23.2 Audit Evidence, Assertions, Procedures, and Documentation

Audit Evidence, Assertions, Procedures, and Documentation

The auditor's opinion must rest on sufficient appropriate audit evidence. This section covers audit evidence under PSA 500, management assertions and the direction of testing, the audit procedures used to obtain evidence (including confirmations under PSA 505 and analytical procedures under PSA 520), and audit documentation under PSA 230 and RA 9298.

---

1. Nature and Characteristics of Audit Evidence (PSA 500)

Audit evidence comprises all the information used by the auditor in arriving at the conclusions on which the audit opinion is based. Audit evidence includes both the information contained within the underlying accounting records (such as general ledgers, subsidiary ledgers, journal entries, and electronic spreadsheets) and other corroborative information obtained from internal or external sources (such as third-party confirmations, vendor contracts, minutes of meetings, and industry benchmarks).

                                    Audit Evidence Dual Pillars
                                                │
                       ┌────────────────────────┴────────────────────────┐
                       ▼                                                 ▼
                  Sufficiency                                      Appropriateness
              (Quantity of Evidence)                            (Quality of Evidence)
                       │                                                 │
       ┌───────────────┴───────────────┐                 ┌───────────────┴───────────────┐
       ▼                               ▼                 ▼                               ▼
Assessed Risk of              Quality of Evidence   Relevance to Specific        Reliability (Source,
Material Misstatement (RMM)   (Higher quality =      Management Assertion       Nature & Circumstances
(Higher RMM = More evidence)  lower quantity needed) (Tests the intended target) of Evidence Gathering)

Sufficiency vs Appropriateness

PSA 500 establishes two fundamental criteria that audit evidence must fulfill:

1. Sufficiency (The Quantitative Measure): Sufficiency refers to the measure of the quantity of audit evidence. The quantity of evidence needed is affected by:

   • The Auditor's Assessment of the Risks of Material Misstatement (RMM): As the assessed risk of material misstatement increases, the required quantity of evidence increases.
   • The Quality of Such Audit Evidence: Higher-quality, more reliable evidence reduces the overall quantity required. However, merely obtaining a massive volume of low-quality evidence cannot compensate for its lack of appropriateness.
   • Materiality and Population Size: Lower materiality thresholds or large, heterogeneous transaction populations demand greater evidence volume.

2. Appropriateness (The Qualitative Measure): Appropriateness is the measure of the quality of audit evidence; that is, its relevance and its reliability in providing support for the conclusions on which the auditor's opinion is based:

   • Relevance: The logical connection between the audit procedure performed and the specific management assertion being tested. For instance, physically inspecting an inventory item is highly relevant to the assertion of existence, but provides zero evidence regarding the client's rights and obligations (the goods may be held on consignment from a third party).
   • Reliability: The credibility and trustworthiness of the evidence, which is heavily influenced by its source, nature, and the specific circumstances under which it is obtained.

The Evidential Reliability Hierarchy

Pursuant to PSA 500, the reliability of audit evidence follows established principles tested extensively on the CPALE:

General Evidential Rules:

• Original Documents vs Copies: Documentary evidence is more reliable when it exists in original format rather than photocopies, faxes, or scanned images, which are susceptible to alteration.
• Written vs Oral: Written evidence (electronic or physical paper) is inherently more reliable than oral statements.

---

2. Management Assertions & Direction of Testing (PSA 315 / PSA 500)

Financial statements are not merely collections of numbers; they are implicit or explicit representations made by management regarding the recognition, measurement, presentation, and disclosure of assets, liabilities, equity, revenues, and expenses. The auditor uses assertions to form a basis for identifying, assessing, and responding to risks of material misstatement.

                                  Management Assertions Architecture
                                                  │
                       ┌──────────────────────────┴──────────────────────────┐
                       ▼                                                     ▼
           Classes of Transactions                                    Account Balances
            & Events (Income Statement)                           at Period-End (Balance Sheet)
                       │                                                     │
         ├─ Occurrence                                         ├─ Existence
         ├─ Completeness                                       ├─ Rights and Obligations
         ├─ Accuracy                                           ├─ Completeness
         ├─ Cut-off                                            ├─ Accuracy, Valuation and Allocation
         ├─ Classification                                     ├─ Classification
         └─ Presentation                                       └─ Presentation

Assertions for Classes of Transactions and Events (P&L)

1. Occurrence: Transactions and events that have been recorded or disclosed have occurred, and such transactions and events pertain to the entity (testing for overstatement / fictitious transactions).
2. Completeness: All transactions and events that should have been recorded have been recorded, and all related disclosures have been included (testing for understatement / unrecorded transactions).
3. Accuracy: Amounts and other data relating to recorded transactions and events have been recorded appropriately (mathematical correctness, proper application of exchange rates).
4. Cut-off: Transactions and events have been recorded in the correct accounting period (preventing revenue acceleration or expense postponement around year-end).
5. Classification: Transactions and events have been recorded in the proper accounts (e.g., distinguishing operating expenses from capital expenditures under PAS 16).
6. Presentation: Transactions and events are appropriately aggregated or disaggregated and clearly described, and related disclosures are relevant and understandable.

Assertions for Account Balances at Period End (Balance Sheet)

1. Existence: Assets, liabilities, and equity interests exist at the balance sheet date (testing for overstatement / ghost assets).
2. Rights and Obligations: The entity holds or controls the rights to assets, and liabilities are the obligations of the entity (e.g., verifying pledged assets or factored receivables).
3. Completeness: All assets, liabilities, and equity interests that should have been recorded have been recorded (testing for omitted liabilities or unrecorded inventory).
4. Accuracy, Valuation and Allocation: Assets, liabilities, and equity interests have been included in the financial statements at appropriate amounts, and any resulting valuation or allocation adjustments are appropriately recorded (e.g., PAS 2 Lower of Cost and Net Realizable Value, PFRS 9 expected credit loss allowances, PAS 36 impairment).
5. Classification: Assets, liabilities, and equity interests have been recorded in the proper accounts (e.g., current vs non-current split).
6. Presentation: Assets, liabilities, and equity interests are appropriately aggregated or disaggregated and clearly described.

The Directional Testing Paradigm: Tracing vs Vouching

A fundamental auditing concept on the CPALE is the direction of testing, which directly determines which assertion is verified:

                      Directional Testing: Vouching vs Tracing

  Source Documents                                                    Accounting Records
 (Invoices, Shipping Orders,                                       (Journals, General Ledgers,
  Receiving Reports)                                                Financial Statements)
          │                                                                  │
          │ ◄────────────────────── VOUCHING ─────────────────────────────── │
          │  Tests: OCCURRENCE (P&L) / EXISTENCE (BS)                        │
          │  Direction: Records back to Source Documents                     │
          │  Objective: Detect OVERSTATEMENT / Fictitious Entries            │
          │                                                                  │
          │ ─────────────────────── TRACING ───────────────────────────────► │
          │  Tests: COMPLETENESS (P&L & BS)                                  │
          │  Direction: Source Documents forward to Records                  │
          │  Objective: Detect UNDERSTATEMENT / Unrecorded Entries           │
          ▼                                                                  ▼

• Vouching (Testing for Overstatement): The auditor selects sample transactions from the general ledger or sales journal and works backward to inspect supporting source documents (such as sales orders, customer signed delivery receipts, and invoices). If a recorded transaction lacks a valid underlying source document, it is fictitious. Vouching tests Occurrence or Existence.
• Tracing (Testing for Understatement): The auditor starts with raw source documents (such as sequential delivery receipts or receiving reports) and follows them forward into the sales journal or purchase journal and general ledger. If a source document was never entered into the accounting records, the records are incomplete. Tracing tests Completeness.

---

3. Core Audit Procedures for Obtaining Evidence

Pursuant to PSA 500, paragraph A10, the auditor obtains audit evidence by performing one or more of the following seven core procedures:

1. Inspection

• Inspection of Records or Documents: Examining records or documents, whether internal or external, in paper or electronic form. Includes vouching and tracing.
• Inspection of Tangible Assets: Physically inspecting an asset (e.g., machinery, buildings, raw materials). Primarily provides highly reliable evidence of existence, but little or no evidence of rights and obligations or valuation.

2. Observation

Looking at a process or procedure being performed by client personnel (e.g., observing the client's inventory count, or observing the distribution of payroll envelopes).

• Limitation: Observation provides evidence only at the exact point in time when the observation takes place, and the act of being observed may alter personnel behavior (Hawthorne effect).

3. External Confirmation (PSA 505)

Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form or by electronic or other medium.

• Positive Confirmation Request: The confirming party responds directly to the auditor indicating agreement or disagreement with the given information, or providing the requested balance (blank form). Provides highly reliable evidence. If no response is received, the auditor must perform alternative audit procedures (e.g., examining subsequent cash receipts, shipping documentation, and purchase orders).
• Negative Confirmation Request: The confirming party responds directly to the auditor only if they disagree with the information provided in the request.
  • CPALE Rule on Negative Confirmations: PSA 505 permits the use of negative confirmation requests as the sole substantive procedure only if all four of the following conditions are met:
    1. The assessed RMM is low and internal controls operating effectiveness has been confirmed.
    2. The population comprises a large number of small, homogeneous account balances.
    3. A very low exception rate is expected.
    4. The auditor is not aware of circumstances that would cause recipients to disregard the requests.
• Management Refusal to Allow Confirmations: If management refuses to allow the auditor to send a confirmation request, the auditor must inquire into management's reasons, evaluate the impact on RMM and fraud risk, and perform alternative procedures. If management's refusal is unreasonable or alternative procedures cannot yield sufficient appropriate evidence, the auditor shall communicate with Those Charged with Governance (TCWG) and consider the impact on the auditor's report (qualified opinion or disclaimer of opinion due to scope limitation).

4. Recalculation

Checking the mathematical accuracy of documents or records (e.g., verifying addition of footing columns in ledgers, recomputing sales invoice extensions, recalculating depreciation expense or bond amortization schedules). Can be performed manually or electronically.

5. Reperformance

The auditor's independent execution of procedures or controls that were originally performed as part of the entity's internal control (e.g., reperforming the aging of accounts receivable or reperforming an automated bank reconciliation).

6. Analytical Procedures (PSA 520)

Evaluations of financial information through analysis of plausible relationships among both financial and non-financial data (e.g., ratio analysis, trend analysis, regression models, variance analysis). PSA 520 governs three distinct applications across the audit lifecycle:

                         Analytical Procedures Across the Audit Lifecycle
                                                │
         ┌──────────────────────────────┼──────────────────────────────┐
         ▼                              ▼                              ▼
   Planning Phase              Substantive Phase               Final Review Phase
     (PSA 315)                     (PSA 520)                       (PSA 520)
   MANDATORY                      OPTIONAL                        MANDATORY
Identify unusual trends/    Obtain substantive evidence     Assess overall reasonableness;
fluctuations to direct      to detect material              confirm financial statements
audit resources and RMM     misstatements in assertions     align with audit knowledge

7. Inquiry

Seeking information of knowledgeable persons, both financial and non-financial, within the entity or outside the entity. Inquiries may range from formal written inquiries to informal oral inquiries.

• Crucial Rule: Inquiry alone does not provide sufficient audit evidence to detect a material misstatement at the assertion level, nor does it suffice to test the operational effectiveness of internal controls.

---

4. PSA 230: Audit Documentation (Working Papers)

Audit documentation (commonly referred to as working papers or workpapers) is the record of audit procedures performed, relevant audit evidence obtained, and conclusions reached by the auditor.

The "Experienced Auditor" Principle

Pursuant to PSA 230, paragraph 8, the auditor shall prepare audit documentation that is sufficient to enable an experienced auditor, having no previous connection with the audit, to understand:

1. The nature, timing, and extent of the audit procedures performed to comply with PSAs and legal/regulatory requirements.
2. The results of the audit procedures performed, and the audit evidence obtained.
3. Significant matters arising during the audit, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions.

Ownership, Confidentiality, and Custody

• Ownership (RA 9298, Sec. 29): Working papers, schedules, and memoranda made by the CPA and staff during an examination, including those prepared and submitted by the client, are confidential and privileged and remain the property of the CPA in the absence of a written agreement to the contrary. Reports the CPA submits to the client are excluded. Even though the client pays the audit fee, the working papers belong to the practitioner.
• Confidentiality and permitted disclosure: Working paper contents are not disclosed to third parties without the client's consent, except:
  1. When production is required by a subpoena issued by a court, tribunal, or government regulatory or administrative body (RA 9298, Sec. 29).
  2. In quality reviews and inspections by the Board of Accountancy or other regulators, and in investigations by the Board or the professional body, as permitted by the Code of Ethics.
  3. To the extent needed for the auditor to defend against legal claims arising from the engagement.

Assembly and Retention Deadlines

                             Audit Documentation Timeline (PSA 230)
                                                │
      Auditor's Report Date              Assembly Window Ends                 Retention Horizon
         (Day 0: Opinion)                  (Ordinarily Day 60)                  (Ordinarily >= 5 Years)
               │ ◄───────────────────────────────► │ ◄────────────────────────────────► │
               ▼                                   ▼                                    ▼
         Report Issued                    Final Audit File Assembled           Disposal Permitted
                                          Administrative process only;         Retain for PRC/BOA/SEC
                                          NO deletion of existing docs;        rules and firm policy
                                          only additions documented

• Assembly Period: Under PSA 230, the auditor shall assemble the audit documentation in an audit file and complete the administrative process of assembling the final audit file on a timely basis after the date of the auditor's report. The assembly deadline is ordinarily not more than 60 days after the date of the auditor's report.
  • After the assembly date, the auditor shall not delete or discard audit documentation of any nature before the end of its retention period.
  • If changes are made to documentation during the assembly period, they must be purely administrative (e.g., sorting, cross-referencing, signing off checklists).
• Retention Period: Under PSQM 1 and PSA 230, the retention period for audit engagements is ordinarily no shorter than five (5) years from the date of the auditor's report (or, if later, the date of the group auditor's report). Laws, regulations, or firm policy may require a longer period.

Working Paper Organization: Permanent vs Current Files

1. Permanent File (Carry-Forward File): Contains information of continuing significance across multiple audit years:
   • Articles of Incorporation and Corporate By-laws.
   • Long-term debt agreements, bond indentures, and loan covenants.
   • Lease agreements (PAS 16 / PFRS 16) and patent/trademark titles.
   • Historical analyses of capital stock and retained earnings.
   • Internal control system flowcharts and manuals.
2. Current File (Current Audit Year File): Contains documentation relating exclusively to the period under audit:
   • Current year financial statements and working trial balance.
   • Audit engagement letter and planning memorandum.
   • General ledger lead schedules and supporting schedules.
   • Bank confirmations, bank reconciliations, and cutoff bank statements.
   • Inventory count observation sheets and test count records.
   • Summary of Unadjusted Audit Differences (SUAD).
   • Management Representation Letter and lawyer's inquiry letters.

5. Specific Audit Areas: Estimates, Related Parties, and Using the Work of Others

Two themes run through all of these standards. First, the auditor's responsibility for the opinion is never reduced by using others' work. Second, areas involving judgment and possible bias call for professional skepticism, which means actively looking for contradictory evidence rather than only evidence that supports management's position.

---