Lesson 3A Audit Evidence
Obtaining evidence
Audit procedures are designed to obtain evidence about the financial statement assertions.
FINANCIAL STATEMENT ASSERTIONS are the representations by management, explicit or otherwise,
that are embodied in the financial statements, as used by the auditor to consider the different types
of potential misstatements that may occur.
SSA 315.25
The auditor shall identify and assess the risks of material misstatement at:
1. The financial statement level; and
2. The assertion level for classes of transactions, account balances, and disclosures. To provide
a basis for designing and performing further audit procedures.
Assertions used by the auditor
Assertions about classes of transactions and events, and related disclosures
1. Occurrence: transactions and events that have been recorded have occurred and pertain to
the entity.
2. Completeness: all transactions and events that should have been recorded have been
recorded.
3. Accuracy: amounts and other data relating to recorded transactions and events have been
recorded appropriately.
4. Cut-off: transactions and events have been recorded in the correct accounting period.
5. Classification: transactions and events have been recorded in the proper accounts.
6. Presentation: transactions and events are appropriately aggregated or disaggregated and
clearly described, and related disclosures are relevant and understandable in the context of
the requirements of the applicable financial reporting framework.
Assertions about account balances, and related disclosures at the period-end
1. Existence: assets, liabilities and equity interests exist.
2. Rights and obligations: the entity holds or controls the rights to assets, and liabilities are the
obligations of the entity.
3. Completeness: all assets, liabilities and equity interests that should have been recorded have
been recorded and all related disclosures that should have been included in the financial
statements have been included.
4. Accuracy valuation and allocation: assets, liabilities, and equity interests have been included
in the financial statements at appropriate amounts and any resulting valuation or allocation
adjustments have been appropriately recorded, and related disclosures have been
appropriately measured and described.
5. Classification: assets, liabilities and equity interests have been recorded in the proper
accounts.
6. Presentation: transactions and events are appropriately aggregated or disaggregated and
clearly described, and related disclosures are relevant and understandable in the context of
the requirements of the applicable financial reporting framework.
1
SSA 500 Audit Evidence outlines the objective of the auditor and procedures used by auditors to obtain
evidence.
SSA 500.4
The objective of the auditor is to design and perform audit procedures in such a way as to enable the
auditor to obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on
which to base the auditor's opinion.
Sufficient and appropriate audit evidence
In essence, auditors need to obtain sufficient reliable audit evidence to support the audit opinion. The
audit partner will make the ultimate assessment of audit efficiency and quality based on their
professional judgment.
When assessing the sufficiency and appropriateness of audit evidence, auditors must consider the
following.
1. The risk of misstatement related to the assertion.
2. Generally speaking, the higher the risk of misstatement, the greater the efficiency of audit
evidence that is required for that assertion. In order to conduct the audit efficiently, the
auditor has to balance the need to reach a balance between obtaining sufficient audit
evidence and performing more work.
3. Source and nature of evidence. Third party independent evidence is more reliable than
internally generated evidence. Similarly, original evidence sources (eg documents) are more
reliable than duplicates. Physical evidence is more reliable than verbal responses to audit
enquiries, and evidence is more reliable when obtained directly by the auditor rather than
from an indirect source.
4. Contradictory or corroborative evidence. Contradictory evidence reduces the reliability of all
related sources; while corroborative evidence has a strengthening effect.
Testing
An effective audit test provides appropriate audit evidence that will be sufficient for the auditor's
purposes. In selecting items for testing, the auditor is required to determine the sufficiency of
information to be used as audit evidence (in addition to relevance and reliability). The means available
to the auditor for selecting items for testing are:
1. Selecting all items (100% examination)
2. Selecting specific items
3. Audit sampling
SSA 530 Audit Sampling is based on the premise that auditors do not normally examine all the
information available to them, as it would be impractical to do so and using audit sampling will
produce valid conclusions.
AUDIT SAMPLING involves the application of audit procedures to less than 100% of the items within a
population of audit relevance such that all sampling units have a chance of selection in order to
provide the auditor with a reasonable basis on which to draw conclusions about the entire population.
STATISTICAL SAMPLING is any approach to sampling that involves random selection of a sample, and
use of probability theory to evaluate sample results, including measurement of sampling risk.
Some testing procedures do not involve sampling, such as:
2
• Testing 100% of items in a population
• Testing all items with a certain characteristic (for example, over a certain value) as the
selection is not representative
The SSA distinguishes between statistically based sampling, which involves the use of random
selection techniques from which mathematically constructed conclusions about the population can
be drawn, and non-statistical methods, from which auditors draw a judgmental opinion about the
population. However, the principles of the SSA apply to both methods.
If they are unable to obtain sufficient appropriate audit evidence, the auditors should consider the
implications for their report.
External confirmations
The reliability of audit evidence is affected by its source. Audit evidence is more reliable when it is
obtained from independent sources outside the entity.
Both SSA 330 The Auditor's Responses to Assessed Risks and SSA 505 External Confirmations address
the need for external confirmations in gathering sufficient and appropriate audit evidence.
SSA 330.19
The auditor shall consider whether external confirmation procedures are to be performed as
substantive audit procedures.
External confirmation procedures frequently are relevant when addressing assertions associated with
account balances and their elements, but need not be restricted to these items. External confirmation
procedures also may be performed to obtain audit evidence about the absence of certain conditions.
The auditor shall maintain control over external confirmation requests. So to take the example of a
receivables circularisation, it is the auditor who should be in control of sending and receiving the
requests and the responses from customers.
If management refuses to allow the auditor to send an external confirmation request, the auditor
must consider whether this is reasonable and whether audit evidence can be obtained in another way.
If evidence cannot be obtained from another source, the auditor should communicate this to those
charged with governance, and consider the impact on the auditor's report (there is a possibility that
the auditor's opinion will have to be modified (qualified) on the basis of an inability to obtain sufficient
appropriate audit evidence, or that a disclaimer of opinion will be issued).
3
Substantive analytical procedures
Role of analytical procedures
Analytical procedures are widely used as a substantive procedure and can be much more cost effective
than carrying out high volumes of tests of details.
SSA 520.5
When designing and performing substantive analytical procedures, either alone or in combination
with tests of details, as substantive procedures in accordance with SSA 330, the auditor shall:
1. Determine the suitability of particular substantive analytical procedures for given assertions,
taking account of the assessed risks of material misstatement and tests of details, if any, for
these assertions;
2. Evaluate the reliability of data from which the auditor's expectation of recorded amounts or
ratios is developed, taking account of source, comparability, and nature and relevance of
information available, and controls over preparation;
3. Develop an expectation of recorded amounts or ratios and evaluate whether the expectation
is sufficiently precise to identify a misstatement that, individually or when aggregated with
other misstatements, may cause the financial statements to be materially misstated; and
4. Determine the amount of any difference of recorded amounts from expected values that is
acceptable without further investigation.
Suitability of using analytical procedures
If the auditor has determined that an assessed risk of material misstatement at the assertion level is
a significant risk, the auditor shall perform substantive procedures that are specifically responsive to
that risk. When the approach to a significant risk consists only of substantive procedures, those
procedures shall include tests of details.
4
Related parties
Importance of related parties
The nature of related party relationships and transactions may, in some circumstances, give rise to
higher risks of material misstatement of the financial statements than transactions with unrelated
parties. For example:
1. Related parties may operate through an extensive and complex range of relationships and
structures, with a corresponding increase in the complexity of related party transactions.
2. Information systems may be ineffective at identifying or summarising transactions and
outstanding balances between an entity and its related parties.
3. Related party transactions may not be conducted under normal market terms and conditions;
for example, some related party transactions may be conducted with no exchange of
consideration.
In addition, fraud may be more easily committed through related parties. Companies not
trading at arm's length have been central to a number of government investigations in various
countries. Such transactions were made possible by a degree of control or influence exercised
by directors over both parties to the transactions. SSA 550 Related Parties covers this area.
KEY MANAGEMENT PERSONNEL are persons having authority and responsibility for planning, directing
and controlling the activities of the entity, directly or indirectly, including any director (whether
executive or otherwise) of that entity.
Management is responsible for the identification of related party transactions. Such transactions
should be properly approved as they are frequently not at arm's length. Management is also
responsible for the disclosure of related party transactions.
Assessment and identification of risks
As part of the risk assessment procedures required by SSA 315, the auditor must carry out the
following procedures to obtain information relevant to identifying risks associated with related parties.
1. Audit team discussion of risk shall include specific consideration of susceptibility of financial
statements to material misstatement through related parties and their transactions
2. Auditor shall inquire of management:
a. The identity of related parties including changes from prior period
b. The nature of the relationships between the entity and its related parties
c. Whether any transactions occurred between the parties, and if so, what
d. What controls the entity has to identify, account for and disclose related party
relationships and transactions
e. What controls the entity has to authorise and approve significant transactions and
arrangements with related parties
f. What controls the entity has to authorise and approve significant transactions and
arrangements outside the normal course of business
3. Remain alert for evidence of related party transactions when obtaining other audit evidence,
in particular, when scrutinising bank and legal confirmations and minutes of meetings
4. If significant transactions outside the normal course of business are discovered, inquire of
management the nature of the transactions and whether related parties could be involved
5
5. Share information obtained about related parties with the audit team
If risks relating to related parties and their transactions are identified, they should be treated as
significant risks in accordance with SSA 315. Also, due to the close connection between related parties
and possible fraud, the auditor must consider the overlap with SSA 240 here as well.
Written representations
SSA 550.26
Where the applicable financial reporting framework establishes related party requirements, the
auditor shall obtain written representations from management, and where relevant, those charged
with governance, that they have disclosed to the auditor the identity of the entity's related parties
and all the related party relationships and transactions of which they are aware, and they have
appropriately accounted for and disclosed such relationships and transactions in accordance with the
requirements of the framework.
Audit conclusions and reporting
If the auditor is unable to obtain sufficient appropriate audit evidence concerning related parties and
transactions with such parties or concludes that their disclosure in the financial statements is not
adequate, the auditor should modify the auditor's report appropriately.
Unless all of those charged with governance are involved in managing the entity, the auditor shall
communicate with those charged with governance significant matters arising during the audit in
connection with the entity's related parties.
Loans to directors and to persons connected with the directors
A key related party transaction you should be familiar with is a loan to directors. A company (other
than an exempt private company) shall not make a loan, or quasi-loan, or enter into any guarantee or
credit transaction, or provide any security in connection with a loan, quasi-loan or credit transaction
made to a director of a company, directors of related companies, to persons connected with directors
of the company, and spouses and children (including adopted children and stepchildren) of directors.
Companies (other than exempt private companies) are prohibited from making loans to another
company or to enter into any guarantee or provide any security in connection with a loan, if a director
or directors of the first-mentioned company is or together are interested in 20% or more of the total
number of equity shares in the other company.
Enquiry of company procedures
Auditors should enquire as to the company's procedures for ensuring that all disclosable transactions
are properly identified and recorded.
Finally, auditors should consider obtaining written representations from each director giving
confirmation of any disclosable transaction which relates to himself and any persons connected with
them.
6
Written representations
SSA 580.6
The objectives of the auditor are:
1. To obtain written representations from management and, where appropriate, those charged
with governance that they believe that they have fulfilled their responsibility for the
preparation of the financial statements and for the completeness of the information provided
to the auditor;
2. To support other audit evidence relevant to the financial statements or specific assertions in
the financial statements by means of written representations if determined necessary by the
auditor or required by other SSAs; and
3. To respond appropriately to written representations provided by management and, where
appropriate, those charged with governance, or if management or, where appropriate, those
charged with governance do not provide the written representations requested by the auditor.
Written representations should be requested from management or directors with appropriate
responsibilities for the financial statements and knowledge of the matters concerned.
As written representations do not form sufficient audit appropriate evidence on their own, when the
auditors receive such representations they should:
1. Seek corroborative audit evidence from sources inside or outside the entity
2. Evaluate whether the representations made by management appear reasonable and are
consistent with other audit evidence obtained, including other representations
3. Consider whether the individuals making the representations can be expected to be well-
informed on the particular matters
Written representations cannot be used as a substitute for evidence which the auditors should have
been able to obtain independently.
Requested written representations not provided
If requested representations are not provided, the auditor must:
1. Discuss the matter with management.
2. Re-evaluate the integrity of management and the effect that this may have on other
representations and audit evidence in general.
3. Take appropriate actions, including determining the possible effect on the auditor's report per
SSA 705, ie a limitation on the scope of the audit work.
Form, timing and documentation of representations by management
The date of the letter should be as near as practicable to the date the auditor's report is signed, but
not after it. In practice, the date of the letter will invariably coincide with the date on which the
financial statements are authorised for issue as well as the date of the auditor's report. If the letter is
received significantly before the date of the audit report, the auditor should request an updated letter.
7
Reliance on the work of an expert
Professional audit staff are highly trained and educated, but their experience and training is limited to
accountancy and audit matters. In certain situations it will therefore be necessary to employ someone
else with different expert knowledge to gain sufficient, appropriate audit evidence.
Auditors have sole responsibility for their opinion, but may use the work of an expert in order to obtain
sufficient audit evidence regarding certain financial statement assertions.
SSA 620 Using the Work of an Auditor's Expert distinguishes between the 'auditor's expert' and
'management's expert'. The latter is used by the entity in the form of assistance in the preparation of
financial statements and is dealt with in SSA 500.
Determining the need to use the work of an auditor's expert
SSA 620.3
… if the auditor using the work of an auditor's expert … concludes that the work of that expert is
adequate for the auditor's purposes the auditor may accept that expert's findings or conclusions in
the expert's field as appropriate audit evidence.
When deciding whether to use an auditor's expert, the auditors should consider:
1. Whether management has used a management's expert in preparing the financial statements
2. The nature and significance of the matter, including its complexity
3. The risks of material misstatement in the matter
4. The expected nature of procedures to respond to identified risks, including the auditor's
knowledge of and experience with the work of experts in relation to such matters
5. The availability of alternative sources of audit evidence
Competence, capabilities and objectivity of the auditor's expert
SSA 620.9
The auditor shall evaluate whether the auditor's expert has the necessary competence, capabilities
and objectivity for the auditor's purposes. In the case of an auditor's external expert, the evaluation
of objectivity shall include inquiry regarding interests and relationships that may create a threat to
that expert's objectivity.
The scope of work of the auditor's expert
SSA 620.11
The auditor shall agree, in writing when appropriate, on … the nature, scope and objectives of that
expert's work.
Assessing the work of the auditor's expert
SSA 620.12
The auditor shall evaluate the adequacy of the auditor's expert's work for the auditor's purposes
including
… the relevance and reasonableness of that expert's findings or conclusions.
8
Reference to an auditor's expert in the auditor's report
SSA 620.14
The auditor shall not refer to the work of an auditor's expert in an auditor's report containing an
unmodified opinion unless required by law or regulation to do so.
Such a reference may be misunderstood and interpreted as a modification of the audit opinion, or as
a division of responsibility, neither of which is appropriate.
If the auditor makes reference to the work of an auditor's expert in the auditor's report because such
reference is relevant to an understanding of a modification to the auditor's opinion, the auditor shall
indicate in the auditor's report that such reference does not reduce the auditor's responsibility for
that opinion. In such circumstances, the auditor may need the permission of the auditor's expert
before making such a reference.
Use of the work of a management's expert
The issues which the auditor needs to consider are very similar to those in respect of the auditors'
expert.
SSA 500.8
If information to be used as audit evidence has been prepared using the work of a management's
expert, the auditor shall, to the extent necessary, having regard to the significance of that expert's
work for the auditor's purposes:
1. Evaluate the competence, capabilities and objectivity of that expert;
2. Obtain an understanding of the work of that expert;
3. Evaluate the appropriateness of that expert's work as audit evidence for the relevant
assertions.
9
Documentation
SSA 230.8
The auditor shall prepare audit documentation that is sufficient to enable an experienced auditor,
having no previous connection with the audit, to understand:
1. The nature, timing and extent of the audit procedures performed to comply with the SSAs and
applicable legal and regulatory requirements.
2. The results of the audit procedures performed, and the audit evidence obtained.
3. Significant matters arising during the audit, the conclusions reached thereon, and significant
professional judgments made in reaching those conclusions.
The key reason for having audit papers therefore is that they provide evidence of work done. They
may be required in the event of litigation arising over the audit work and opinion given.
Review of audit working papers
Work performed by each auditor should be reviewed by a more experienced team member to
consider whether:
1. The work has been performed in accordance with professional standards and applicable legal
and regulatory requirements
2. Significant matters have been raised for further consideration
3. Appropriate consultations have taken place and the resulting conclusions have been
documented and implemented
4. There is a need to revise the nature, timing and extent of work performed
5. The work performed supports the conclusions reached and is appropriately documented
6. The evidence obtained is sufficient and appropriate to support the auditor's report
7. The objectives of the engagement procedures have been achieved.
The following should be reviewed on a timely basis by the engagement partner:
1. Critical areas of judgment, especially those relating to difficult or contentious matters
identified during the course of the engagement
2. Significant risks
3. Other areas the engagement partner considers important
The engagement partner need not review all audit documentation, but may do so. However, the
partner documents the extent and timing of the reviews.
10
SSA 540 Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related
Disclosures
SSA 540's requirements are as follows:
The auditor shall obtain an understanding of the following in order to provide a basis for the
identification and assessment of the risks of material misstatement for accounting estimates:
– The requirements of the applicable financial reporting framework.
– The means by which the management identifies transactions, events and conditions that may give
rise to the accounting estimate to be recognised or disclosed in the financial statements.
– How management makes the accounting estimate and an understanding of the data on which they
are based.
The auditor shall evaluate the degree of estimation uncertainty associated with the accounting
estimate and assess whether this gives rise to significant risks.
Based on the assessed risks the auditor will determine whether the financial reporting framework has
been properly applied and whether methods for making estimates are appropriate and have been
applied consistently.
The auditor will also:
– Determine whether events occurring up to the date of the auditor's report provide evidence
regarding the accounting estimate
– Test how management made the accounting estimate
– Test the operating effectiveness of controls together with appropriate substantive procedures
– Develop a point estimate or a range to evaluate the management's point estimate
For accounting estimates which give rise to significant risks, the auditor should also evaluate the
following:
– How management has considered alternative assumptions or outcomes
– Whether the significant assumptions used are reasonable
– Management intent to carry out specific courses of action and its ability to do so, where these affect
the accounting estimate
– Management's decision to recognise, or to not recognise the accounting estimate
– The selected measurement basis
The auditor shall obtain sufficient appropriate audit evidence about whether the disclosures in the
financial statements related to accounting estimates are in accordance with the requirements of the
applicable financial reporting framework. For accounting estimates that give rise to significant risks,
the auditor shall also evaluate the adequacy of the disclosure of their estimation uncertainty in the
financial statements in the context of the applicable financial reporting framework.
The possibility of management bias must be considered by the auditor.
11
SSA 510 Initial Audit Engagements – Opening Balances
When the financial statements for the prior period were not audited
When the financial statements for the prior period were audited by a predecessor auditor
The auditor shall obtain sufficient appropriate audit evidence about whether the opening balances
contain misstatements that materially affect the current period's financial statements by:
(a) Determining whether the prior period's closing balances have been correctly brought forward to
the current period or, when appropriate, have been restated;
(b) Determining whether the opening balances reflect the application of appropriate accounting
policies; and
(c) Performing one or more of the following:
(i) Where the prior year financial statements were audited, reviewing the predecessor auditor's
working papers to obtain evidence regarding the opening balances;
(ii) Evaluating whether audit procedures performed in the current period provide evidence relevant
to the opening balances; or
(iii) Performing specific audit procedures to obtain evidence regarding the opening balances.
12