12.2 Independence, Corroboration, and the Control Environment

12.2 Independence, Corroboration, and the Control Environment

Quick Answer: CIA Part 2 B2b tests factors that impact reliability: obtaining evidence directly from an independent source, obtaining corroborated evidence, and gathering evidence from a system with effective governance, risk management, and control (GRC) processes. Reliability is a hierarchy, not a coin flip. Auditor-obtained evidence outranks independent third-party evidence, which outranks internal evidence with good controls, which outranks internal evidence with weak controls, which outranks oral inquiry alone. Information produced by the entity (IPE) is internal evidence: test completeness and accuracy before you rely on it. Three copies of the same management spreadsheet are not corroboration.

Section 12.1 defined reliability as factual, current, quality-of-source. This section is the B2b skill: recognize what makes one piece more trustworthy than another. You still need relevance and sufficiency. A highly reliable confirmation of the wrong account is a 12.1 failure. A highly reliable single observation of a daily control is a sufficiency failure. Here, assume the information is on-point and ask: can I trust it?

GIAS Standard 14.1 states that reliability is strengthened when information is (1) obtained directly by an internal auditor or from an independent source, (2) corroborated, and (3) gathered from a system with effective GRC processes. Those are the official three. The hierarchy below is how you apply them on items that rank sources.

The reliability hierarchy

Rank sources from most to least reliable all else equal. The exam loves a ranking item and a “which is most reliable?” item.

Directly obtained is not the same as independent. You can directly obtain a weak thing (you watch the clerk open the same untested spreadsheet). You can receive a strong independent thing by mail (bank confirmation). GIAS groups “directly by an internal auditor or from an independent source” because both strengthen reliability relative to management-filtered internals. When both are available, auditor-obtained independent evidence is the top of the stack: you go to the warehouse and count; you log into the bank portal under audit credentials; you reperform three-way match from source documents you selected.

Originals beat copies. Contemporaneous records beat reconstructions dated the week the auditors arrived. Written beats oral. Documents created outside the process under review beat documents the process owner can edit. None of those rules override relevance: the most reliable evidence of the wrong fact still fails 12.1.

Independent source

An independent source is outside the activity — and preferably outside the incentive structure — of the people whose work you are evaluating. The customer who confirms an open receivable, the bank that confirms cash, the freight carrier whose bill of lading shows shipment, the cloud provider whose immutable log shows who changed a role: those sources do not close the books for the process owner.

Independence is relative. A “third-party” warehouse that is a related entity, paid to store whatever management says is there, is not independent in substance. A vendor confirmation sent to the AP manager, who then forwards a PDF, has been filtered. The confirmation is only as independent as the path it traveled. Have third-party evidence sent to the internal auditors, or obtain it through a channel you control.

Worked example. To test cash, a client-provided photocopy of a year-end bank statement is internal evidence. A statement downloaded by the auditor from the bank portal is auditor-obtained from an independent source. A bank confirmation mailed to the audit function is independent third-party evidence. If those three disagree, you do not average them — you investigate, because reliability just told you where to put your skepticism.

Related-party “confirmations,” shared-service attestations written by the same controller, and SOC reports that do not cover the system or period in scope are frequent exam disguises for independence that is not actually there. Read the source, the period, and the path.

Corroboration

Corroboration means a different source or a different procedure supports the same fact. Inquiry plus a matching original document plus a system log is corroboration. Inquiry plus two more interviews of the same team is not. Printing the same ERP extract three times is not. Management’s narrative plus management’s slide deck is not.

Use corroboration when a single source would be convenient but biased: fraud red flags, estimates and forecasts, oral explanations of exceptions, related-party activity, and any finding you already suspect is significant. GIAS 14.2 analysis of criteria versus condition still needs evidence; corroboration is how you keep that evidence from being a single story.

When two independent sources conflict, reliability dropped, it did not rise. Conflict is a signal to expand procedures, not to pick the nicer number. Corroboration is also not a substitute for direct testing when the claim is the core of a high-risk objective — you still prefer to obtain the evidence yourself.

Effective GRC processes (the control environment of the source system)

Evidence gathered from a system with effective governance, risk management, and control is more reliable because unauthorized change, incomplete populations, and silent parameter edits are less likely. This is the same intuition as Section 9.2: an automated application control is more trustworthy when IT general controls over access and program change are effective.

Evaluate the source system, not the brand name. An ERP with weak access, shared passwords, and developers in production is not “reliable because it is SAP.” A well-controlled sub-ledger with dual approval, logging, and change management can be more reliable than a famous platform that anyone can reconfigure.

Ask: who can change the record or the report definition? Is there an audit trail? Are incompatible duties separated? Was the environment production (or another locked effective environment) when you extracted? A report generated in a sandbox that IT refreshed from last month is not current production evidence.

IPE: still internal evidence

GRC effectiveness does not make IPE self-proving. A strong ERP can still emit a report with the wrong company code, the wrong date range, or a filter the process owner applied before sending it to you. IPE remains internal evidence: test completeness (every item that should be on the extract is on it) and accuracy (fields are right) when you rely on the report as evidence or when a control uses the report.

IPE procedures you already planned in 9.2 apply here as reliability procedures: reconcile the extract to a source population, inspect parameters, compare record counts, reperform the query with independently obtained criteria, and test line items to source documents. If you cannot test IPE, you do not get to treat the report as rank-3 evidence; you treat it closer to rank 4 until you obtain it another way — preferably by pulling the population yourself.

A process owner who “filters the noise so audit sees the real exceptions” has just destroyed completeness. That filtered file is not corroborated by the fact that the ERP is otherwise well controlled. Obtain the unfiltered extract or reperform the selection.

Putting the factors together

A practical fieldwork sequence:

1. Prefer obtaining the evidence yourself from the live system or location.
2. Where you cannot, go to an independent third party with the response path aimed at internal audit.
3. For internal evidence, ask whether the source system’s GRC is effective; if not, increase corroboration and direct testing.
4. Corroborate high-risk claims and all oral explanations of exceptions.
5. Test IPE before you rely on a report.
6. Never let inquiry alone carry an assurance conclusion.

Exam traps

• Ranking a client-provided bank PDF above an auditor-obtained confirmation “because it is a bank document.”
• Calling repeated management statements corroboration.
• Skipping IPE tests because “the ERP is well controlled.”
• Treating oral evidence as sufficient if the speaker is senior (seniority is not independence).
• Assuming originals in a weak-control environment cannot be fabricated or backdated — skepticism still applies.
• Mixing this ranking with relevance: the most reliable evidence of the wrong fact still fails 12.1.

B2b is complete when you can rank two packets and say which reliability factor you would add next: go direct, go independent, corroborate, or move to a better-controlled system — including testing IPE.