In accordance with OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence, the engagement leader is accountable and should ensure that there is sufficient appropriate evidence to support the conclusion of the audit report.

  • Audit documentation is reviewed and signed off by the engagement leader in a timely manner.

2. Substantiate only what is important

Before undertaking a substantiation exercise, the audit team should determine which statements in the audit report should be substantiated. Substantiation is more suitable for statements that

  • are sensitive in nature
  • involve complex calculations or analysis
  • involve significant judgments
  • relate to a significant deviation identified
  • are or might be contentious with the entity
  • are significant to the well-being of Canadians
  • are or might be a source of public debate or media attention
  • are key to the conclusion reached

Statements requiring substantiation are mainly found in the “Findings” and “Conclusions” sections of the audit report. As an exception, they might also be found in the “Introduction” section. It is expected that no statements requiring substantiation be identified in the other sections, such as “Recommendations,” “Responses,” or “About the Audit.”

3. Choose the substantiation format and assemble the evidence clearly and logically

Substantiation can be documented in a variety of ways. Two options are

  • Footnotes—Statements identified in the PX draft are linked to corresponding or supporting evidence or audit documentation using footnotes. As the PX draft changes into the transmission draft, the wording or the sequence of the statements might change, but the links follow them. This method might offer some advantages. For example, as the report draft is reworded, it might be sufficient to review the corresponding sources or links to ensure they still best reflect the new wording.

  • Appendix—A simple table can be attached to the PX draft with 2 columns: statement (as it appears in the report) and reference or source documentation. Optionally, a third column for paragraph numbers can be added to indicate where the statement is located in the report.

Clear references to audit documentation should be used to document the location of the evidence that supports the statements. At the time of performing substantiation, the audit documentation that is linked to the statements should already include the necessary contextual information, explanations, assumptions, or logic arguments required to understand the evidence. For this reason, when the draft report is reworded, the link that connects the audit documentation to the statement should not be affected. Further, the relevant extract from the audit documentation should be easy for a reviewer to find.

As evidence is obtained and added to the file during the audit, the naming convention for working papers, documents, and interview notes should be followed by the audit team. This will help ensure that the evidence used for substantiation is organized and documented consistently. A protocol has been established that covers file naming conventions and other topics. When interview notes are referenced in the substantiation, include the interviewee’s approval or “sign-off” of the notes.

Determining the appropriate level of substantiation for each statement is a matter of judgment. Auditors should present the strongest or best evidence first and then add supplementary sources only where necessary.

Tips for performing an easy, straightforward, and efficient substantiation
  • When the audit team clears issues, observations, facts, findings, information received, and so on periodically throughout the audit and at the right level within the audited entity, it reduces the risks that new information or evidence comes to light towards the end of the audit, or even after the PX draft. Consequences? Your evidence and audit documentation will be solid, so less time—or even no additional time—will be spent making small adjustments as you work on the transmission draft.

  • The evaluation of sufficiency and appropriateness of audit evidence should happen throughout the audit and be finalized before commencing the substantiation. In accordance with OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence, the engagement leader is accountable and should ensure that there is sufficient appropriate evidence to support the conclusion of the audit report.

  • When the audit team performs substantiation (that is, links statements that are important with the relevant evidence or audit documentation), it is simpler to make this link to audit documentation. Prepare separate working papers (for example, notes to file) to explain how the pieces of documentation fit together if needed. In addition, think like a reviewer: Is the link between the statements and the evidence or audit documentation sufficient, easily understandable, and readily available? Would the substantiation enable the engagement leader to provide a prompt, complete response to an internal question or to an external question from Parliament, the board of directors, or the media?

Example of the substantiation process
  • A working paper was prepared by the auditor and reviewed by the engagement leader. In it, the auditor has described the audit work, the evidence evaluated, the audit procedures performed, the result of the audit work, and so on.

  • This working paper is relevant to an important statement in the audit report, so it has to be included in the substantiation.

  • The auditor highlights the specific paragraph or paragraphs that are relevant for readers when they open the document.

  • When substantiating (using either of the 2 methods), the auditor indicates the hyperlink to this working paper document.

  • New information or evidence comes to light, and it impacts the audit report:

Step 1: The auditor goes back to the initial working paper where the related audit work was described.

Step 2: The auditor amends the working paper as necessary based on the new information or evidence.

Step 3: The auditor rechecks if the highlighted paragraphs are still relevant.

Step 4: Nothing—there is no need to go back to substantiation file. The link protects the auditor from having to duplicate work.