Types of Audit Evidence and the Sufficiency Standard

An auditor’s conclusion depends on types of audit evidence and whether that evidence meets the dual standard of sufficiency and appropriateness. Sufficiency means having enough evidence; appropriateness means the evidence is relevant and reliable. These eight categories—documents, confirmations, observation, inquiry, recalculation, inspection, analytical procedures, and reperformance—each carry different weight, and auditors must justify why the mix they gathered supports their opinion.

The Two Pillars: Sufficiency and Appropriateness

An auditor cannot simply declare an opinion valid because they found one piece of evidence. Instead, they must assess both sufficiency and appropriateness—a two-part filter:

Sufficiency asks: Did I gather enough evidence? This is partly quantitative. Testing 5 transactions out of 500,000 is rarely sufficient for a major account; testing 500 might be. The auditor applies professional judgment, risk assessment, and audit standards to decide.

Appropriateness asks: Is this the right type of evidence for what I’m testing? A company’s own internal memo documenting the value of an intangible asset is less appropriate than an independent third-party valuation. An auditor’s observation of a physical inventory count is more appropriate than merely asking management to confirm the count happened.

Neither sufficiency nor appropriateness alone is enough. A large quantity of weak evidence (low appropriateness) doesn’t support a conclusion; a small quantity of strong evidence (high appropriateness) may not be sufficient. The auditor must find a balance—typically a mix of evidence types, each reinforcing the others.

The Eight Types of Audit Evidence Explained

1. Audit Documentation

Documents and records produced by the company or third parties are the backbone of most audits. These include:

• Invoices and supporting documentation: Proof that goods or services were delivered and billed.
• Purchase orders and receiving reports: Evidence that purchases were authorized and received.
• Contracts and agreements: Terms and conditions underlying account balances.
• General ledger entries and journal entries: The underlying transactions recorded.
• Bank statements and loan agreements: Evidence of debt, cash, and banking relationships.

Appropriateness varies. A vendor’s invoice showing goods shipped is highly reliable if authentic; a client’s internal memo asserting the reasonableness of an estimate is weak. Authentication matters: Is the document original or a copy? Is it signed or authorized? Could it be forged?

Sufficiency also depends on population size. Auditing 30 large invoices from a population of 50 is more likely sufficient than auditing 30 from a population of 50,000.

2. Confirmations

Confirmations are third-party written replies to direct auditor inquiries. The auditor requests a third party—a bank, customer, supplier, or lender—to reply directly to the auditor, bypassing the client.

Examples:

• Bank confirmations: The bank confirms the company’s account balance, debt, and payment terms.
• Accounts receivable confirmations: Customers confirm they owe the company and the outstanding balance.
• Accounts payable confirmations: Suppliers confirm amounts owed by the company.
• Lender confirmations: Lenders confirm loan balances, covenants, and terms.

Confirmations are high in appropriateness because they come from outside the company, reducing bias. However, they’re subject to:

• Non-response: A customer or supplier may not reply, weakening the sample.
• False confirmations: Fictitious customers or co-conspirators may forge replies (fraud risk).
• Negative vs. positive confirmations: A “negative” confirmation asks the recipient to reply only if they disagree (lower response but simpler). A “positive” confirmation asks for confirmation regardless (higher response but more effort). Positive confirmations are more appropriate.

Sufficiency requires a reasonable response rate, typically 70–90% depending on risk, account size, and nature of items.

3. Observation

The auditor directly observes a company process or asset. This provides real-time insight into control execution and physical reality.

Common observations:

• Inventory counts: The auditor observes the client’s physical count, notes control procedures (segregation, re-counting, documentation), and tests the accuracy of counts.
• Cash counting: Witnessing the count of petty cash or security transactions.
• Reconciliation procedures: Watching management perform a bank reconciliation or accounts payable aging.
• System access controls: Observing how access is granted and monitored in accounting systems.

Appropriateness is high for testing whether controls are actually in place and followed. If the client claims to segregate duties between authorization and payment, the auditor can observe this in action.

Limitation: Observation is a snapshot. The auditor sees what happens on the day of the audit; control breakdowns outside that window are invisible. Sufficient observation often includes multiple visits across the year, or observation paired with reperformance.

4. Inquiry

Inquiry is conversation with company staff, management, auditors, legal counsel, or internal specialists. It’s the most cost-effective evidence type but also the weakest in appropriateness.

Inquiry alone rarely supports a conclusion because:

• Management is biased in favor of the financial statements.
• Interviewees may lack knowledge or misremember.
• Responses are subjective and unverifiable without corroboration.

Inquiry is often used to:

• Understand processes and controls (opening questions).
• Corroborate or challenge other evidence (“We observed the count; did any items arrive after the count date?”).
• Test management’s awareness of known issues (“Are there any pending lawsuits we should accrue?”).

Appropriateness rises when inquiry is directed to independent parties (external legal counsel, board audit committee) rather than operational management.

5. Recalculation

The auditor recomputes amounts to verify accuracy: depreciation schedules, interest accruals, payroll tax withholdings, pension liabilities.

This evidence is:

• High in appropriateness for mathematical accuracy, provided the auditor uses the same input data and method as the client.
• Limited in scope: Recalculation verifies math but not whether the underlying assumptions (useful life, interest rate, payroll hours) are correct.

Example: The auditor recalculates depreciation on a building purchased for $1M with a 40-year useful life. The client computed $25K per year; the auditor verifies: $1M / 40 = $25K. Correct math. But the auditor has not tested whether the building’s useful life is truly 40 years or whether the purchase price is correct.

Sufficiency depends on the population. For a small number of depreciation schedules, testing all is often feasible. For thousands of transactions, sampling applies.

6. Inspection

The auditor examines physical assets or tangible evidence: property, equipment, securities, inventory, contracts stored on-site, or signed agreements.

High appropriateness for existence and ownership:

• Is the building really there? Inspecting it provides evidence.
• Does the company own the copyright or trademark? Examining the registration or agreement provides evidence.

Limited for valuation:

• The auditor can see equipment exists and appears operational, but cannot judge its market value from inspection alone.
• Condition assessment requires expertise; a physical inspection by the auditor is weaker evidence than a professional appraisal.

Sufficiency depends on the population and risk. For a small number of significant assets, inspection of all items may be feasible. For many minor assets, sampling or a mix with analytical procedures applies.

7. Analytical Procedures

The auditor compares relationships and trends within the financial statements and between current and prior periods.

Examples:

• Ratio analysis: The gross margin on sales is 40% this year; prior years ranged 38–42%. The 40% is consistent and reasonable.
• Trend analysis: Sales revenue increased 5% year-over-year; cost of goods sold increased 6%; the slight margin compression is explained by rising input costs.
• Expectation setting: The auditor predicts expected payroll based on headcount, wages, and benefits; the recorded payroll is within 2% of the expectation; evidence of accuracy.
• Reasonableness testing: The allowance for doubtful accounts is 2% of receivables; historical write-off rates were 1.8%; the increase is modest and explained by recent customer defaults.

Appropriateness is high for detecting anomalies and broad patterns but lower for pinpointing errors in individual transactions. A reasonable trend suggests no material misstatement; an unreasonable trend prompts investigation but doesn’t prove how much is wrong.

Sufficiency depends on the nature of the procedure. A simple reasonableness test is quick and can cover many items; a deeper investigation of an unexplained trend requires more time and often pairs with other evidence.

8. Reperformance

The auditor independently redoes a client control or calculation to test accuracy.

Examples:

• Reconciliation reperformance: The auditor re-reconciles the general ledger cash account to the bank statement, independently, without looking at the client’s reconciliation first.
• Journal entry reperformance: The auditor re-enters a significant manually recorded journal entry into the system to verify it was posted correctly.
• Payroll reperformance: The auditor recomputes payroll withholdings and net pay for selected employees, using the same payroll master data but verifying the formulas applied.

Appropriateness is high because the auditor is testing what was actually done, not what was claimed to be done. Reperformance often pairs with observation and documentation to create a strong chain of evidence.

Sufficiency requires testing enough items to reach a conclusion. For routine controls operating throughout the year, the auditor might test a sample (e.g., one week’s payroll processing per quarter). For complex, non-routine transactions, testing all or most items is often required.

Balancing Sufficiency and Appropriateness: A Framework

Auditors use a risk-based approach:

1. Identify the account or assertion being tested (e.g., Do accounts receivable exist? Is the allowance adequate?).
2. Assess inherent risk: Is the account inherently risky due to complexity, judgment, or fraud potential?
3. Assess control risk: Are there strong controls mitigating the risk?
4. Determine the required evidence quality: Higher risk requires higher-appropriateness evidence (e.g., confirmations, inspections, reperformance rather than inquiry alone).
5. Select evidence types: Mix multiple types to reinforce each other.
6. Determine quantity: Assess whether the sample size and population coverage are sufficient for the level of assurance needed.
7. Document and evaluate: Reconcile the evidence gathered against the audit objective; determine if sufficiency and appropriateness thresholds are met.

Example: The auditor is testing a $5M accounts receivable balance. The company has weak controls over credit approvals. Inherent and control risk are high. The auditor decides:

• Obtain confirmations from the largest 60% of customers (high appropriateness, third-party source).
• For the remaining 40%, inspect supporting invoices and shipping documentation.
• Perform aged receivables analysis to identify stale or unusual items.
• Recalculate the allowance for doubtful accounts using historical write-off rates.
• Inquire of management regarding any known uncollectible accounts.

This blend of evidence—confirmations, documentation, analytical procedures, recalculation, and inquiry—provides sufficient, high-quality assurance that receivables are fairly stated.

Common Evidence Deficiencies

Auditors must avoid:

• Insufficient evidence: Testing too small a sample or skipping accounts altogether.
• Low-appropriateness evidence: Relying on inquiry or client-generated documents without corroboration.
• Mismatched evidence: Using recalculation to test existence (recalculation tests accuracy, not existence).
• Unresolved contradictions: Multiple evidence types conflict; the auditor must investigate rather than dismiss.
• Biased evidence: Evidence from sources with incentives to misrepresent (e.g., a salesperson confirming an uncertain receivable).

See also