AUD, Auditing and Attestation

Sources for Sufficient Appropriate Evidence

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Sufficient Appropriate Evidence. The topic rests on AU-C 500.

About this topic

An auditor needs enough evidence, and it needs the right kind of evidence. Those are two separate tests, and this topic is built on keeping them apart.

The standard's words for the two tests are sufficient and appropriate.

Key points

• Audit evidence must be both sufficient (quantity) and appropriate (quality: relevance and reliability).
• External evidence is generally more reliable than internal evidence; documentation is more reliable than oral inquiry.
• The nature, timing, and extent of procedures are determined by the assessed risk of material misstatement.
• Analytical procedures are required in planning and overall review; they are optional as substantive procedures.

What the lessons cover

1. Relevance and the direction of testing
2. The assertions
3. Sufficiency and persuasiveness (AS 1105)
4. Reliability: the generalizations and how they rank
5. Information produced by the entity
6. The seven procedures for obtaining evidence
7. Selecting items for testing
8. Using the work of a management's specialist
9. Inconsistent evidence and doubts about reliability
10. Where AU-C 500 and AS 1105 diverge

Authoritative references

Where these requirements sit in the literature. Each entry names the standard, then breaks it out paragraph by paragraph.

• AU-C 500.05 carries the definitions, and it treats the two measures as interrelated:
  • Sufficiency is the measure of the quantity of audit evidence, and the quantity needed is affected by the assessed risk of material misstatement and by the quality obtained.
  • Appropriateness is the measure of quality, meaning the evidence's relevance and reliability.
• AU-C 500.07a and AU-C 500.A22 through .A24 carry appropriateness and the reliability generalizations, and evidence is more reliable on five counts:
  • when obtained from independent sources outside the entity;
  • when generated under effective internal control;
  • when obtained directly by the auditor rather than indirectly or by inference;
  • when in documentary form rather than oral; and
  • when original rather than a copy.
• AU-C 500 (cited here at standard level on purpose) governs information produced by the entity, and the same standard covers information from an external information source, whose relevance and reliability are evaluated including the nature and authority of the source. The evaluation of whether entity-produced information is sufficiently reliable runs in two halves:
  • Accuracy and completeness. Obtain evidence about both, or test the controls over the information.
  • Precision and detail. Evaluate whether the information is sufficiently precise and detailed for the auditor's purpose.
• AU-C 500 (again at standard level on purpose) governs inconsistency in, or doubts about the reliability of, audit evidence, and either trigger produces the same two-part response:
  • Resolve the matter. Determine what modifications to or additions to procedures are necessary.
  • Consider the effect. Weigh the effect, if any, on other aspects of the audit.
• AU-C 501.27 governs a management's specialist. The auditor retains sole responsibility and does not reference the specialist, and AU-C 620 governs an auditor's specialist and reaches the same no-reference conclusion. The paragraph itself sets three duties:
  • evaluate the specialist's competence, capabilities, and objectivity;
  • obtain an understanding of the specialist's work; and
  • evaluate whether that work is appropriate audit evidence for the relevant assertion.
• AU-C 315.A219 carries the assertions after SAS No. 145: two categories, six assertions each, each carrying related disclosures.
• AU-C 315.12 carries the definition of a relevant assertion, identified on inherent risk without regard to controls, and makes an item with one or more relevant assertions significant.
• AU-C 505 governs confirmations, strongest on existence because the population selected is the recorded balances.
• AU-C 330 requires substantive procedures for each relevant assertion of each material class of transactions, account balance, and disclosure irrespective of the assessed risks, so effective controls reduce extent and never eliminate it.
• AS 1105.02 through .06 define audit evidence as all the information used in arriving at the conclusions on which the opinion rests, including information that contradicts management's assertions, and carry sufficiency and appropriateness. Quantity turns on two inputs, and a limit closes the pair:
  • The risk of material misstatement. As it rises, the quantity of evidence rises, with ordinarily more evidence for significant risks.
  • The quality of the evidence. As quality rises, the need for additional corroborating evidence falls.
  • The limit. Obtaining more of the same type of evidence cannot compensate for its poor quality.
• AS 1105.07 makes relevance depend on the design of the procedure, and three things decide it:
  • whether the procedure tests the assertion or control directly, and whether it tests for understatement or overstatement;
  • the timing of the procedure; and
  • the level of disaggregation or detail needed.
• AS 1105.08 and .09 carry reliability.
  • An independent knowledgeable source ranks above internal sources.
  • Entity-produced and externally received electronic information is more reliable when the entity's controls over it, including IT general controls and automated application controls, are effective.
  • Direct receipt ranks above indirect receipt.
  • Originals rank above photocopies, facsimiles, and filmed, digitized, or otherwise converted documents.
  • A note requires evaluating the effect of any restrictions, limitations, or disclaimers a third party attaches.
  • Paragraph .09 adds that the auditor is not expected to be an expert in document authentication but responds with modified or additional procedures when conditions indicate a document may not be authentic or was modified without disclosure.
• AS 1105.10 and .10A carry information produced by the company and external information the company provides in electronic form.
  • Paragraph .10 requires testing the accuracy and completeness of the information or the controls over it, and evaluating whether it is sufficiently precise and detailed.
  • Paragraph .10A requires understanding the source and the company's receiving, maintaining, and processing steps, including modifications made before the information reached the auditor.
  • Then, still under .10A, either test for modification and evaluate its effect, or test the controls over that process.
• AS 1105.11 and .12 carry the financial statement assertions, and different assertions may be used if sufficient to identify the types of potential misstatements and respond to the risks in each significant account and disclosure. Paragraph .11 fixes five:
  • existence or occurrence;
  • completeness;
  • valuation or allocation;
  • rights and obligations; and
  • presentation and disclosure.
• AS 1105.13 through .21 classify procedures as risk assessment procedures or further audit procedures (tests of controls and substantive procedures, the latter including tests of details and substantive analytical procedures).
  • The purpose decides the classification, and a procedure used for more than one purpose must achieve each objective (.14).
  • Paragraphs .15 through .21 define the seven procedures.
  • Observation is limited to the point in time observed, and being observed may affect performance (.16).
  • A note to .17 states that inquiry of company personnel by itself does not provide sufficient evidence for a relevant assertion or for a conclusion about a control's effectiveness.
  • Confirmation is a direct written communication to the auditor (.18).
  • Recalculation is checking mathematical accuracy (.19).
  • Reperformance is the independent execution of procedures or controls originally performed by company personnel (.20).
• AS 1105.22 through .29 carry selecting items for testing and the inconsistency rule.
  • The three alternatives are selecting all items, selecting specific items, and audit sampling, and the selection must meet the objective of the procedure (.22).
  • Paragraph .24 gives three situations for a 100 percent examination.
  • Paragraph .25 defines specific items as all items with a specified characteristic, including key items and all items over a certain amount.
  • Paragraph .27 provides that applying procedures to specific items is not audit sampling and the results cannot be projected to the population.
  • Paragraph .28 defines audit sampling.
  • Paragraph .29 requires the auditor to perform the procedures necessary to resolve an inconsistency or a doubt about reliability and to determine the effect on other aspects of the audit.
• Appendix A to AS 1105 carries the company's specialist. It supplements the standard and does not reach specialized skill in income taxes or information technology, nor an attorney's information about litigation, claims, and assessments used under AS 2505 (.A1).
  • The auditor assesses the specialist's knowledge, skill, and ability (.A3).
  • The auditor assesses the specialist's relationship to the company (.A4).
  • The auditor evaluates the data, significant assumptions, and methods used and the work's relevance and reliability in relation to the relevant assertion (.A6).
  • The auditor tests the accuracy and completeness of company-produced data used by the specialist (.A8).
  • The auditor evaluates any restrictions or disclaimers attached to that work (.A9).
  • The auditor performs additional procedures when the findings appear to contradict the relevant assertion or the work is not sufficient appropriate evidence (.A10).

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary