Welcome to the World of Audit Evidence!

Hello future CPAs! Today we are diving into one of the most practical parts of the AUD exam: Use of Data and Information. This is where the rubber meets the road. In an audit, you aren't just checking boxes; you are collecting "clues" (evidence) to prove that the financial statements are fair.

Don't worry if this feels a bit technical at first. Think of yourself as a digital detective. Your job is to figure out which pieces of information are "solid gold" and which ones are "fools' gold." Let's break down how we use data to reach the right conclusions!

1. The Golden Rule: Relevance and Reliability

Before an auditor uses any piece of information, they must ask two questions: "Does this matter?" (Relevance) and "Can I trust this?" (Reliability).

Relevance

Relevance refers to the logical connection between the audit procedure and the assertion being tested.
Example: If you want to prove that a company actually owns their building (Ownership assertion), looking at a repair bill isn't very relevant. You need the title deed.

Reliability

Evidence reliability depends on its source, nature and circumstances. Direct, independent external and documentary evidence are generally more reliable, but there is no universal ranking that overrides relevance or authenticity. Internal information can be supported by testing its accuracy/completeness or relevant controls. More evidence cannot compensate for poor quality.

  1. Evidence reliability depends on its source, nature and circumstances. Direct, independent external and documentary evidence are generally more reliable, but there is no universal ranking that overrides relevance or authenticity. Internal information can be supported by testing its accuracy/completeness or relevant controls. More evidence cannot compensate for poor quality.

Quick Review Box:
High Reliability: Bank statements sent directly to the auditor.
Low Reliability: A photocopy of a handwritten note from the CEO.

2. Information Produced by the Entity (IPE)

Most of the data you use will come from the client’s computer system. We call this IPE (Information Produced by the Entity). Think of these as "System-Generated Reports."

Information produced by the entity includes manual as well as electronic information. Obtain evidence about its accuracy and completeness and evaluate whether it is sufficiently precise and detailed for the audit purpose. Direct testing or relevant control testing may support reliability. Reconciliation to the ledger may help but is neither sufficient by itself nor a universal prerequisite for every type of information.

  • Information produced by the entity includes manual as well as electronic information. Obtain evidence about its accuracy and completeness and evaluate whether it is sufficiently precise and detailed for the audit purpose. Direct testing or relevant control testing may support reliability. Reconciliation to the ledger may help but is neither sufficient by itself nor a universal prerequisite for every type of information.

Information produced by the entity includes manual as well as electronic information. Obtain evidence about its accuracy and completeness and evaluate whether it is sufficiently precise and detailed for the audit purpose. Direct testing or relevant control testing may support reliability. Reconciliation to the ledger may help but is neither sufficient by itself nor a universal prerequisite for every type of information.

3. Audit Data Analytics (ADA)

Audit Data Analytics (ADA) is the use of software to discover patterns, find "outliers" (weird things), and extract useful information from large sets of data. It allows us to look at 100% of the transactions instead of just a small sample.

The ADA Process: Step-by-Step

  1. Plan the ADA: Define what question you are trying to answer.
  2. Access and Prepare the Data: Make sure the data is "clean" (formatted correctly).
  3. Consider Relevance and Reliability: Is the data coming from a trusted source?
  4. Perform the ADA: Run the software and generate visualizations (charts/graphs).
  5. Evaluate Results: Decide if the "outliers" are actual errors or just unusual but okay items.

Did you know?
ADAs are great for Risk Assessment. For example, you can use a "heat map" to see if a specific warehouse has way more inventory write-offs than others. This tells you exactly where to focus your "detective" work!

4. Using the Work of an Auditor’s Specialist

Sometimes, auditors aren't experts in everything. If you are auditing a jewelry store, you might not know if a diamond is real or glass. In this case, you hire an Auditor’s Specialist.

Your responsibilities when using a specialist:
  • Evaluate their Competence (Do they have the right license?).
  • Evaluate their Capabilities (Do they have the resources to do the job?).
  • Evaluate their Objectivity (Are they independent of the client?).
  • Understand their methods and assumptions.

Key Takeaway: Even though the specialist did the work, the auditor is still 100% responsible for the audit opinion. You cannot just "blame the specialist" if things go wrong!

5. External Confirmations

An External Confirmation is a direct written response to the auditor from a third party (the confirming party). This is very high-quality evidence because it comes from outside the company.

Positive vs. Negative Confirmations

  • Positive confirmations request a response; negative confirmations request one only for disagreement. Under AU-C 505, negative requests alone require low assessed risk, evidence of effective relevant controls, many small homogeneous items, very low expected exceptions and no reason to expect recipients to disregard them. Current PCAOB AS 2310 does not permit negative requests alone as sufficient substantive evidence. Silence is not proof of agreement.

Positive confirmations request a response; negative confirmations request one only for disagreement. Under AU-C 505, negative requests alone require low assessed risk, evidence of effective relevant controls, many small homogeneous items, very low expected exceptions and no reason to expect recipients to disregard them. Current PCAOB AS 2310 does not permit negative requests alone as sufficient substantive evidence. Silence is not proof of agreement.

Quick Summary for the Exam

Information produced by the entity includes manual as well as electronic information. Obtain evidence about its accuracy and completeness and evaluate whether it is sufficiently precise and detailed for the audit purpose. Direct testing or relevant control testing may support reliability. Reconciliation to the ledger may help but is neither sufficient by itself nor a universal prerequisite for every type of information.

Keep going! Auditing is all about building a logical argument based on the best information available. You've got this!