It is the responsibility of the auditor to obtain reasonable assurance by conducting audit engagement and expressing his opinion in the audit report. This expression of opinion results in reasonable assurance which is conveyed to users of financial statements via audit report. However, to form audit opinion, auditor is required to stay objective and he cannot express an opinion on his own and by his own free will rather his opinion must be based upon evidence i.e. audit evidence (as it is collected as a result of application of audit procedures during audit engagement thus called audit evidence) and it should be that sufficient and appropriate that a reasonable assurance can be drawn on the basis of such evidence by the auditor.
The term, which is a combination of two, “sufficient appropriate” requires auditor to obtain audit evidence which is sufficient enough and also so appropriate that it can back up the conclusions reached and opinions formed by the auditor.
Sufficiency is the measure of quantity of audit evidence i.e. the amount of evidence obtained must be enough that it can be used and considered by the auditor. The quantity of audit evidence required depends on the assessment of risk conducted by the auditor. If the risk of material misstatement is high then higher quantity of audit evidence is required to establish (confirm) by the application of audit procedures.
Appropriateness on the other hand is the measure of quality of audit evidence. Audit evidence is said to be appropriate if it is relevant and reliable in the given set of circumstances. However, the appropriateness of audit evidence is affected by the time, source and the circumstances under which such evidence is obtained.
However, the two features of evidence are NOT independent and isolated rather they are closely interrelated. A quality audit evidence, even if it is in small quantity, might be enough in some situation i.e. higher the quality lesser the amount of evidence required, however, a large quantity of audit evidence cannot be a substitute for inappropriateness of audit evidence i.e. poor quality of audit evidence cannot be rectified by merely increasing the amount of evidence.
Sufficient appropriate audit evidence is obtained by applying appropriate audit procedures keeping the risk assessment in consideration. It is up to the auditor to decide whether a certain audit procedure is appropriate enough to obtain sufficient appropriate evidence in a particular situation. Sufficient appropriate audit evidence is said to have been obtained if the audit risk is reduced by the auditor (through application of audit procedures) to such level that enables the auditor to draw reasonable inferences on which ultimately auditor’s opinion will be based.
Thus, the emphasize on obtaining sufficient appropriate audit evidence is because auditor is required to reduce audit risk to an appropriate level which is so appropriate that reasonable assurance can be drawn which is in the end expressed in the form of audit report.
CAS 200.11 In conducting an audit of financial statements, the overall objectives of the auditor are:
(a) To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and
(b) To report on the financial statements, and communicate as required by the CASs, in accordance with the auditor’s findings.
CAS 330.25 Based on the audit procedures performed and the audit evidence obtained, the auditor shall evaluate before the conclusion of the audit whether the assessments of the risks of material misstatement at the assertion level remain appropriate. (Ref: Para. A60-A61)
Evaluating the Sufficiency and Appropriateness of Audit Evidence (Ref: Para. 25-27)
CAS 330.A60 An audit of financial statements is a cumulative and iterative process. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing or extent of other planned audit procedures. Information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based. For example:
- The extent of misstatements that the auditor detects by performing substantive procedures may alter the auditor’s judgment about the risk assessments and may indicate a significant deficiency in internal control.
- The auditor may become aware of discrepancies in accounting records, or conflicting or missing evidence.
- Analytical procedures performed at the overall review stage of the audit may indicate a previously unrecognized risk of material misstatement.
In such circumstances, the auditor may need to reevaluate the planned audit procedures, based on the revised consideration of assessed risks for all or some of the classes of transactions, account balances, or disclosures and related assertions. CAS 315 contains further guidance on revising the auditor’s risk assessment.
CAS 330.A61 The auditor cannot assume that an instance of fraud or error is an isolated occurrence. Therefore, the consideration of how the detection of a misstatement affects the assessed risks of material misstatement is important in determining whether the assessment remains appropriate.
CAS 330.26 The auditor shall conclude whether sufficient appropriate audit evidence has been obtained. In forming an opinion, the auditor shall consider all relevant audit evidence, regardless of whether it appears to corroborate or to contradict the assertions in the financial statements. (Ref: Para. A62)
CAS 330.A62 The auditor’s judgment as to what constitutes sufficient appropriate audit evidence is influenced by such factors as the following:
- Significance of the potential misstatement in the assertion and the likelihood of its having a material effect, individually or aggregated with other potential misstatements, on the financial statements.
- Effectiveness of management’s responses and controls to address the risks.
- Experience gained during previous audits with respect to similar potential misstatements.
- Results of audit procedures performed, including whether such audit procedures identified specific instances of fraud or error.
- Source and reliability of the available information.
- Persuasiveness of the audit evidence.
- Understanding of the entity and its environment, including the entity’s internal control.
CAS 330.27 If the auditor has not obtained sufficient appropriate audit evidence as to a material financial statement assertion, the auditor shall attempt to obtain further audit evidence. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor shall express a qualified opinion or disclaim an opinion on the financial statements.
Forming the Assurance Conclusion
CSAE 3001.68 The practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary in the circumstances, attempt to obtain further evidence. The practitioner shall consider all relevant evidence, regardless of whether it appears to corroborate or to contradict the measurement or evaluation of the underlying subject matter against the applicable criteria. If the practitioner is unable to obtain necessary further evidence, the practitioner shall consider the implications for the practitioner’s conclusion in paragraph 69. (Ref: Para. A147-A153)
CSAE 3001.69 The practitioner shall form a conclusion about whether the underlying subject matter is free from significant deviation. In forming that conclusion, the practitioner shall consider the practitioner’s conclusion in paragraph 68 regarding the sufficiency and appropriateness of evidence obtained and an evaluation of whether identified deviations are significant, individually or in the aggregate. (Ref: Para. A5, A120 and A154-A155)
CSAE 3001.70 If the practitioner is unable to obtain sufficient appropriate evidence, a scope limitation exists and the practitioner shall express a qualified conclusion, disclaim a conclusion, or withdraw from the engagement, where withdrawal is possible under applicable law or regulation, as appropriate. (Ref: Para. A156-A158)
CSAE 3001.83 If the practitioner identifies information that is inconsistent with the practitioner’s final conclusion regarding a significant matter, the practitioner shall document how the practitioner addressed the inconsistency.
Significance
CSAE 3001.49 The practitioner shall consider significance when: (Ref: Para. A90-A98)
(b) Evaluating whether the underlying subject matter is free from significant deviation.
Forming the Assurance Conclusion
Sufficiency and Appropriateness of Evidence (Ref: Para. 14(j), 68)
CSAE 3001.A147 Evidence is necessary to support the practitioner’s conclusion and assurance report. It is cumulative in nature and is primarily obtained from procedures performed during the course of the engagement. It may, however, also include information obtained from other sources such as previous engagements (provided the practitioner has determined whether changes have occurred since the previous engagement that may affect its relevance to the current engagement) or a firm’s quality control procedures for client acceptance and continuance. Evidence may come from sources inside and outside the appropriate party(ies). Also, information that may be used as evidence may have been prepared by an expert employed or engaged by the appropriate party(ies). Evidence comprises both information that supports and corroborates aspects of the underlying subject matter, and any information that contradicts aspects of the underlying subject matter. In addition, in some cases, the absence of information (for example, refusal by the appropriate party(ies) to provide a requested representation) is used by the practitioner and, therefore, also constitutes evidence. Most of the practitioner’s work in forming the assurance conclusion consists of obtaining and evaluating evidence.
CSAE 3001.A148 The sufficiency and appropriateness of evidence are interrelated. Sufficiency is the measure of the quantity of evidence. The quantity of evidence needed is affected by the risks of the underlying subject matter containing a significant deviation (the higher the risks, the more evidence is likely to be required) and also by the quality of such evidence (the higher the quality, the less may be required). For certain types of direct engagements such as performance audits, there may also be a higher risk of concluding that there is a significant deviation when that is not the case. The appropriateness of the practitioner’s decision regarding whether a matter identified is a significant deviation is affected by the quantity and quality of evidence obtained.
CSAE 3001.A149 Appropriateness is the measure of the quality of evidence; that is, its relevance and its reliability in providing support for the practitioner’s conclusion. The reliability of evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained. Generalizations about the reliability of various kinds of evidence can be made; however, such generalizations are subject to important exceptions. Even when evidence is obtained from sources external to the appropriate party(ies), circumstances may exist that could affect its reliability. For example, evidence obtained from an external source may not be reliable if the source is not knowledgeable or objective. While recognizing that exceptions may exist, the following generalizations about the reliability of evidence may be useful:
- Evidence is more reliable when it is obtained from sources outside the appropriate party(ies).
- Evidence that is generated internally is more reliable when the related controls are effective.
- Evidence obtained directly by the practitioner (for example, observation of the application of a control) is more reliable than evidence obtained indirectly or by inference (for example, inquiry about the application of a control).
- Evidence is more reliable when it exists in documentary form, whether paper, electronic, or other media (for example, a contemporaneously written record of a meeting is ordinarily more reliable than a subsequent oral representation of what was discussed).
CSAE 3001.A150 The practitioner ordinarily obtains more assurance from consistent evidence obtained from different sources or of a different nature than from items of evidence considered individually. In addition, obtaining evidence from different sources or of a different nature may indicate that an individual item of evidence is not reliable. For example, corroborating information obtained from a source independent of the appropriate party(ies) may increase the assurance the practitioner obtains from a representation from the appropriate party(ies). Conversely, when evidence obtained from one source is inconsistent with that obtained from another, the practitioner determines what additional procedures are necessary to resolve the inconsistency.
CSAE 3001.A151 In terms of obtaining sufficient appropriate evidence, it is generally more difficult to obtain assurance about the underlying subject matter covering a period than about underlying subject matter at a point in time. In addition, conclusions provided on processes ordinarily are limited to the period covered by the engagement; the practitioner provides no conclusion about whether the process will continue to function in the specified manner in the future.
CSAE 3001.A152 Whether sufficient appropriate evidence has been obtained on which to base the practitioner’s conclusion is a matter of professional judgment.
CSAE 3001.A153 In some circumstances, the practitioner may not have obtained the sufficiency or appropriateness of evidence that the practitioner had expected to obtain through the planned procedures. In these circumstances, the practitioner considers that the evidence obtained from the procedures performed is not sufficient and appropriate to be able to form a conclusion on the underlying subject matter. The practitioner may:
- Extend the work performed; or
- Perform other procedures judged by the practitioner to be necessary in the circumstances.
Where neither of these is practicable in the circumstances, the practitioner will not be able to obtain sufficient appropriate evidence to be able to form a conclusion. This situation may arise even though the practitioner has not become aware of a matter(s) that causes the practitioner to believe the underlying subject matter may have a significant deviation, as addressed in paragraph 54L.
Evaluating the Sufficiency and Appropriateness of Evidence (Ref: Para. 69)
CSAE 3001.A154 An assurance engagement is a cumulative and iterative process. As the practitioner performs planned procedures, the evidence obtained may cause the practitioner to change the nature, timing or extent of other planned procedures. Information may come to the practitioner’s attention that differs significantly from that expected and upon which planned procedures were based. For example:
- The extent of deviations that the practitioner identifies may alter the practitioner’s professional judgment about the reliability of particular sources of information.
- The practitioner may become aware of discrepancies in relevant information, or inconsistent or missing evidence.
- If analytical procedures were performed towards the end of the engagement, the results of those procedures may indicate a previously unrecognized risk of significant deviation.
In such circumstances, the practitioner may need to reevaluate the planned procedures.
CSAE 3001.A155 The practitioner’s professional judgment as to what constitutes sufficient appropriate evidence is influenced by such factors as the following:
- Importance of a potential deviation and the likelihood of its having a significant effect, individually or when aggregated with other potential deviations, on the practitioner’s report.
- Effectiveness of the appropriate party(ies)’s responses to address the known risk of significant deviation.
- Experience gained during previous assurance engagements with respect to similar potential deviations.
- Results of procedures performed, including whether such procedures identified specific deviations.
- Source and reliability of the available information.
- Persuasiveness of the evidence.
- Understanding of the appropriate party(ies) and its environment.