12.3 Evidence an Informed, Competent Person Could Rely On

12.3 Evidence an Informed, Competent Person Could Rely On

Quick Answer: CIA Part 2 B2c asks you to describe evidence that would allow an informed and competent person to reach the same conclusions as the internal auditor. That person is a reviewer, another auditor, an external assessor, or a similarly skilled outsider — not the staff member who “was there.” GIAS Standard 14.1 builds this outsider into sufficiency; Standard 14.6 requires documentation such that an informed, prudent internal auditor or similarly informed and competent person could repeat the work and derive the same engagement results. The trap is “I was there so I know”: undocumented observation, unlabeled tick marks, and conclusions that cannot be re-performed from the file.

If 12.1 is the three-attribute filter and 12.2 is how you rank reliability, 12.3 is the reperformance test. It is the reason workpapers exist. Chapter 16 will organize complete workpapers and retention; Chapter 17 will put a supervisor in the reviewer chair. This section is the B2c skill those later chapters assume: what must the evidence itself look like so someone who did not do the work can still agree with you — or show where you went wrong.

Who is the informed, competent person?

The standard is not “a random employee on the elevator” and not “only the CAE who already knows this process.” Think of a prudent, informed, competent reviewer who:

• understands internal auditing and the type of engagement,
• has the file, the work program, and the supporting exhibits,
• does not have your memory of the hallway conversation,
• could repeat the procedures and see how the conclusion follows.

GIAS 14.6 uses almost the same person: an informed, prudent internal auditor, or a similarly informed and competent person. Quality assessors, external auditors who rely on your work, and engagement supervisors are the practical faces of that person. If the file only works when you are in the room to narrate it, the evidence is not yet B2c-quality — and it is not sufficient under 14.1.

The person is informed (given the objectives, criteria, scope, and methods) and competent (could execute the procedures). You do not have to educate a novice from zero inside every tick mark. You do have to make the logic reconstructable: what you tested, against what, on what population, with what result, leading to what conclusion.

Confidentiality does not empty the file. You may restrict who sees workpapers. The authorized reviewer still needs a reperformable packet. “This is sensitive, so I kept it in my head” fails B2c.

What the file must show (the reperformance checklist)

Describe evidence at a level another auditor could reperform the logic, not merely admire the conclusion sentence.

That is evidence, not bureaucracy. A screenshot of a live configuration with the parameter name, environment (production), date captured, and who can change it is reperformable. A sticky note that says “match is on” is not. A bank confirmation in the file, with the request, the reply path, and the reconciliation to the GL, is reperformable. “Cash is fine — I called the controller” is not.

You do not need to reproduce the entire ERP. You need a reproducible path: parameters, record counts, hash or control totals, sample selection method, and exhibits that still exist. If the only copy of a report was on a live screen you did not capture, the competent person has nothing.

The “I was there so I know” trap

Observation and professional judgment are real procedures. They become non-evidence when they leave no trail an outsider can evaluate.

Worked example — undocumented observation. The auditor visits the warehouse, watches receiving, and concludes dual custody of high-value items is effective. The workpaper says “Observed receiving — OK.” A reviewer cannot tell which dock, which shift, which SKUs, whether staff knew they were being watched, or how one visit supports a period-long conclusion. Repair: date, location, who was present, what was supposed to happen (criterion), what actually happened (condition), photographs or count sheets if used, limitations (snapshot), and why the observation does or does not support the objective. The observation can still be relevant and, for that hour, reliable. Without that description, it fails the competent-person test — which is a sufficiency and documentation failure, not a finding that observation is never evidence.

Worked example — undocumented judgment. Five exceptions in a sample of 25. The auditor writes “immaterial — no finding.” The reviewer cannot see the dollar effect, the root-cause hypothesis, whether items were in a high-risk class (vendor bank changes versus office supplies), or whether the five share a pattern. Repair: show the calculation or qualitative rationale a competent person could challenge. Significance evaluation is GIAS 14.3 and Chapter 15; B2c is the demand that the basis sit in the evidence, not in the auditor’s head.

Worked example — oral close-out. Management explains all exceptions in a meeting. The auditor is persuaded and files nothing but “cleared in discussion.” An informed person cannot evaluate the explanation, cannot see corroboration (12.2), and cannot reperform the clearance. Repair: document the explanation, obtain supporting records, and show why the evidence now supports — or still does not support — the original conclusion.

The same trap appears as unlabeled tick marks, as “tested 25 — OK” with no listing of items, and as a conclusion drafted before exhibits were attached (file stuffing). A reviewer who cannot tell whether you sampled from the full unmatched population or from a filtered “clean” list cannot reach your conclusion honestly.

Linking 14.1 sufficiency to 14.6 documentation

Candidates split these standards into “fieldwork versus paper.” The 2025 exam does not. If a competent person cannot reach the same conclusion from the file, the information was not sufficient under 14.1, even if you personally remember more. Standard 14.6 then requires the analyses, evaluations, and supporting information to be documented so that person could repeat the work and derive the same engagement results. Supervisors review documentation for accuracy, relevance, and completeness (14.6) — that review is Chapter 17; your job in B2c is to produce evidence that makes the review possible.

Supervisor sign-off is not a substitute for exhibits. Sign-off means someone reviewed the evidence. Empty papers with a reviewer’s initials still fail B2c. Likewise, a process-owner “agrees with the rating” in a closing meeting is communication during the engagement (Chapter 18), not evidence that an outsider could reperform.

Retention, legal hold, and linking workpapers to final communications are Chapter 16. Final report attributes, recommendation protocols, residual-risk acceptance, and follow-up monitoring are not the B2c task — and are primarily CIA Part 3 2025. Stay on: would another competent person, looking only at this evidence, reach the same conclusion?

Describing B2c-quality evidence (what good looks like)

Use the AP unmatched-invoice review as a complete packet an informed person could rely on:

1. Objective: operating effectiveness of the Friday unmatched-invoice review for the fiscal year.
2. Criterion: policy requiring weekly review of all unmatched invoices over $5,000, evidenced by sign-off and investigation notes.
3. Source: production ERP exception report; IPE tested by reconciling one week’s report to the unmatched table, including parked items; parameters screenshotted.
4. Procedures: inquiry (documented, not sole support); inspection of signed reports for 12 weeks spread across the year including close; reperformance of 15 investigations; user-ID comparison to the authority list.
5. Results: one unsigned week in March (system outage); 14 of 15 investigations supported; IPE complete for the weeks tested.
6. Conclusion: control operated with a documented exception in March; exception evaluated for significance with amounts and duration shown.

A reviewer can disagree with the significance call — that is healthy — but cannot say the conclusion is unavailable to evaluate. That is B2c.

Exam traps

• Believing personal knowledge substitutes for evidence another person can evaluate.
• Confusing confidentiality (you may restrict who sees the file) with emptiness (the authorized reviewer still needs a reperformable file).
• Dumping raw extracts with no procedure description and calling it sufficiency.
• Writing the conclusion first and attaching random documents.
• Treating supervisor sign-off as a substitute for evidence.
• Drifting into Part 3 final-report form and follow-up tracking.

B2c is complete when you can describe a packet that would let a competent outsider repeat the logic — and reject a packet that only makes sense if the original auditor is still in the building.