Evidence Sufficiency
Definition
The standard that evidence must meet to support an audit conclusion. Evidence must be relevant to the control being tested, reliable in terms of its source and collection method, and sufficient in quantity to support the conclusion with reasonable assurance.
- Field
- Audit and control testing
- Three qualities
- Relevant, reliable, sufficient in quantity
- Reliability factors
- Source of the evidence and the method used to collect it
- Outcome
- Supports the audit conclusion with reasonable assurance, not certainty
Common questions
Why is reasonable assurance the standard rather than certainty?+
Audits sample controls and transactions rather than testing every instance, so conclusions are inherently probabilistic. Reasonable assurance means the evidence gathered is strong enough to support the stated conclusion, not that every possible failure has been ruled out.
What makes an evidence source more or less reliable in an audit?+
Evidence obtained directly by the auditor, such as observation or independent recalculation, is generally more reliable than evidence supplied by the entity being audited. Evidence from a well-controlled system also outranks evidence from one with known weaknesses.
Related terms
- Audit Chain of Custody
- The documented record of when audit evidence was collected, by whom, from what source, and how it has been stored and accessed...
- Control Criterion
- The standard against which a control is evaluated. Criteria may come from an external standard (ISO 27001 Annex A, NIST CSF, PCI-DSS),...
- Design Effectiveness
- The assessment of whether a control is designed in a way that would prevent or detect the risk it targets, if it...
- Fieldwork
- The active evidence-gathering phase of an audit, during which the auditor applies testing procedures to specific controls and collects the evidence that...
- Operating Effectiveness
- The assessment of whether a control has consistently functioned as designed over the audit period. Requires evidence of actual operation, such as...