CIA Part 2 Evidence

Three questions for evidence

Evidence evaluation begins with three questions: Is the information relevant to the objective? Is it reliable for the assertion being tested? Is it sufficient in coverage and quantity to support the conclusion? These qualities work together. A large volume of irrelevant records is not sufficient evidence, and a reliable source does not help if it addresses the wrong question.

Relevance is the connection between information and the engagement objective. If the objective is whether terminated employees lost system access promptly, a current employee roster is not enough. The auditor needs termination dates, access-change evidence, and perhaps logs showing when access ended.

Reliability depends on origin, creation, transmission, controls over alteration, independence, and corroboration. Direct observation or external confirmation may be more persuasive in some circumstances, but no evidence type is automatically reliable for every assertion. A system log can be altered or incomplete; an external response may address only one part of a transaction.

Sufficiency concerns whether coverage supports the audit conclusion. A single verified transaction may demonstrate a control can work once, but it rarely proves consistent operation throughout a year. The needed quantity and breadth depend on risk, population, control frequency, test purpose, and quality of evidence.

Match evidence to the assertion

First identify what the auditor must establish. Authorization asks whether the proper person approved an action. Accuracy asks whether amounts and data are correct. Completeness asks whether all relevant transactions are included. Timeliness asks whether an activity happened within a required period. A procedure should target the assertion, not merely collect convenient documents.

For completeness of refunds, trace a sequence of system-generated refund records to accounting entries and investigate gaps. For validity, select recorded refunds and trace them to customer requests and authorization. The direction of testing matters: tracing from source to record addresses possible omissions; selecting records and tracing back tests whether recorded items are supported.

If the objective is to determine whether a review control operated, a policy establishes intended design, but dated review evidence supports operation. The auditor may inspect sign-offs, comments, exception resolution, and population coverage. A signature alone may prove only that a field was completed, not that the reviewer challenged unusual items.

Evaluate sources and corroborate

Inquiry is useful for learning how a process works, identifying known issues, and locating evidence. It is usually weaker when it is the sole support for a conclusion about consistent control operation. Corroborate important statements with records, observation, system data, or independent confirmation.

Observation can show how a process operates at a particular time. It may not establish that staff behave the same way when the auditor is absent or in other locations. Inspection of historical records can cover a period but depends on the records’ integrity and completeness. Reperformance can test whether a control or calculation works when the auditor independently repeats it.

External evidence may be valuable, such as a bank confirmation or vendor statement, but examine whether the source is independent, the response is authentic, and the question matches the objective. An external document supplied by management is not automatically independent merely because an outside party created it.

Digital evidence requires attention to extraction logic, access, date fields, time zones, filters, deleted records, and retention. Preserve the query, parameters, source, and date of extraction. If a data analyst transforms the information, document the transformation and validate totals or samples back to source.

Sufficiency and triangulation

Triangulation means using more than one type of evidence to test the same important issue. For example, a manager interview, system access log, and HR termination file may collectively show whether access was removed on time. If they conflict, do not average them; understand why and which source is more reliable for each fact.

Evidence can be sufficient without every conceivable document. The goal is enough relevant, reliable information to support a reasonable conclusion and meet the engagement objective. High-risk or complex matters may require broader corroboration. A low-risk, clearly controlled process may not need the same depth.

Contradictory evidence must be documented and resolved or disclosed as a limitation. If policy says all account changes require two approvals but system records show one, investigate whether another approved record exists, whether a permitted exception applies, or whether the control failed. Do not omit the conflict because it weakens the preferred conclusion.

Worked example: revenue completeness

An auditor reviews whether online sales are recorded in the general ledger. Management provides a ledger export and says it reconciles to the sales platform. The auditor first validates the source systems, date ranges, currencies, and transaction status definitions. A reconciliation total can hide omitted canceled, refunded, or offline transactions if the fields are not understood.

The objective is completeness, so the auditor traces a population from the sales platform through settlement and accounting records, rather than only selecting ledger entries and asking whether each has a receipt. The auditor tests interfaces, unmatched items, settlement reports, and cutoff around period end.

A difference appears because the platform report includes pending transactions. The auditor learns that pending sales are not yet recognized under the accounting policy, verifies settlement status and period cutoff, and distinguishes valid timing from omission. The conclusion describes the tested interface and exceptions. The evidence is relevant to completeness, reliable after source validation, and sufficient only if the selected periods and populations cover the defined scope.

Document evidence so it can be reviewed

Workpapers should show the objective, procedure, population, selection, source, evidence obtained, analysis, exceptions, reviewer actions, and conclusion. A reviewer should understand the reasoning without relying on the preparer’s memory. Save extracts or references in a secure manner consistent with retention and privacy requirements.

Document the sample basis and limitations. If selection was judgmental, say so. If an electronic extract excludes a system, note that boundary. If evidence could not be obtained, state the impact on assurance and alternatives considered. Do not use a generic “no exceptions noted” sentence when the testing did not address all relevant attributes.

When evidence conflicts, preserve both sides and record resolution. The final report should not present an unqualified conclusion that contradicts the workpapers. Strong documentation protects the credibility of the engagement and allows future auditors to understand what was tested.

Common evidence mistakes

Mistake one: treating inquiry as proof. Ask what independent evidence supports the statement. Mistake two: confusing relevance with reliability. A log can be directly relevant but still untrustworthy if the system allows administrators to alter it without detection. Mistake three: treating quantity as sufficiency. Hundreds of transactions from one low-risk month may not cover seasonal or year-end risk.

Mistake four: ignoring negative or contradictory evidence. A conclusion should reflect the full record, not only the evidence that supports the initial hypothesis. Mistake five: overclaiming from an exception. The finding should fit the population, period, and selection method.

On the exam, identify the assertion and the evidence gap. Choose the procedure that closes that gap, not the one that simply collects more documents.

Study checklist

For each practice item, state the objective, assertion, evidence source, reliability concern, coverage, and conclusion limit. Explain whether the procedure is inquiry, inspection, observation, confirmation, analysis, or reperformance, and what it can establish.

The current Part 2 syllabus places evidence within Information Gathering, Analysis, and Evaluation, which carries 40%. Strong answers connect evidence quality to planning: an auditor chooses sources and tests based on objective, scope, criteria, and risk.

When evidence is missing

If expected evidence cannot be obtained, determine why. Records may be retained in another system, destroyed under a retention schedule, unavailable because of a control failure, or withheld. The response affects scope and risk. Seek appropriate alternative procedures, assess whether the objective can still be met, and communicate a material limitation.

Do not substitute a less relevant source simply to complete a checklist. If an approval record is missing, a later payment record may show the transaction settled but cannot prove the required approval occurred before payment. Explain the gap and any residual uncertainty.

Evidence and professional skepticism

Professional skepticism means evaluating information with a questioning mind, not assuming everyone is dishonest. Consider incentives, inconsistencies, unexpected patterns, and the reliability of explanations. Follow up on information that contradicts an initial conclusion.

Anomalies do not prove misconduct, but they should not be dismissed because management offers a plausible story. Corroborate the explanation, document evidence, and consult the engagement supervisor when the matter may involve fraud, legal obligations, or sensitive escalation.

A source-comparison exercise

Suppose a department manager says monthly reconciliations were completed, a checklist has initials for each month, and the reconciliation file contains unresolved differences. The checklist is evidence that a form was completed; the unresolved items raise a question about review quality and follow-up. The auditor should inspect the underlying reconciliation, determine whether the reviewer investigated variances, and assess the control objective.

This comparison prevents a common shortcut: equating a signature with an effective control. Evidence should establish both performance and the attribute the control is meant to achieve.

Sampling workpapers should identify how each selected item was obtained and what evidence was examined. When documents are sensitive, cite secure storage locations and restrict access. The workpaper must remain reviewable without copying unnecessary personal data into an unsecured file.

The reviewer should be able to follow this trail.