Audit evidence: gather, analyze, and evaluate
Useful audit evidence must address the objective, be dependable enough for its purpose, and support the conclusion with adequate coverage. Gathering more data is not automatically better. Analyze contradictions, compare the condition with a suitable criterion, and document the path from evidence to finding.
Three checks before relying on evidence
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Relevance | Does the information answer the specific audit question? | Using a training attendance list as proof that access was removed on departure. |
| Reliability | Can the source, completeness, and accuracy be trusted for this use? | Accepting a manually edited spreadsheet without understanding its origin. |
| Sufficiency | Is the extent and quality enough to support the proposed conclusion? | Generalizing from one convenient transaction to a whole year. |
Relevance
Does the information answer the specific audit question?
Avoid: Using a training attendance list as proof that access was removed on departure.
Reliability
Can the source, completeness, and accuracy be trusted for this use?
Avoid: Accepting a manually edited spreadsheet without understanding its origin.
Sufficiency
Is the extent and quality enough to support the proposed conclusion?
Avoid: Generalizing from one convenient transaction to a whole year.
A decision path you can use
- 1Define the evidence needed
- 2Validate and analyze what you obtain
- 3Limit the conclusion to what it supports
Understand the method
Work through the reasoning
Design the evidence chain before collecting files
For a leaver-access review, identify the events that define the objective: departure, the required removal deadline, and actual disablement in each relevant system. Each event may have a different source. A completed service ticket can show a request was processed, but it may not establish that every application account was disabled when required.
Map the sources to these assertions and identify omissions. HR can help establish who left; system logs can help establish what access changed. Contractors, shared accounts, and rehires may need different treatment. Collect information because it answers an identified question, not because the file is available or large enough to look comprehensive.
Validate information for the way it will be used
Reliability is contextual. An export may be accurate for the accounts it includes but incomplete because a filter excluded inactive users. Check extraction rules, period boundaries, key fields, and reconciliation totals. Where practical, trace selected records back to their source and investigate unexplained differences before performing a large analysis.
Direct observation and independent corroboration can strengthen evidence, but neither removes every limitation. Observing a control today does not prove it operated throughout the prior year. A confirmation may answer a balance question without answering whether approval occurred. Record the purpose and limits of each source so the conclusion does not silently exceed its evidential reach.
Turn mismatches into evaluated conditions
Join the departure and account records using dependable identifiers. Names alone can create false matches; missing identifiers can conceal unmatched accounts. Calculate elapsed time under the actual criterion, including its time-zone and business-day conventions where relevant. Retain unmatched records for investigation rather than dropping them to make the analysis run.
A mismatch is a lead, not automatically a confirmed failure. A rehire, leave arrangement, or duplicate identity could explain it. Obtain corroboration and compare the established condition with the applicable benchmark. If an exception remains, assess its significance and possible cause. Avoid selecting only explanations that support the conclusion the team initially expected.
Evaluate sufficiency at the conclusion level
Ask what a competent reviewer could infer from the evidence obtained. Complete records for one application cannot support a statement about all systems unless the relationship is established. A few carefully selected high-risk accounts may reveal a serious defect but do not automatically estimate the failure rate across every employee.
When evidence is missing or contradictory, decide whether additional procedures can resolve the uncertainty. If not, explain the limitation and adjust the conclusion appropriately. Document the chain from objective to source, analysis, exceptions, and judgment. This makes the work reviewable and prevents a polished report from concealing an unsupported inference.
Original teaching example
Apply the method to a decision
The scenario
HR supplies a list of departures. IT supplies an access report. The auditor wants to assess whether accounts were disabled promptly.
The decision
Validate both populations, join reliable identifiers, and compare departure dates with disablement evidence.
A list of disabled accounts alone excludes leavers whose accounts remain active. Starting from the complete departure population makes missing action visible. Investigate mismatches before concluding that all leavers were handled correctly.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A clean join hides missing identifiers
The situation
An analyst reports no late removals after joining HR and IT files. Forty departures with blank employee IDs were excluded by the analysis.
Reason through it
The result describes only the matched records. The excluded departures could include the very failures the audit seeks. Audit should resolve their identities, seek alternative matching evidence, and reassess completeness before extending the result.
Take the decision
Investigate unmatched records and state coverage explicitly. A successful calculation does not establish a complete evidence chain.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Is evidence from outside the organization always sufficient?
No. Independence can improve reliability, but the evidence must still be relevant, current, complete enough, and appropriate for the objective. A third-party confirmation of one balance does not answer every audit question.
Can a large dataset still be insufficient evidence?
Yes. Volume cannot correct an irrelevant population, unreliable fields, missing periods, or an analysis that does not answer the objective. Sufficiency depends on the quality and extent needed for the particular conclusion.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Information Gathering, Analysis, and Evaluation (40% of Part 2). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 14.1-14.6. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.