State of the Art Audit Evidence Presented by David B. Crawford, CIA, CCSA, CPA Justina A. Crawford, MA, BME JDEnterprises crawfordjd@earthlink.net

Definition of Evidence Any information used by the auditor to determine whether the information being audited is stated in accordance with the established criteria. Why Audit Evidence: Support for Elements of Audit Findings Criteria Condition Cause Effect Recommendation

Characteristics of Evidence Use Nature Evaluator Certainty of conclusions derived Nature of conclusions Consequences of incorrect conclusions

Audit Evidence Decisions What type of evidence What audit procedure to use When to perform the procedure How much evidence What sample size to select for the procedure What items to select from the population

Audit Procedure & Audit Program AUDIT PROCEDURE is a detailed set of instructions for the collection of a type of audit evidence that is to be obtained at some time during the audit AUDIT PROGRAM is list of audit procedures for an audit

Evidence Standards IIA Standard 2310 Identifying Information Internal auditors should identify sufficient, reliable, relevant, and useful information to achieve the engagement objectives. GAAS Third Standard of Field Work Sufficient, competent evidential matter is to be obtained…..to afford a reasonable basis for an opinion…..

IIA Standards: Evidence Terms (Practice Advisory 2310-1: Identifying Information) Sufficient – factual, adequate, convincing so that a prudent, informed person would reach same conclusion Competent – reliable and best attainable through use of appropriate …techniques Relevant – …is consistent with the objectives of the engagement Useful – helps the organization meet its goals

Competence (Reliability) of Information The degree to which evidence is considered believable or worthy of trust Established solely by the audit procedure selected Cannot be improved by increasing sample size or selecting different items in sample Can only be improved by selecting an audit procedure with higher quality of one or more of seven characteristics of competence

Seven Characteristics of Competence of Information Relevance Independence of provider Effectiveness of auditee’s internal controls Auditor’s direct knowledge Qualifications of person providing the info Degree of Objectivity Timeliness

Sufficiency of Evidence Quantity of evidence determines sufficiency Determined usually by size and composition of the sample (items selected for testing) Appropriate sample size usually determined by Expectations of error or misstatement Effectiveness of internal controls

Cost of Evidence Types of Evidence Auditor’s goal is to obtain a sufficient amount of competent evidence at the lowest possible total cost (usually equates to direct audit hours) Types of Evidence Inquiries of client Reperformance Observation Physical examination Confirmation Documentation Analytical procedures

Relationship Between Standards, Types of Evidence, and Audit Procedures Standards - broad guidelines for the accumulation and documentation of evidence Types of evidence – broad categories of evidence available to auditors to satisfy standards Audit Procedures –specific instructions for accumulating a type of evidence to meet audit objectives

Physical Examination Pros & Cons The inspection or count by the auditor of a tangible asset To be a tangible asset the item examined must have inherent value; inventory item, cash, fixed asset, etc. Pros & Cons Pros Direct evidence of existence Highly reliable Cons Not sufficient to establish ownership Not sufficient to establish value

Types of Confirmations The receipt of written or oral response from an independent third party verifying the accuracy of information that was requested by the auditor Use of confirmations depends upon Reliability needs to meet audit objective Availability of alternate evidence Types of Confirmations Positive Blank Information included Negative

Documentation The examination of client documents and records to substantiate the information that is being audited Usually the most available type of evidence May be the only type of evidence that can reasonably be obtained by the auditor Two types – Internal or External

Reliability of Documentation External Internal Good internal control Poor internal control

Analytical Procedures Use comparisons and relationships to determine whether data appears reasonable Uses include Planning and final working paper review stages of an audit Understand the auditee’s operations Indicate the presence of errors or fraud Reduce detailed audit tests

Use of Analytical Procedures during Fieldwork (Practice Advisory 2320-1: Analysis & Evaluation) Factors to consider Significance of area being examined Adequacy of internal control Availability and reliability of information Precision with which results of analytical procedures can be predicted Availability and comparability of like external information Other procedures that already provide support for objectives

Inquiry Obtaining of written or oral information from the client in response to questions from the auditor Generally, must be corroborated through the application of other audit procedures

Reperformance Rechecking of computations, such as extensions and footings Rechecking of transfers of information, such as movement of a transaction through the information system (manual or electronic) the accumulation of information in a bank reconciliation

Observation Use of sight to assess activities Usually must be supported by corroborating evidence obtained through another audit procedure

Competence of Types of Evidence Depends upon the design and effectiveness of internal controls A single type of evidence is rarely sufficient by itself There is usually a correlation between the level of competence of evidence and its costs to produce

Cost of Evidence Expensive Moderately expensive Less expensive Physical examination Confirmation Documentation Moderately expensive Analytical procedures Reperformance (manual) Less expensive Inquiries of client Observations Reperformance (CAAT)

Documentation Evidence Gathering Techniques Read – examination of written info to determine facts pertinent to audit Examine - reasonably detailed study of document or record to determine specific facts about it Trace – to follow the movement of a document & its info from origination to recording Compare – make a comparison of info in two different places Vouch – to validate a recorded transaction or amount by examining the originating document or record

Analytical Procedures Evidence Gathering Techniques Scan – A less detailed examination of a document or record to determine whether there is anything unusual warranting further attention Compute – A calculation done by the auditor independent of the client

Reperformance Evidence Gathering Techniques Recompute – a calculation done by the auditor to determine if the client’s calculation is correct Foot and Cross foot – addition of columns and rows of numbers to determine that totals are the same as the client’s

Physical Examination Evidence & Observation Evidence Gathering Techniques Count – a determination by the auditor of the quantity of assets on hand at a given time. Only associated with Physical Examination type of evidence Observe – visually monitoring an activity by the auditor to obtain info. Only associated with Observation type of evidence

Inquiries of Clients Evidence Gathering Techniques Inquiry – a written or verbal question of the client about information pertinent to the audit

Special Considerations for Electronic Evidence Risk Areas Authentication Integrity Authorization Nonrepudiation Audit Approach Test of Controls Combined Test of Controls and Substantive Tests

Test of I/S Controls General Controls Application Controls Security Segregation of incompatible functions Lifecycle controls Application Controls Access controls Audit trails Retention Security Archiving Encryption Electronic signatures & digital certificates Management and audit trails

Type of Evidence Matrix 31

SUMMARY Characteristics Types Reliability versus Cost Electronic Transactions

Working Papers: Audit Documentation IIA Standard 2330: Recording Information Internal auditors should record relevant information to support the conclusions and engagement results.

Working Papers Definition The record kept by the auditor of the planning done, procedures applied, the test performed, the information obtained, the analysis made, the conclusions reached, the supervision performed, and the observations made and reported in the engagement.

Uses of Working Papers IIA Practice Advisory 2330-1 Recording Information Provide support for engagement report Aid in planning, performance, and review of the engagement work Document that the engagement objectives are achieved Aid in the professional development of the internal auditing staff

Uses of Working Papers (cont’d) Demonstrate compliance with the Standards for the Professional Practice of Internal Auditing Facilitate third-party review Provide basis for evaluating quality assurance program Provide support when reports are challenged

Examples of Working Papers Planning working papers Fieldwork working papers Report working papers Review working papers

Planning Working Papers Organization data Control questionnaires Flowcharts Risk assessment results Important documents Policies and Procedures Planning Memorandum Audit Program

Fieldwork Working Papers Lead schedules Abstracts Notes Supporting schedules Copies of documents Memos

Reporting Working Papers Summary of Potential Report Items Draft Report Memos Client action plan Final Report Distribution list

Review Working Papers Manager review checklist Quality Assurance review checklist Director Sign-off sheet

Working Paper Characteristics ID of the engagement Purpose of working paper Content of working paper Source of content Preparer initials and date First level reviewer initials and date Conclusion Index or reference number Appropriate cross-referencing Audit verification symbols (tick marks)

Working Paper Presentation Detailed schedule Abstract Memo Copies of client documents Interview notes Externally received documents

Helpful Websites www.utsystem.edu/AUD www.theiia.org www.gain2.org