AUD, Auditing and Attestation

Sources for Use of Data and Information

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Use of Data and Information. The topic rests on AU-C 500.

About this topic

An audit opinion has to rest on something. This topic covers the raw material it rests on: where the auditor gets its information, and when that information can be trusted.

Audit evidence is the information the auditor uses to reach its conclusions. Two questions govern every piece of it. Is it relevant to the assertion being tested? Is it reliable?

Key points

• Audit data analytics can serve as risk assessment procedures, tests of controls, or substantive procedures.
• The auditor must evaluate the relevance and reliability of data used as audit evidence, whether from the entity or external sources.
• Vouching tests existence (recorded to support); tracing tests completeness (source to records).
• Computer-assisted audit techniques (CAATs) include test data, parallel simulation, and embedded audit modules.

What the lessons cover

1. Information produced by the entity (AU-C 500.08)
2. Reliability of evidence (AU-C 500; AS 1105)
3. Audit data analytics
4. The seven procedures for obtaining evidence, and what each cannot prove (AS 1105.13 through .21)
5. Selecting items for testing: all items, specific items, or sampling (AS 1105.22 through .28)
6. Substantive analytical procedures (AU-C 520)
7. Where the two frameworks diverge, and where they only look different

Authoritative references

Where these requirements sit in the literature. AU-C 520 deliberately carries none. Each entry names the standard, then breaks it out paragraph by paragraph.

• AU-C 500.05 defines the two measures:
  • Sufficiency is the measure of the quantity of evidence, influenced by the assessed risk of material misstatement and by the quality of the evidence obtained.
  • Appropriateness is the measure of quality, comprising relevance, meaning the evidence bears on the assertion, and reliability, which depends on the source and nature of the information.
• AU-C 500.06 carries the rule that analyzing 100 percent of a population does not automatically yield sufficient appropriate audit evidence. The analytic identifies notable items requiring further investigation, and its reliability still depends on the completeness and accuracy of the data analyzed.
• AU-C 500.07 carries the reliability generalizations, and evidence ranks higher on five counts:
  • when it comes from an independent external source;
  • when the related internal controls are effective;
  • when the auditor obtains it directly rather than by inference;
  • when it is documentary rather than oral; and
  • when it is an original rather than a photocopy or facsimile.
• AU-C 500.07 also carries the relevance rule and the treatment of an external information source:
  • Relevance depends on the assertion and on the direction of testing.
  • An external information source supplies more reliable information when the source is competent and objective and uses a methodology suited to what is being measured, and when the information relates to the measurement date and measurement basis the applicable framework requires.
• AU-C 501.27 covers a management's specialist, and it sets three duties:
  • evaluate the specialist's competence, capabilities and objectivity;
  • obtain an understanding of the work; and
  • evaluate its appropriateness as audit evidence for the relevant assertion.
• AU-C 500.08 covers information produced by the entity. It applies whether the information supports a substantive procedure or a control being tested, and it reaches data extracted to feed an analytic. Two tests sit inside it:
  • Accuracy and completeness. Obtain evidence about both, by testing the report or the controls over its preparation.
  • Precision and detail. Evaluate whether the information is sufficiently precise and detailed for the auditor's purpose.
• AU-C 500.10 governs inconsistency in, or doubts about the reliability of, audit evidence, and either trigger produces the same two-part response:
  • Resolve the matter. Determine what modifications or additions to audit procedures are necessary.
  • Consider the effect. Weigh the effect, if any, on other aspects of the audit.
• SAS No. 142 amended AU-C 500 to address information from an external information source, such as a pricing service used by a broad range of users. Evaluate relevance and reliability including the nature and authority of the source, and note that independence alone does not remove the evaluation. Two routes are closed to such information:
  • it is not tested as information produced by the entity; and
  • the management's-specialist rules do not apply to it.
• AU-C 520 governs analytical procedures and carries no paragraph number here. A substantive analytic takes three design steps:
  • evaluate the reliability of the data from which the expectation is developed;
  • develop an expectation of recorded amounts or ratios and evaluate whether it is precise enough to identify a material misstatement; and
  • determine the acceptable difference requiring no further investigation.
• AU-C 520 further governs the investigation of a difference, the end-of-audit pass, and suitability:
  • Investigating a larger difference. Inquire of management and obtain corroborating evidence relevant to the response.
  • Near the end of the audit. Analytics assist in forming an overall conclusion, and a previously unrecognized risk found there forces a revised risk assessment and further procedures.
  • Suitability. It turns on expected effectiveness in detecting a material misstatement, and such procedures suit large volumes of transactions predictable over time.
• AU-C 315 is the source of the requirement to perform analytical procedures as risk assessment procedures during planning. It carries no paragraph number here.
• AS 1105.05 and .06 are the PCAOB definitions of sufficiency and appropriateness, and .05 adds that obtaining more of the same type of evidence cannot compensate for its poor quality.
• AS 1105.07 carries relevance, which depends on the design of the procedure. Three things decide it:
  • whether the procedure tests for understatement or overstatement;
  • its timing; and
  • the level of disaggregation needed.
• AS 1105.08 carries reliability, which rewards four features of the evidence:
  • an independent knowledgeable source;
  • effective controls, including information technology general controls and automated application controls, over information the company produced or received from external sources in electronic form;
  • direct auditor access; and
  • originals over copies and converted electronic forms.
• AS 1105.09 addresses document authentication. The auditor is not expected to be an expert, and the duty that remains is conditional:
  • The trigger. Conditions indicate that a document may not be authentic, or that its terms were modified without disclosure to the auditor.
  • The response. Modify the planned procedures or perform additional procedures, and evaluate the effect on other aspects of the audit.
• AS 1105.10 and .10A are the PCAOB requirements for company information.
  • Under .10, test the accuracy and completeness of company-produced information or test the controls over them, and evaluate precision and detail.
  • Under .10A, for external information the company supplies in electronic form, obtain an understanding of the source and of the company's process for receiving, maintaining and processing it, including any modifications.
  • Then, still under .10A, either test it for modification or test the controls over that process.
• AS 1105.11 and .12 carry the PCAOB assertion categories, and different assertions may be used if sufficient to identify potential misstatements and respond to the risks. Paragraph .11 fixes five:
  • existence or occurrence;
  • completeness;
  • valuation or allocation;
  • rights and obligations; and
  • presentation and disclosure.
• AS 1105.13 through .21 classify procedures and describe the techniques. Procedures are risk assessment or further audit procedures, the latter being tests of controls and substantive procedures (tests of details and substantive analytics). Per .14 the purpose determines the classification, and a dual-purpose procedure must achieve each objective. The techniques are:
  • Inspection (.15).
  • Observation (.16), limited to the point in time observed and possibly affected by being observed.
  • Inquiry (.17), whose Note states that inquiry of company personnel by itself does not provide sufficient audit evidence.
  • Confirmation (.18), a direct written communication to the auditor.
  • Recalculation (.19).
  • Reperformance (.20).
  • Analytical procedures (.21).
• AS 1105.22 through .28 govern selecting items for testing.
  • .22 gives three alternatives: selecting all items, selecting specific items, and audit sampling.
  • .23 makes the choice turn on the nature of the procedure, the characteristics of the items or the control, and the evidence needed to meet the objective.
  • A 100 percent examination suits few large-value items, a significant-risk response other means cannot satisfy, and a procedure that can be automated and applied to the whole population (.24).
  • Specific-item selection reaches key items and all items over an amount (.25) and may serve understanding (.26).
  • .27 states such selections are not audit sampling and their results cannot be projected.
  • .28 confines audit sampling to less than 100 percent of items.
• AS 1105.29 is the PCAOB counterpart on inconsistency and doubts, and it requires two things:
  • Resolve the matter. Perform the audit procedures necessary to resolve it.
  • Consider the effect. Determine the effect, if any, on other aspects of the audit.
• AS 1105 Appendix A governs using the work of a company's specialist.
  • Qualifications and level of knowledge, skill and ability (.A3).
  • The specialist's relationship to the company, specifically whether circumstances let the company significantly affect the specialist's judgments (.A4).
  • The data, significant assumptions and methods used, and the relevance and reliability of the work (.A6).
  • Testing the accuracy and completeness of company-produced data the specialist used (.A8).
  • Additional procedures where the findings appear to contradict the assertion or the work is not sufficient (.A10).
• AS 2305 governs substantive analytical procedures for issuers.
  • .09: for significant risks, substantive analytics alone are unlikely to be sufficient.
  • .10: evaluate the risk of management override, because substantive analytics alone are not well suited to detecting fraud.
  • .11: expected effectiveness turns on the nature of the assertion, the plausibility and predictability of the relationship, the availability and reliability of the data, and the precision of the expectation.
  • .12: aggregate salaries against personnel count is the standard's own example.
  • .14: stable environments and income statement relationships are more predictable than dynamic environments and balance-sheet-only relationships, and discretionary transactions less so.
  • .16: before using the results, test controls over the information used or perform other procedures supporting its completeness and accuracy.
  • .17: the expectation must be precise enough to identify potential material misstatements.
  • .18 and .19: offsetting factors obscure misstatements, so disaggregate, since detailed beats broad, monthly beats annual, and location or line of business beats company-wide.
  • .20: the acceptable difference is influenced primarily by materiality.
  • .21: evaluate significant unexpected differences, ordinarily corroborate management's responses, and where no explanation can be obtained perform other procedures, treating the unexplained difference as indicating increased risk.
  • .22: document the expectation, the comparison, and any additional procedures when an analytic is the principal substantive test of a significant assertion.
• AS 2110.46 through .48 require analytics as risk assessment procedures.
  • .46 requires them to be designed to enhance understanding of the business and to identify areas of specific risk.
  • .47 requires analytics relating to revenue, aimed at relationships that might indicate material misstatement including fraud.
  • The Note to .48 adds that risk assessment analytics often use preliminary or highly aggregated data and in those instances are not designed with the precision necessary for substantive analytics.
• AS 2315.26 requires projecting a sample's misstatement results. Read it against AS 1105.27, which bars projection from specifically selected items. The projection runs in three moves:
  • project the sample's misstatement results to the items from which the sample was selected;
  • add the misstatements from items examined 100 percent; and
  • compare the total to tolerable misstatement, with consideration of sampling risk.
• AS 2810.05 through .08 govern the overall review.
  • Read the statements and disclosures and perform analytics to evaluate the conclusions on significant accounts and to help form an opinion on the statements as a whole (.05).
  • Evaluate whether evidence on previously identified unusual items is sufficient and whether anything indicates previously unidentified risks, particularly fraud risks (.06).
  • Corroborate management's explanations, performing procedures where responses appear implausible, inconsistent with other evidence, imprecise, or insufficiently detailed (.08).
• AS 2301.17 explains why controls testing becomes unavoidable around electronic information: tests of controls must be performed for each relevant assertion for which substantive procedures alone cannot provide sufficient appropriate evidence. Its Note observes that where a significant amount of supporting information is electronically initiated, recorded, processed or reported, sufficiency and appropriateness usually depend on the effectiveness of controls over accuracy and completeness.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary