Statement on Auditing Standards, Audit Evidence (Study Guide Part 1)

Statement on Auditing Standards, Audit Evidence Introduction Scope of This SAS 1. This Statement on Auditing Standards (SAS) explains what constitutes audit evidence in an audit of financial statements and sets out attributes of information that are taken into account by the auditor when evaluating information to be used as audit evidence. Taking these attributes into account assists the auditor in maintaining professional skepticism. (Ref: par. A1) The application of this SAS assists the auditor in fulfilling the auditor’s responsibilities in 2. other AU-C sections.* This SAS should be read in conjunction with other AU-C sections, including those that address the auditor’s responsibilities to identify and assess the risks of material misstatement,1 design and implement responses to the risks of material misstatement identified and assessed by the auditor,2 and form an opinion on the financial statements.3 In particular, AUC section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, requires the auditor to conclude whether sufficient appropriate audit evidence has been obtained and thereby provides a basis for the auditor’s opinion. (Ref: par. A2) 3. The auditor’s overall conclusion in accordance with AU-C section 330 about whether sufficient appropriate audit evidence has been obtained is a matter of professional judgment. Evaluating information to be used as audit evidence in accordance with this SAS assists the auditor in making that conclusion. The auditor’s evaluation of information to be used as audit evidence is not a formulaic exercise and is dependent on the degree to which the attributes of information to be used as audit evidence influence the auditor’s evaluation. (Ref: par. A33A4) Effective Date 4. This SAS is effective for audits of financial statements for periods ending on or after December 15, 2022. Objective 5. The objective of the auditor is to evaluate information to be used as audit evidence, including the results of audit procedures, to inform the auditor’s overall conclusion about whether sufficient appropriate audit evidence has been obtained. * All AU-C sections can be found in AICPA Professional Standards. See AU-C section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement. 1 2 AU-C section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained. 3 AU-C section 700, Forming an Opinion and Reporting on Financial Statements. Definitions 6. For purposes of generally accepted auditing standards (GAAS), the following terms have the meanings attributed as follows: Appropriateness (of audit evidence). The measure of the quality of audit evidence, that is, its relevance and reliability in providing support for the conclusions on which the auditor’s opinion is based. (Ref: par. A9) Audit evidence. Information used by the auditor in arriving at the conclusions on which the auditor’s opinion is based. Audit evidence is information to which audit procedures have been applied and consists of information that corroborates or contradicts assertions in the financial statements. (Ref: par. A53A10) External information source. An external individual or organization that provides information that is used by the entity in preparing the financial statements or that has been obtained by the auditor as audit evidence, when such information is suitable for use by a broad range of users. When information has been provided by an individual or organization acting in the capacity of management’s specialist, service organization, 4 or auditor’s specialist,5 the individual or organization is not considered an external information source with respect to that particular information. Sufficiency (of audit evidence). The measure of the quantity of audit evidence. The quantity of audit evidence necessary is affected by the auditor’s assessment of the risks of material misstatement and the quality of the audit evidence obtained (that is, its appropriateness). (Ref: par. A93A10) Requirements Evaluating Information to Be Used as Audit Evidence The auditor should evaluate information to be used as audit evidence by taking into account 7. (Ref: par. A11) a. the relevance and reliability of the information, including its source, and (Ref: par. A123A34) b. whether such information corroborates or contradicts assertions in the financial statements. (Ref: par. A353A38) 8. The auditor’s evaluation of the information to be used as audit evidence in accordance with paragraph 7 should include a. evaluating whether the information is sufficiently precise and detailed for the auditor’s 4 5 See AU-C section 402, Audit Considerations Relating to an Entity Using a Service Organization. See AU-C section 620, Using the Work of an Auditor’s Specialist. purposes and (Ref: par. A39) b. obtaining audit evidence about the accuracy and completeness of the information, as necessary (Ref: par. A403A42). Audit Procedures as a Basis for Concluding on the Sufficiency and Appropriateness of Audit Evidence 9. In evaluating information to be used as audit evidence, the auditor should consider whether the results of audit procedures provide a basis for concluding on the sufficiency and appropriateness of audit evidence obtained. (Ref: par. A433A64) Inconsistencies in, or Doubts About the Reliability of, Audit Evidence 10. The auditor should determine whether modifications or additions to audit procedures are necessary to resolve inconsistencies in, or doubts about the reliability of, audit evidence, including when a. audit evidence obtained from one source is inconsistent with that obtained from another source. b. the results of an audit procedure are inconsistent with the results of another audit procedure. (Ref: par. A653A66) *** Application and Other Explanatory Material Scope of This SAS (Ref: par. 133) A1. AU-C section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards, defines professional skepticism and professional judgment.6 AU-C section 200 and AU-C section 330 provide application material about maintaining professional skepticism and exercising professional judgment.7 The auditor’s evaluation of information to be used as audit evidence in accordance with this SAS involves maintaining professional skepticism, including the consideration of whether unconscious or conscious auditor biases may affect the auditor’s professional judgments.8 Paragraphs A17, A30, A31, A37, A38, A60, and A63 of this SAS are examples of paragraphs that describe ways in which the auditor can maintain professional skepticism. 6 Paragraph .14 of AU-C section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards. 7 8 Paragraphs .A223.A31 of AU-C section 200. See paragraph .A27 of AU-C section 200. A2. Paragraph 2 states that this SAS should be read in conjunction with other AU-C sections. For example, the objective of AU-C section 330 is for the auditor to obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement through designing and implementing appropriate responses to those risks.9 AU-C section 330 also states that the auditor is required to do the following: • Design and perform further audit procedures whose nature, timing, and extent are based on, and are responsive to, the assessed risks of material misstatement at the relevant assertion level.10 • Obtain more persuasive audit evidence the higher the auditor’s assessment of risk.11 • Conclude whether sufficient appropriate audit evidence has been obtained.12 • Attempt to obtain further audit evidence if the auditor has not obtained sufficient appropriate audit evidence about a relevant assertion.13 In addition, AU-C section 700, Forming an Opinion and Reporting on Financial Statements, requires the auditor to conclude whether reasonable assurance has been obtained about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. The conclusions required by AU-C section 700 take into account, among other things, whether sufficient appropriate audit evidence has been obtained in accordance with AU-C section 330.14 A3. Audit evidence is cumulative in nature and is obtained through the performance of one or more audit procedures on information obtained during the course of the audit. The auditor’s evaluation of information to be used as audit evidence may be enhanced by the use of automated tools and techniques, which may enable the auditor to aggregate or disaggregate information or consider information obtained from multiple sources. For example, the auditor may use automated tools and techniques for the purpose of A4. planning or performing the audit, such as audit data analytics. Data analytics is described as the analysis of patterns, identification of anomalies, or extraction of other useful information in data underlying or related to the subject matter of an audit through analysis, modeling, or visualization. Examples of other automated tools and techniques are artificial intelligence, machine learning, remote observation tools, and robotic process automation. Definitions (Ref: par. 6) 9 10 11 12 13 14 Paragraph .03 of AU-C section 330. Paragraph .06 of AU-C section 330. Paragraph .07b of AU-C section 330. Paragraph .28 of AU-C section 330. Paragraph .29 of AU-C section 330. Paragraph .13a of AU-C section 700. Audit Evidence A5. Audit evidence is information to which audit procedures have been applied, ordinarily during the course of the current-year audit. Information to be used as audit evidence may also be obtained by the auditor as part of designing and performing risk assessment procedures in accordance with AU-C section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, including from a. the auditor’s previous experience with the entity and audit procedures performed in previous audits, when the auditor has evaluated whether such information remains relevant and reliable as audit evidence for the current audit, b. the auditor’s procedures regarding acceptance or continuance of the client relationship or the audit engagement, and c. when applicable, other engagements performed by the engagement partner for the entity. A6. The nature of the audit procedures that the auditor performs to use information as audit evidence may depend on the source of the information and range from simple to extensive audit procedures. For example, when using information from an external information source, obtaining the information may be relatively straightforward, and the auditor’s procedures to evaluate that information would be largely focused on the relevance and reliability of the information, including its source, in accordance with this SAS. On the other hand, audit procedures to obtain evidence about the accuracy and completeness of the information, such as tests of controls, may be necessary when the auditor intends to use information generated internally from the entity’s general and subsidiary ledgers as audit evidence. A7. In some cases, the absence of information is used by the auditor and, therefore, also constitutes audit evidence.15 For example, when considering information regarding management’s assertions related to the entity’s recorded warranty provision, the absence of sales returns of the product in question may be audit evidence supporting management’s assertion about the completeness of the warranty provision. Sufficient Appropriate Audit Evidence A8. As explained in AU-C section 200, reasonable assurance is obtained when the auditor has obtained sufficient appropriate audit evidence to reduce audit risk (that is, the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated) to an acceptably low level.16 A9. As explained in AU-C section 200, the sufficiency and appropriateness of audit evidence are interrelated.17 Together they affect the persuasiveness of audit evidence. The auditor’s 15 16 17 Paragraph .A32 of AU-C section 200. Paragraph .06 of AU-C section 200. Paragraph .A33 of AU-C section 200. conclusion about whether sufficient appropriate audit evidence has been obtained in accordance with AU-C section 330 is both at the financial statement level as well as the relevant assertion level. AU-C section 330 requires the auditor to obtain more persuasive audit evidence the higher the assessment of risk.18 For example, ordinarily, more persuasive audit evidence is needed to respond to significant risks. Persuasiveness, therefore, relates to the auditor obtaining appropriate audit evidence that is sufficient for the auditor to draw reasonable conclusions. A10. The quantity of audit evidence, in and of itself, is not solely determinative of its persuasiveness. For example, obtaining more of the same type of audit evidence may not compensate for its lack of appropriateness. However, as the quality of audit evidence increases, the need for additional corroborating audit evidence decreases. Depending on the auditor’s consideration of relevance and reliability, information obtained from a single source may provide persuasive audit evidence. Evaluating Information to Be Used as Audit Evidence (Ref: par. 738) A11. Information to be used as audit evidence may take different forms, which influences the nature of audit procedures that may be necessary to obtain or evaluate the information. Different forms of information, individually or in combination, include • oral information obtained through a verbal response to an inquiry of management or external information sources (for example, oral inquiries made during the course of the audit). • visual information obtained through observation (for example, a message that appears onscreen for a control restricting access to an IT) system or observed by the auditor using remote observation tools). • paper documents, which are obtained in documentary form (for example, an original executed sales contract or a written confirmation). • electronic information, which includes 4 documents obtained in electronic documentary form (for example, a scanned version of an executed sales contract or an electronic confirmation). 4 data stored in the entity’s IT system or obtained electronically from an external information source. Such data may be manually input into the system or may be electronically generated (for example, an electronic data interface between the entity and a service organization). Relevance and Reliability of the Information, Including Its Source (Ref: par. 7a) 18 See paragraph .07b of AU-C section 330. Sources of Information to Be Used as Audit Evidence A12. The source of the information to be used as audit evidence often affects the consideration of its relevance and reliability. Information to be used as audit evidence may be obtained directly or derived individually or in combination from different sources, including the following: a. Management. Management may provide the auditor with information obtained from the financial reporting process used to prepare the financial statements, including disclosures (for example, the entity’s accounting records) as well as information obtained from outside of the general and subsidiary ledgers (for example, from the entity’s risk management system or sales functions). This information may be stored by the entity within its IT systems or in a remote server. Management may also employ or engage a specialist who may provide information to be used as audit evidence.19 b. External information sources and other external parties. Management or the auditor may use information obtained from external information sources and other external parties (for example, information used as inputs to forecasts or models used to prepare accounting estimates or accumulated by an auditor to analyze industry trends). The auditor may obtain external confirmations or make inquiries of external parties to corroborate management’s assertions. See appendix A,