Statement On Auditing Standards 142: Audit Evidence

Statement on July 2020
Auditing Standards 142
Issued by the Auditing Standards Board
Audit Evidence
(Supersedes Statement on Auditing Standards (SAS) No. 122, Statements on Auditing Standards:
Clarification and Recodification, as amended, section 500, Audit Evidence [AICPA, Professional
Standards, AU-C sec. 500]; Amends
• SAS No. 122, as amended

— Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit
in Accordance With Generally Accepted Auditing Standards [AICPA, Professional
Standards, AU-C sec. 200]
— Section 230, Audit Documentation [AICPA, Professional Standards, AU-C sec. 230]
— Section 315, Understanding the Entity and Its Environment and Assessing the Risks of
Material Misstatement [AICPA, Professional Standards, AU-C sec. 315]
— Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating
the Audit Evidence [AICPA, Professional Standards, AU-C sec. 330]
— Section 501, Audit Evidence — Specific Considerations for Selected Items [AICPA,
Professional Standards, AU-C sec. 501]
— Section 530, Audit Sampling [AICPA, Professional Standards, AU-C sec. 530]
— Section 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates,
and Related Disclosures [AICPA, Professional Standards, AU-C sec. 540]
© 2020 American Institute of Certified Public Accountants, Inc. All rights reserved.
For information about the procedure for requesting permission to make copies of any part of this work,
please email copyright-permissions@aicpa-cima.com with your request. Otherwise, requests should be
written and mailed to Permissions Department, 220 Leigh Farm Road, Durham, NC 27707-8110.
Auditing Standards Board
(2019–2020)
Michael J. Santay, Chair Audrey A. Gramling
Brad C. Ames Gaylen R. Hansen
Monique Booker Tracy W. Harding
Patricia Bottomly Jon Heath
Jay D. Brodish, Jr. Kristen A. Kociolek
Dora A. Burzenski G. Alan Long
Joseph S. Cascio Sara Lord
Harry Cohen Marcia L. Marien
Jeanne M. Dee Aaron Saito
Lawrence M. Gill
Audit Evidence Task Force
Jay D. Brodish, Jr., Chair Susan Jones
James P. Burton Jeffrey D. Schaberg
David Finkelstein Eric Turner
Audrey A. Gramling Alan Young
Kristen A. Kociolek
The ASB gratefully acknowledges Sally Ann Bailey, Kathy Healy, and Vanessa Teitelbaum
for their contributions to this project.
AICPA Staff
Robert Dohrer Hiram Hasty

Chief Auditor Associate Director
Professional Standards and Services Audit and Attest Standards —
Public Accounting
Teighlor S. March
Assistant General Counsel —
Office of General Counsel
Note: Statements on Auditing Standards are issued by the Auditing Standards Board, the senior technical
body of the AICPA designated to issue pronouncements on auditing matters. The “Compliance With
Standards Rule” (ET sec. 1.310.001)1 of the AICPA Code of Professional Conduct requires compliance
with these standards in an audit of a nonissuer.
1
All ET sections can be found in AICPA Professional Standards.
CONTENTS
Paragraph
Introduction
Scope of This Statement on Auditing Standards ................................................................. 1–3
Effective Date .......................................................................................................................... 4
Objective ....................... ................................................................................................................5
Definitions ..................................................................................................................................... 6
Requirements
Evaluating Information to Be Used as Audit Evidence ....................................................... 7–8
Audit Procedures as a Basis for Concluding on the Sufficiency and
Appropriateness of Audit Evidence ......................................................................................... 9
Inconsistencies in, or Doubts About the Reliability of, Audit Evidence ............................... 10
Application and Other Explanatory Material
Scope of This SAS ......................................................................................................... A1–A4
Definitions.................................................................................................................... A5–A10
Evaluating Information to Be Used as Audit Evidence ............................................. A11–A42
Audit Procedures as a Basis for Concluding on the Sufficiency and
Appropriateness of Audit Evidence ........................................................................... A43–A64
Inconsistencies in, or Doubts About the Reliability of, Audit Evidence ................... A65–A66
Appendix A — Considerations Regarding the Use of External Information

Sources ..................................................................................................................................... A67
Appendix B — Amendments to Various Sections in SAS No. 122, Statements on
Auditing Standards: Clarification and Recodification, as Amended .................................... A68
Exhibit A — Using ADAs to Simultaneously Accomplish Multiple Audit
Procedures ............................................................................................................................... A69
4
Statement on Auditing Standards, Audit Evidence
Introduction
Scope of This SAS
1. This Statement on Auditing Standards (SAS) explains what constitutes audit evidence in an
audit of financial statements and sets out attributes of information that are taken into account by
the auditor when evaluating information to be used as audit evidence. Taking these attributes into
account assists the auditor in maintaining professional skepticism. (Ref: par. A1)
2. The application of this SAS assists the auditor in fulfilling the auditor’s responsibilities in
other AU-C sections.* This SAS should be read in conjunction with other AU-C sections, including
those that address the auditor’s responsibilities to identify and assess the risks of material
misstatement,1 design and implement responses to the risks of material misstatement identified
and assessed by the auditor,2 and form an opinion on the financial statements.3 In particular, AU-
C section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the
Audit Evidence Obtained, requires the auditor to conclude whether sufficient appropriate audit
evidence has been obtained and thereby provides a basis for the auditor’s opinion. (Ref: par. A2)
3. The auditor’s overall conclusion in accordance with AU-C section 330 about whether
sufficient appropriate audit evidence has been obtained is a matter of professional judgment.
Evaluating information to be used as audit evidence in accordance with this SAS assists the auditor
in making that conclusion. The auditor’s evaluation of information to be used as audit evidence is
not a formulaic exercise and is dependent on the degree to which the attributes of information to
be used as audit evidence influence the auditor’s evaluation. (Ref: par. A3–A4)
Effective Date
4. This SAS is effective for audits of financial statements for periods ending on or after
December 15, 2022.
Objective
5. The objective of the auditor is to evaluate information to be used as audit evidence,
including the results of audit procedures, to inform the auditor’s overall conclusion about whether
sufficient appropriate audit evidence has been obtained.
*
All AU-C sections can be found in AICPA Professional Standards.
1
See AU-C section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material
Misstatement.
2
AU-C section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit
Evidence Obtained.
3
AU-C section 700, Forming an Opinion and Reporting on Financial Statements.
5
Definitions
6. For purposes of generally accepted auditing standards (GAAS), the following terms have
the meanings attributed as follows:
Appropriateness (of audit evidence). The measure of the quality of audit evidence, that is,
its relevance and reliability in providing support for the conclusions on which the auditor’s
opinion is based. (Ref: par. A9)
Audit evidence. Information used by the auditor in arriving at the conclusions on which the
auditor’s opinion is based. Audit evidence is information to which audit procedures have
been applied and consists of information that corroborates or contradicts assertions in the
financial statements. (Ref: par. A5–A10)
External information source. An external individual or organization that provides
information that is used by the entity in preparing the financial statements or that has been
obtained by the auditor as audit evidence, when such information is suitable for use by a
broad range of users. When information has been provided by an individual or organization
acting in the capacity of management’s specialist, service organization, 4 or auditor’s
specialist,5 the individual or organization is not considered an external information source
with respect to that particular information.
Sufficiency (of audit evidence). The measure of the quantity of audit evidence. The quantity
of audit evidence necessary is affected by the auditor’s assessment of the risks of material
misstatement and the quality of the audit evidence obtained (that is, its appropriateness).
(Ref: par. A9–A10)
Requirements
Evaluating Information to Be Used as Audit Evidence
7. The auditor should evaluate information to be used as audit evidence by taking into account
(Ref: par. A11)
a. the relevance and reliability of the information, including its source, and (Ref: par.
A12–A34)
b. whether such information corroborates or contradicts assertions in the financial
statements. (Ref: par. A35–A38)
8. The auditor’s evaluation of the information to be used as audit evidence in accordance with
paragraph 7 should include
a. evaluating whether the information is sufficiently precise and detailed for the auditor’s
4
See AU-C section 402, Audit Considerations Relating to an Entity Using a Service Organization.
5
See AU-C section 620, Using the Work of an Auditor’s Specialist.
6
purposes and (Ref: par. A39)
b. obtaining audit evidence about the accuracy and completeness of the information, as
necessary (Ref: par. A40–A42).
Audit Procedures as a Basis for Concluding on the Sufficiency and Appropriateness of

Audit Evidence
9. In evaluating information to be used as audit evidence, the auditor should consider whether
the results of audit procedures provide a basis for concluding on the sufficiency and
appropriateness of audit evidence obtained. (Ref: par. A43–A64)
Inconsistencies in, or Doubts About the Reliability of, Audit Evidence
10. The auditor should determine whether modifications or additions to audit procedures are
necessary to resolve inconsistencies in, or doubts about the reliability of, audit evidence, including
when
a. audit evidence obtained from one source is inconsistent with that obtained from another
source.
b. the results of an audit procedure are inconsistent with the results of another audit
procedure.
(Ref: par. A65–A66)
***
Application and Other Explanatory Material

Scope of This SAS (Ref: par. 1–3)
A1. AU-C section 200, Overall Objectives of the Independent Auditor and the Conduct of an
Audit in Accordance With Generally Accepted Auditing Standards, defines professional skepticism
and professional judgment.6 AU-C section 200 and AU-C section 330 provide application material
about maintaining professional skepticism and exercising professional judgment.7 The auditor’s
evaluation of information to be used as audit evidence in accordance with this SAS involves
maintaining professional skepticism, including the consideration of whether unconscious or
conscious auditor biases may affect the auditor’s professional judgments.8 Paragraphs A17, A30,
A31, A37, A38, A60, and A63 of this SAS are examples of paragraphs that describe ways in which
the auditor can maintain professional skepticism.
6
Paragraph .14 of AU-C section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit
in Accordance With Generally Accepted Auditing Standards.
7
Paragraphs .A22–.A31 of AU-C section 200.
8
See paragraph .A27 of AU-C section 200.
7
A2. Paragraph 2 states that this SAS should be read in conjunction with other AU-C sections.
For example, the objective of AU-C section 330 is for the auditor to obtain sufficient appropriate
audit evidence regarding the assessed risks of material misstatement through designing and
implementing appropriate responses to those risks.9 AU-C section 330 also states that the auditor
is required to do the following:
• Design and perform further audit procedures whose nature, timing, and extent are
based on, and are responsive to, the assessed risks of material misstatement at the
relevant assertion level.10
• Obtain more persuasive audit evidence the higher the auditor’s assessment of risk.11
• Conclude whether sufficient appropriate audit evidence has been obtained.12
• Attempt to obtain further audit evidence if the auditor has not obtained sufficient
appropriate audit evidence about a relevant assertion.13
In addition, AU-C section 700, Forming an Opinion and Reporting on Financial Statements,
requires the auditor to conclude whether reasonable assurance has been obtained about whether
the financial statements as a whole are free from material misstatement, whether due to fraud or
error. The conclusions required by AU-C section 700 take into account, among other things,
whether sufficient appropriate audit evidence has been obtained in accordance with AU-C section
330.14
A3. Audit evidence is cumulative in nature and is obtained through the performance of one or
more audit procedures on information obtained during the course of the audit. The auditor’s
evaluation of information to be used as audit evidence may be enhanced by the use of automated
tools and techniques, which may enable the auditor to aggregate or disaggregate information or
consider information obtained from multiple sources.
A4. For example, the auditor may use automated tools and techniques for the purpose of
planning or performing the audit, such as audit data analytics. Data analytics is described as the
analysis of patterns, identification of anomalies, or extraction of other useful information in data
underlying or related to the subject matter of an audit through analysis, modeling, or visualization.
Examples of other automated tools and techniques are artificial intelligence, machine learning,
remote observation tools, and robotic process automation.
Definitions (Ref: par. 6)
9
Paragraph .03 of AU-C section 330.
10
11
Paragraph .07b of AU-C section 330.
12
13
14
Paragraph .13a of AU-C section 700.
8
Audit Evidence
A5. Audit evidence is information to which audit procedures have been applied, ordinarily
during the course of the current-year audit. Information to be used as audit evidence may also be
obtained by the auditor as part of designing and performing risk assessment procedures in
accordance with AU-C section 315, Understanding the Entity and Its Environment and Assessing
the Risks of Material Misstatement, including from
a. the auditor’s previous experience with the entity and audit procedures performed in
previous audits, when the auditor has evaluated whether such information remains
relevant and reliable as audit evidence for the current audit,
b. the auditor’s procedures regarding acceptance or continuance of the client relationship
or the audit engagement, and
c. when applicable, other engagements performed by the engagement partner for the
entity.
A6. The nature of the audit procedures that the auditor performs to use information as audit
evidence may depend on the source of the information and range from simple to extensive audit
procedures. For example, when using information from an external information source, obtaining
the information may be relatively straightforward, and the auditor’s procedures to evaluate that
information would be largely focused on the relevance and reliability of the information, including
its source, in accordance with this SAS. On the other hand, audit procedures to obtain evidence
about the accuracy and completeness of the information, such as tests of controls, may be necessary
when the auditor intends to use information generated internally from the entity’s general and
subsidiary ledgers as audit evidence.
A7. In some cases, the absence of information is used by the auditor and, therefore, also
constitutes audit evidence.15 For example, when considering information regarding management’s
assertions related to the entity’s recorded warranty provision, the absence of sales returns of the
product in question may be audit evidence supporting management’s assertion about the
completeness of the warranty provision.
Sufficient Appropriate Audit Evidence
A8. As explained in AU-C section 200, reasonable assurance is obtained when the auditor has
obtained sufficient appropriate audit evidence to reduce audit risk (that is, the risk that the auditor
expresses an inappropriate opinion when the financial statements are materially misstated) to an
acceptably low level.16
A9. As explained in AU-C section 200, the sufficiency and appropriateness of audit evidence
are interrelated.17 Together they affect the persuasiveness of audit evidence. The auditor’s
15
Paragraph .A32 of AU-C section 200.
16
17
Paragraph .A33 of AU-C section 200.
9
conclusion about whether sufficient appropriate audit evidence has been obtained in accordance
with AU-C section 330 is both at the financial statement level as well as the relevant assertion
level. AU-C section 330 requires the auditor to obtain more persuasive audit evidence the higher
the assessment of risk.18 For example, ordinarily, more persuasive audit evidence is needed to
respond to significant risks. Persuasiveness, therefore, relates to the auditor obtaining appropriate
audit evidence that is sufficient for the auditor to draw reasonable conclusions.
A10. The quantity of audit evidence, in and of itself, is not solely determinative of its
persuasiveness. For example, obtaining more of the same type of audit evidence may not
compensate for its lack of appropriateness. However, as the quality of audit evidence increases,
the need for additional corroborating audit evidence decreases. Depending on the auditor’s
consideration of relevance and reliability, information obtained from a single source may provide
persuasive audit evidence.
Evaluating Information to Be Used as Audit Evidence (Ref: par. 7–8)
A11. Information to be used as audit evidence may take different forms, which influences the
nature of audit procedures that may be necessary to obtain or evaluate the information. Different
forms of information, individually or in combination, include
• oral information obtained through a verbal response to an inquiry of management or

external information sources (for example, oral inquiries made during the course of the
audit).
• visual information obtained through observation (for example, a message that appears on-
screen for a control restricting access to an IT) system or observed by the auditor using
remote observation tools).
• paper documents, which are obtained in documentary form (for example, an original
executed sales contract or a written confirmation).
• electronic information, which includes
— documents obtained in electronic documentary form (for example, a scanned version

of an executed sales contract or an electronic confirmation).
— data stored in the entity’s IT system or obtained electronically from an external

information source. Such data may be manually input into the system or may be
electronically generated (for example, an electronic data interface between the entity
and a service organization).
Relevance and Reliability of the Information, Including Its Source (Ref: par. 7a)
18
See paragraph .07b of AU-C section 330.
10
Sources of Information to Be Used as Audit Evidence
A12. The source of the information to be used as audit evidence often affects the consideration
of its relevance and reliability. Information to be used as audit evidence may be obtained directly
or derived individually or in combination from different sources, including the following:
a. Management. Management may provide the auditor with information obtained from the
financial reporting process used to prepare the financial statements, including disclosures
(for example, the entity’s accounting records) as well as information obtained from outside
of the general and subsidiary ledgers (for example, from the entity’s risk management
system or sales functions). This information may be stored by the entity within its IT
systems or in a remote server. Management may also employ or engage a specialist who
may provide information to be used as audit evidence.19
b. External information sources and other external parties. Management or the auditor may
use information obtained from external information sources and other external parties (for
example, information used as inputs to forecasts or models used to prepare accounting
estimates or accumulated by an auditor to analyze industry trends). The auditor may obtain
external confirmations or make inquiries of external parties to corroborate management’s
assertions. See appendix A, “Considerations Regarding the Use of External Information
Sources,” for the auditor’s considerations when using external information sources.
c. Auditor. The auditor may develop information to be used as audit evidence. For example,
an auditor may accumulate and analyze industry trends to be used in the audits of entities
in that industry. The auditor may also employ or engage a specialist to assist the auditor in
developing audit evidence, which could include developing an independent expectation to
evaluate the reasonableness of an accounting estimate. The auditor may also use automated
tools and techniques to analyze information provided by management or external parties,
resulting in audit evidence.
A13. Accounting records are an example of information provided by management that is
obtained from the financial reporting process and may include the following:
• The records of initial accounting entries and supporting records, such as checks and
records of electronic fund transfers; invoices; contracts; the general and subsidiary
ledgers; and journal entries
• Records, such as spreadsheets, cost allocations, computations, reconciliations, and
disclosures
A14. An example of information provided by management that is obtained from outside the
general and subsidiary ledgers is internal marketing information developed by the entity’s sales
function as an assumption in making an accounting estimate for a warranty provision.
19
See AU-C section 501, Audit Evidence — Specific Considerations for Selected Items.
11
A15. External confirmation20 procedures may provide relevant information to be used as audit
evidence when addressing assertions associated with certain account balances and their elements.
However, external confirmations need not be restricted to classes of transactions, account balances,
or disclosures. For example, the auditor may request confirmation of the terms of agreements or
transactions an entity has with third parties; the confirmation request may be designed to ask if
any modifications have been made to the agreement and, if so, the relevant details. External
confirmation procedures are also used to obtain audit evidence about the absence of certain
conditions (for example, the absence of a side agreement that may influence revenue recognition).
A16. As indicated in paragraph A12, information to be used as audit evidence by the auditor
may be obtained directly or derived individually or in combination from different sources. For
example, in making an accounting estimate for an accumulated pension obligation, management
may use information that is obtained from the general and subsidiary ledgers; information obtained
from outside the general and subsidiary ledgers; and information obtained from a management’s
specialist. Similarly, an auditor may obtain information to be used as audit evidence from multiple
sources. For example, in performing a regression analysis to test revenue recorded, the auditor may
obtain information about square footage of retail space and sales prices (both management-
generated) and changes in an index published by a government agency (an external information
source).
A17. In some situations, there may be only one source of certain information external to the
entity, for example, information from a central bank or government, such as an inflation rate, or
single recognized industry body. In such cases, taking into account the reliability of such
information is influenced by the nature and credibility of the source of the external information,
the assessed risks of material misstatement to which that external information is relevant, and the
degree to which the use of that external information is relevant to the reasons for the assessed risk
of material misstatement. For example, when the information is from a credible authoritative
source, the extent of the auditor’s further audit procedures may be less extensive, such as
corroborating the information with the source’s website or published information. In other cases,
when information is from a source not assessed as credible, the auditor may determine that more
extensive audit procedures are appropriate. In the absence of an alternative independent
information source against which to compare, the auditor may consider whether performing
additional audit procedures to obtain information from the external information source is
appropriate in order to obtain sufficient appropriate audit evidence (see paragraph 9 in appendix
A).
A18. In certain circumstances, the source of information may be a combination of management

and external parties. For example, if an entity develops a distributed ledger to capture its
transactions, there may be few or many other external parties participating in the transactions and
contributing to the information included in the distributed ledger. Therefore, the source of the
information included in the distributed ledger is not solely management but also external parties.
In such circumstances, professional judgment is exercised by the auditor to evaluate the relevance
20
See AU-C section 505, External Confirmations.
12
and reliability of the information obtained from the distributed ledger to be used as audit evidence.
Relevance and Reliability
Relevance
A19. The relevance of the information to be used as audit evidence relates to the logical
connection with, or bearing upon, the auditor’s purposes. Information from one source may be
relevant when performing one or more audit procedures (for example, sales information provided
by management may be used to perform procedures related to both the entity’s warranty provision
and evaluation of management’s cash flows forecast related to the entity’s warranty provision).
The following are factors that, individually or in combination, may affect the relevance of
information to be used as audit evidence:
• The classes of transactions, account balances, or disclosures or assertions to which the

information relates. Information to be used as audit evidence may be relevant to multiple
classes of transactions, account balances, or disclosures.
• The period of time to which the information relates.
A20. The following examples illustrate the relevance of information to be used as audit evidence:
• Recorded accounts payable may provide relevant information when the objective of the
audit procedures is to test the existence or valuation pertaining to accounts payable.
• Employee salaries may provide relevant information regarding an accounting estimate for
a bonus accrual.
• Commodity pricing data may be used in the performance of an audit data analytic to
evaluate recorded revenue. The period of time used for the commodity pricing data has to
be relevant to the time period revenue was recorded.
A21. Certain information to be used as audit evidence may have direct relevance to one financial
statement assertion but may not be relevant to all assertions:
• Inspection of a document constituting a financial instrument, such as a stock, bond, or a

digital copy of a mortgage, may provide relevant audit evidence about existence but may
not necessarily provide audit evidence about ownership or valuation.
• Inspection of tangible assets may provide relevant audit evidence with respect to their
existence but not necessarily about the entity’s rights and obligations.
• The collection of receivables after the period-end may provide relevant audit evidence
regarding existence and valuation of receivables and occurrence and accuracy of revenue
but not necessarily completeness of receivables and revenue.
Reliability
13
A22. The reliability of audit evidence depends on the nature and source of the audit evidence
and the circumstances under which it is obtained. Generally, the reliability of audit evidence
increases when it is obtained from external parties because the information is less susceptible to
management bias. Consideration of the sources of information to be used as audit evidence
includes the possibility that the information source may not be reliable.
A23. Information obtained directly by the auditor (for example, observation of the application
of a control) may be more reliable than information obtained indirectly or by inference (for
example, inquiry about the application of a control). When information has been obtained
indirectly or by inference, the auditor may perform additional audit procedures to evaluate the
reliability of that information, such as by reperforming the control activity.
A24. Information in documentary form, whether paper or electronic, may be more reliable than
evidence obtained through oral inquiries (for example, a contemporaneously written record of a
meeting may be more reliable than a subsequent oral representation of the matters discussed).
A25. Determining whether controls are effectively designed and implemented (including general
IT controls, as appropriate) may help the auditor design appropriate audit procedures to evaluate
the reliability of information.21 In some cases, the reliability of such information may only be
established when the related controls, whether manual or automated, including those over the
preparation and maintenance of the information, have been tested and determined to be operating
effectively.22
A26. Using electronic information may require the auditor to perform additional audit
procedures to establish its reliability. For example, when using a scanned version of an executed
sales contract provided by the sales department, additional audit procedures, such as confirmation
of the key terms with a third party, may be necessary if the auditor has not tested the operating
effectiveness of the controls around execution of the original contract and the maintenance of the
scanned version.
A27. The reliability of information to be used as audit evidence is affected to varying degrees
by the following attributes, individually or in combination:
• Accuracy
• Completeness
• Authenticity
• Susceptibility to management bias
These attributes are also relevant when automated tools and techniques are used to obtain audit
21
See paragraph .7 of this SAS.
22
See also paragraph .05b of AU-C section 520, Analytical Procedures.
14
evidence.
Controls Over Information to Be Used as Audit Evidence
A28. When information has been transformed from its original medium (for example, documents
that have been filmed, digitized, or otherwise transformed to electronic form), the reliability of
that information may depend on the controls over the information’s transformation and
maintenance. In some situations, the auditor may determine that additional audit procedures are
necessary to address reliability (for example, inspecting underlying original documents to validate
the authenticity of information in electronic form). In other situations, the auditor may determine
that it is necessary to test controls over the transformation and maintenance of the information.
A29. Similarly, when a significant amount of information is electronically initiated, recorded,

processed, or reported, information to be used as audit evidence may be available only in electronic
form. In such cases, the sufficiency and appropriateness of the audit evidence usually depends on
the effectiveness of controls over their accuracy and completeness. Furthermore, the potential for
improper initiation or alteration of information to occur and not be detected may be greater if
information is initiated, recorded, processed, or reported only in electronic form, and appropriate
controls are not operating effectively.
Authenticity
A30. An audit performed in accordance with GAAS rarely involves the authentication of
documents, nor is the auditor trained as, or expected to be, an expert in such authentication. When
the auditor identifies conditions that cause the auditor to believe that a document may not be
authentic, that terms in a document may have been modified but not disclosed to the auditor, or
that undisclosed side agreements may exist, the auditor may determine that additional audit
procedures are necessary, including audit procedures to evaluate authenticity. Such audit
procedures may include
• confirming directly with the third party.
• using the work of a specialist to assess the document’s authenticity.23
Susceptibility to Management Bias
A31. Information with a higher susceptibility to management bias is considered less reliable than
information for which the susceptibility to management bias is lower unless audit procedures have
been performed to address the higher susceptibility to management bias.
A32. A susceptibility to management bias may exist in the development of information itself or
may exist due to interpretation of the information by the entity. A greater susceptibility to
23
Paragraph .A11 of AU-C section 240, Consideration of Fraud in a Financial Statement Audit.
15
management bias may exist when information is generated from internal sources.
A33. In accordance with AU-C section 200, the auditor is required to exercise professional
judgment.24 This includes determining the impact of management bias in evaluating the reliability
of information from external information sources to be used as audit evidence. Determining the
effect of management bias involves considering the following:
a. The ability of the entity to influence the external information source

b. Management’s selection of information from an external source known to be favorably
biased toward corroborating management’s assertions or information
A34. External information is more likely to be suitable for use by a broad range of users and less
likely to be subject to influence by any particular user if the external individual or organization
provides it to the public for free or makes it available to a wide range of users in return for payment
of a fee.
Corroborative or Contradictory Information (Ref: par. 7b)
A35. AU-C section 330 states that, in forming a conclusion about whether sufficient appropriate
audit evidence has been obtained, the auditor should consider all relevant audit evidence,
regardless of whether it appears to corroborate or contradict the assertions being tested by the
auditor or the amounts recorded in the financial statements.25
A36. Evaluating information to be used as audit evidence involves taking into account
information that corroborates assertions or contradicts assertions in the financial statements. For
example, audit evidence obtained through the inspection of an original document may corroborate
a financial statement assertion, whereas audit evidence obtained from confirmation with an
external party may contradict that financial statement assertion. In this example, additional audit
evidence may be necessary to enable the auditor to conclude on the relevant assertion.
A37. Contradictory information may be relevant even when the source of that information is less
reliable than the source of corroborative information. For example, in the audit of a depository
institution, reports of decreasing property values in a particular geographical area may have been
obtained by the auditor that contradicted the report of an external appraisal provided by
management to support its estimate of the values of collateral for a loan portfolio. In this case,
given that contradictory information has been obtained, the auditor may determine that it is
necessary to perform additional audit procedures to obtain audit evidence about the value of the
property.
A38. Contradictory information is not considered in isolation but, rather, as part of the auditor’s
consideration with respect to that management assertion taken as a whole. In such cases,
professional skepticism and judgment is necessary to evaluate the persuasiveness of the audit
24
25
16
evidence taken as a whole, rather than focusing on an individual piece of audit evidence. For
example, the auditor may be aware of information on social media suggesting a company’s product
has major quality issues and that all buyers would be returning the product. The auditor may have
obtained external confirmations regarding product sales and outstanding accounts receivable that
do not indicate quality or return issues and may have scanned the sales returns subsidiary ledger,
which contained only an immaterial amount of returns subsequent to year-end. In light of that, the
auditor may conclude that the contradictory information does not suggest a reasonable possibility
of a risk of material misstatement and that further audit procedures are not necessary.
Evaluating Whether the Information Is Sufficiently Precise and Detailed for the Auditor’s
Purposes (Ref: par. 8a)
A39. In some cases, the auditor may intend to use information obtained from management for
other audit purposes. For example, the auditor may use the performance measures included in the
entity's internal audit function reports, initially obtained for the purpose of evaluating monitoring
activities, in a substantive analytical procedure. In such cases, the appropriateness of this
information to be used as audit evidence is affected by whether the information is sufficiently
precise or detailed for the auditor's purposes.
Accuracy and Completeness (Ref: par. 8b)
A40. In accordance with paragraph 8, the auditor is required to determine whether it is necessary
to obtain audit evidence about the accuracy and completeness of information to be used as audit
evidence. Examples of this would be the reliability of
• the price and sales volume data produced by the entity used to develop an expectation
of revenue is affected by the accuracy and completeness of the information being
used.
• a population being tested for a certain characteristic, such as payment authorization, is
affected by the completeness of the population from which items are selected.
A41. The auditor may obtain audit evidence about the accuracy or completeness of information
to be used as audit evidence through the performance of an audit procedure that was not primarily
intended for that purpose. For example, in testing valuation, the auditor may reconcile the listing
of investment purchases for completeness before selecting a sample. In other situations, the auditor
may consider it necessary to obtain audit evidence about the accuracy and completeness of
information by testing controls over the preparation and maintenance of the information (for
example, in light of the nature, frequency, and volume of transactions).
A42. In contrast to paragraph A41, evaluating certain attributes related to the relevance and
reliability of information obtained from external information sources, such as completeness, used
by the auditor may not be practicable. Procedures regarding the reliability of external information
may depend on how the external information will be used in the execution of an audit procedure
because the auditor may not be able to evaluate the completeness and accuracy of information
obtained from an external source to the same degree as the auditor would evaluate the
completeness and accuracy of internal information obtained from management. For example, when
using information from external information sources to perform an audit data analytic, the
17
auditor’s evaluation may focus more on the quality of that information (for example, that the
information was from a reputable source), rather than its completeness.
Audit Procedures as a Basis for Concluding on the Sufficiency and Appropriateness of Audit
Evidence (Ref: par. 9)
A43. Audit procedures performed on information may include inspection, observation,

confirmation, recalculation, reperformance, and analytical procedures, often in some combination,
in addition to inquiry. These audit procedures may be performed either manually or using
automated tools and techniques. The nature, timing, and extent of audit procedures performed on
information influences the persuasiveness of the audit evidence obtained. For example, inspection
or observation may provide more persuasive audit evidence than inquiry.
A44. As explained further in AU-C section 315 and AU-C section 330, to draw reasonable
conclusions on which to base the auditor’s opinion, audit evidence is obtained by performing the
following:26, 27
a. Risk assessment procedures

b. Further audit procedures, which comprise
i. tests of controls, when required by the AU-C sections or when the auditor has
chosen to do so, and
ii. substantive procedures, which include tests of details and substantive analytical
procedures
An audit procedure may have characteristics of one or more of the preceding categories and can
be designed to accomplish more than one objective. The auditor’s focus is on evaluating the results
of the audit procedures performed.
A45. The auditor may use automated tools and techniques to process, organize, structure, or
present data in a given context in order to generate useful information that can be used as audit
evidence.
A46. An auditor may use automated tools and techniques to perform both a risk assessment
procedure and a substantive procedure concurrently. As illustrated by the concepts in exhibit A, a
properly designed audit data analytic may be used to perform risk assessment procedures and may
also provide sufficient appropriate audit evidence to address a risk of material misstatement.
A47. The auditor may also use automated tools and techniques to obtain audit evidence about
the operation of the entity’s internal control. For example, if management has controls over the
sequential numbering of sales invoices, the auditor may be able to obtain corroborating audit
evidence about the sequential numbering of sales invoices for the period by using automated tools
and techniques to determine whether any gaps in numbering or duplicates exist, which may provide
26
Paragraphs .05–.06 of AU-C section 315.
27
Paragraphs .06–.07 of AU-C section 330.
18
audit evidence about the controls over the completeness of invoices issued during the period.
A48. Some information may be available only in electronic form or only at certain points or
periods in time, which may affect the nature and timing of the audit procedures to be performed.
A49. Certain electronic information may be destroyed or deleted after a specified period of time
(for example, if files are changed and back-up files do not exist). Accordingly, as a result of the
entity’s data retention policies, the auditor may find it necessary to request retention of some
information for the performance of audit procedures at a later point in time or to perform audit
procedures at a time when the information is available.
A50. Some electronic information (for example, records maintained on a distributed ledger, such
as a blockchain) is available on a continuous basis during the audit. In such cases, auditors may
develop audit procedures using automated tools and techniques to obtain information about
transactions on a real-time basis.
Inspection
A51. Inspection involves an examination (being physically present or using remote observation
tools) of an asset or an examination of records or documents, whether internal or external or in
paper form, electronic form, or other media. An example of inspection used as a test of controls is
inspection of records, using manual or automated techniques, for evidence of authorization. An
example of an automated technique for inspection is the use of text-recognition programs to
examine large populations of documents, such as contracts, to identify items for further audit
consideration.
Observation
A52. Observation includes looking at a process or procedure being performed by others (for
example, the auditor’s observation of inventory counting by the entity’s personnel or the
performance of control activities).
A53. Remote observation tools (for example, a camera mounted on a drone or a video
transmission) may aid the auditor in performing an inspection or an observation procedure, such
as management’s physical inventory count.
A54. Audit evidence obtained through observation procedures is limited to the point in time at
which the observation takes place and by the fact that the act of being observed may affect how
the process or procedure is performed.
Confirmation
A55. An external confirmation is defined as audit evidence obtained as a direct written response
to the auditor from a third party (the confirming party), either in paper form or by electronic or
other medium (for example, through the auditor’s direct access to information held by a third
party). See AU-C section 505, External Confirmations, for further guidance.
Recalculation
19
A56. Recalculation consists of testing the mathematical accuracy of information. Recalculation
may be performed manually or using automated tools and techniques.
A57. By using automated tools and techniques, auditors may be able to perform recalculation
procedures on 100 percent of a population, for example, recalculating the gross margin for each
product sold for an entity’s product line.
Reperformance
A58. Reperformance involves the independent execution of procedures or controls by the auditor
that were originally performed as part of the entity’s internal control.
Analytical Procedures
A59. Analytical procedures consist of evaluations of financial information through analysis of

plausible relationships among both financial and nonfinancial data. Analytical procedures also
encompass investigation as necessary of identified fluctuations or relationships that are
inconsistent with other relevant information or that differ from expected values by a significant
amount. Audit data analytics are techniques that the auditor may use to perform risk assessment
procedures or substantive procedures.
A60. Use of audit data analytics may enable auditors to identify areas that might represent
specific risks relevant to the audit, including the existence of unusual transactions and events, and
amounts, ratios, and trends that warrant investigation. An analytical procedure performed using
audit data analytics may be used to produce a visualization of transactional detail to assist the
auditor in performing risk assessment procedures. For example, a visualization depicting the
composition of a population may be prepared to illustrate the volume and dollar value of items in
the population. Although the auditor may find this technique useful in obtaining information in
order to identify and assess the risks of material misstatement, the information provided may not
be sufficiently precise for the auditor’s purpose of obtaining information to respond to the assessed
risks of material misstatement at the assertion level.
A61. Analytical procedures involve the auditor’s exercise of professional judgment and may be
performed manually or by using automated tools and techniques. For example, the auditor may
manually scan data to identify significant or unusual items to test, which may include the
identification of unusual individual items within account balances or other data through the reading
or analysis of entries in transaction listings, subsidiary ledgers, general ledger control accounts,
adjusting entries, suspense accounts, reconciliations, and other detailed reports for indications of
misstatements that have occurred. The auditor also might use automated tools and techniques to
scan an entire population of transactions and identify those transactions meeting the auditor’s
criteria for a transaction being unusual. The identification of items that exhibit characteristics of
risk of material misstatement through analytical procedures provides the auditor with audit
evidence about those items. Analytical procedures also provide audit evidence about the items not
exhibiting characteristics of risks of material misstatements because the auditor has determined,
exercising professional judgment, that the items not selected for further audit procedures are less
likely to be materially misstated.
Inquiry
20
A62. Inquiry consists of seeking information, both financial and nonfinancial, from
knowledgeable persons within the entity or outside the entity. Inquiry is used extensively
throughout the audit, in addition to other audit procedures.
A63. Responses to inquiries may provide the auditor with information that corroborates other
information or with new information. Alternatively, responses might provide information that
contradicts other information that the auditor has obtained (for example, regarding the possibility
of management override of controls). Responses to inquiries may provide a basis for the auditor
to modify or perform additional audit procedures. Evaluating responses to inquiries is an integral
part of the inquiry process.
A64. Inquiries of knowledgeable persons outside the entity do not meet the definition of external
confirmations in accordance with AU-C section 505. However, the responses to inquiries of
persons outside of the entity are considered in accordance with this SAS and may constitute
reliable information to be used as audit evidence.
Inconsistencies in, or Doubts About the Reliability of, Audit Evidence (Ref: par. 10)
A65. Information obtained from different sources may indicate that an individual item of audit
evidence is not reliable, such as when audit evidence obtained from one source is inconsistent with
that obtained from another. This may be the case when, for example, an external confirmation is
inconsistent with the terms of a debt obligation. AU-C section 230, Audit Documentation, includes
a specific documentation requirement if the auditor identifies information that is inconsistent with
the auditor’s final conclusion regarding a significant finding or issue.28
A66. In the case of inquiries about management’s intent, the information available to support
management’s intent may be limited.29 AU-C section 580, Written Representations, provides
guidance about obtaining written representations that address management’s intent. Maintaining
professional skepticism is particularly important when corroborative audit evidence is limited to
inquiry. In such circumstances, it may be helpful to consider the consistency, or lack thereof,
between the information obtained through inquiry and management’s history of carrying out its
stated intentions, management’s stated reasons for choosing a course of action, and management’s
ability to pursue a specific course of action.
28
Paragraph .12 of AU-C section 230, Audit Documentation.
29
Paragraph .A13 of AU-C section 580, Written Representations.
21
A67.
Appendix A — Considerations Regarding the Use of External Information Sources (Ref:

par. A12b)
1. As defined in paragraph 6 of this SAS, an external information source is an external

individual or organization that provides information used by the entity in preparing the
financial statements or that has been obtained by the auditor as audit evidence, when such
information is suitable for use by a broad range of users.
2. External information sources may include pricing services, governmental organizations,

central banks, recognized stock exchanges, media, or academic journals. Examples of
information that may be obtained from external information sources include the following:
• Prices and pricing-related data

• Macroeconomic data, such as historical and forecast unemployment rates and
economic growth rates, or census data
• Credit history data
• Industry-specific data, such as an index of reclamation costs for certain extractive
industries or viewership information or ratings used to determine advertising revenue
in the entertainment industry
• Mortality tables used to determine liabilities in the life insurance and pension sectors
• Documents or records on websites or in databases or distributed ledgers
3. As set forth in generally accepted auditing standards, an external individual or organization

cannot, in respect of any particular set of information, be both an external information
source and
• a management’s specialist,
• a service organization, or
• an auditor’s specialist.
4. However, an external individual or organization may, for example, be acting as a

management’s specialist when providing a particular set of information but acting as an
external information source when providing a different set of information. Professional
judgment may be needed to determine whether an external individual or organization is
acting as an external information source or as a management’s specialist with respect to a
particular set of information. The following examples illustrate some of the considerations
that may be used. Each situation may be influenced by individual facts and circumstances:
• An external individual or organization may be providing information about real estate

prices that is suitable for use by a broad range of users, for example, information made
generally available pertaining to a geographical region, and determined to be an
22
external information source with respect to that set of information. The same external
organization may also be acting as a management’s or auditor’s specialist in providing
commissioned valuations, with respect to the entity’s real estate portfolio specifically
tailored for the entity’s facts and circumstances.
• Some actuarial organizations publish mortality tables for general use that, when used
by an entity, would generally be considered to be information from an external
information source. The same actuarial organization may also be a management’s
specialist with respect to different information tailored to the specific circumstances of
the entity to help management determine the pension liability for several of the entity’s
pension plans.
• An external individual or organization may possess expertise in the application of
models to estimate the fair value of securities for which there is no observable market.
If the external individual or organization applies that expertise in making an estimate
specifically for the entity and that work is used by management in preparing its
financial statements, the external individual or organization is likely to be a
management’s specialist with respect to that information. If, on the other hand, that
external individual or organization merely provides, to the public, prices or pricing-
related data regarding private transactions, and the entity uses that information in its
own estimation methods, the external individual or organization is likely to be an
external information source with respect to such information.
• An external individual or organization may publish information, suitable for a broad
range of users, about risks or conditions in an industry. If used by an entity in preparing
its risk disclosures (for example, in compliance with FASB Accounting Standards
Codification 275, Risk and Uncertainties), such information would ordinarily be
considered to be information from an external information source. However, if the
same type of information has been specifically commissioned by the entity to use its
expertise to develop information about those risks, tailored to the entity’s
circumstances, the external individual or organization is likely to be acting as a
management’s specialist.
• An external individual or organization may apply its expertise in providing information
about current and future market trends, which it makes available to, and is suitable for
use by, a broad range of users. If used by the entity to help make decisions about
assumptions to be used in making accounting estimates, such information is likely to
be considered to be information from an external information source. If the same type
of information has been commissioned by the entity to address current and future trends
relevant to the entity’s specific facts and circumstances, the external individual or
organization is likely to be acting as a management’s specialist.
5. The auditor is required by paragraph 7 of this SAS to take into account the relevance and
reliability of information to be used as audit evidence regardless of whether that
information has been used by the entity in preparing the financial statements or was
obtained by the auditor. For information obtained from an external information source, that
consideration may, in certain cases, include
• information about the external information source,

23
• details about the preparation of the information by the external information source, or
• audit evidence obtained through designing and performing further audit procedures in
accordance with AU-C section 330, Performing Audit Procedures in Response to
Assessed Risks and Evaluating the Audit Evidence Obtained, or, where applicable, AU-
C section 540, Auditing Accounting Estimates, Including Fair Value Accounting
Estimates, and Related Disclosures.
6. Obtaining an understanding of why management or, when applicable, a management’s

specialist uses an external information source, and how the relevance and reliability of the
information was taken into account (including its accuracy and completeness), may help
inform the auditor's consideration of relevance and reliability of that information.
7. The following factors may be important when taking into account the relevance and
reliability of information obtained from an external information source, including its
accuracy and completeness. Some of these factors may only be relevant when the
information has been used by management in preparing the financial statements or has been
obtained by the auditor:
• The nature and authority of the external information source (for example, a central bank
or government statistics office with a legislative mandate to provide industry
information to the public may be considered a reliable external information source for
certain types of information.)
• The ability of management to influence the information obtained, through relationships
between the entity and the external information source
• The competence and reputation of the external information source with respect to the
information, including whether, in the auditor’s professional judgment, the information
is routinely provided by an external information source with a track record of providing
reliable information
• Past experience of the auditor with the reliability of the information provided by the
external information source
• Evidence of general market acceptance by users of the relevance or reliability of
information from an external information source for a similar purpose to that for which
the information has been used by management or the auditor
• Whether the entity has in place controls to address the relevance and reliability of the
information obtained and used
• Whether the external information source accumulates overall market information or
engages directly in “setting” market transactions
• Whether the information is suitable for use in the manner in which it is being used and,
if applicable, was developed taking into account the applicable financial reporting
framework
• Alternative information that may contradict the information used
• The nature and extent of disclaimers or other restrictive language relating to the
24
information obtained1
• Information about the methods used in preparing the information; how the methods are
being applied including, where applicable, how models have been used in such
application; and the controls over the methods
• When available, information relevant to considering the appropriateness of
assumptions and other data applied by the external information sources in developing
the information obtained
8. The nature and extent of the auditor’s consideration takes into account the assessed risks
of material misstatement at the assertion level to which the use of the external information
is relevant, the degree to which the use of that information is relevant to the reasons for the
assessed risks of material misstatement, and the possibility that the information from the
external information source may not be reliable (for example, whether it is from a credible
source). Based on the auditor’s consideration of the matters described in paragraph 5 of
this appendix, the auditor may determine that
a. further understanding of the entity and its environment, including its internal
control, is needed, in accordance with AU-C section 315, Understanding the Entity
and Its Environment and Assessing the Risks of Material Misstatement, or
b. further audit procedures, in accordance with AU-C section 3302 and AU-C section
540,3 when applicable, are appropriate in the circumstances, to respond to the
assessed risks of material misstatement at the assertion level related to the use of
information from an external information source. Such audit procedures may
include the following:
i. Performing a comparison of information obtained from the external

information source with information obtained from an alternative
independent information source
ii. When relevant to considering management’s use of an external information
source, obtaining an understanding of controls management has in place to
consider the reliability of the information from external information sources
and potentially testing the operating effectiveness of such controls
iii. Performing procedures to obtain information from the external information
source to understand its processes, techniques, and assumptions, for the
purposes of identifying, understanding, and when relevant, testing the
operating effectiveness of its controls
1
Paragraphs .A56–.A62 of AU-C section 501, Audit Evidence — Specific Considerations for Selected Items.
2
Paragraph .06 of AU-C section 330, Performing Audit Procedures in Response to Assessed Risks and
Evaluating the Audit Evidence Obtained.
3
Paragraphs .12–.14 of AU-C section 540, Auditing Accounting Estimates, Including Fair Value Accounting
Estimates, and Related Disclosures.
25
9. When the auditor does not have a sufficient basis upon which to consider the relevance and
reliability of information from an external information source, the auditor may have a
limitation on scope if sufficient appropriate audit evidence cannot be obtained through
alternative procedures. Any imposed limitation on scope is evaluated in accordance with
the requirements of AU-C section 705, Modifications to the Opinion in the Independent
Auditor’s Report.
26
A68.
Appendix B — Amendments to Various Sections in Statement on Auditing Standards No.

122, Statements on Auditing Standards: Clarification and Recodification, as Amended
(Boldface italics denote new language. Deleted text is shown in strikethrough.)
1. The amendment to each section in this appendix is effective for audits of financial statements
for periods ending on or after December 15, 2022.
AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of
an Audit in Accordance With Generally Accepted Auditing Standards
[No amendment to paragraphs .01–.13.]
Definitions
.14 For purposes of GAAS, the following terms have the meanings attributed as
follows:
Audit evidence. Information used by the auditor in arriving at the conclusions on which
the auditor’s opinion is based. Audit evidence includes both information contained in
the accounting records underlying the financial statements and other information.
Sufficiency of audit evidence is the measure of the quantity of audit evidence. The
quantity of theaudit evidence necessary needed is affected by the auditor’s assessment
of the risks of material misstatement . and also by the quality of such audit evidence.
Appropriateness of audit evidence is the measure of that is, its relevance and reliability
in providing support for the conclusions on which the auditor’s opinion is based.
Sufficient Appropriate Audit Evidence and Audit Risk
.19 To obtain reasonable assurance, the auditor should obtain sufficient appropriate audit
evidencefn 4 to reduce audit risk to an acceptably low level and thereby enable the auditor
to draw reasonable conclusions on which to base the auditor’s opinion. (Ref: par. .A32–
.A56)
fn 4
See paragraph .06 of AU-C section 500, Audit Evidence, for the definition of audit evidence.
[Subsequent footnotes renumbered.]
[No amendment to paragraphs .20–.A26. Paragraph .A26 included for contextual

purposes only.]
27
…
.A26 The auditor neither assumes that management is dishonest nor assumes
unquestioned honesty. The auditor cannot be expected to disregard past experience of the
honesty and integrity of the entity’s management and those charged with governance.
Nevertheless, a belief that management and those charged with governance are honest and
have integrity does not relieve the auditor of the need to maintain professional skepticism
or allow the auditor to be satisfied with less than persuasive audit evidence when obtaining
reasonable assurance.
.A27 Unconscious or conscious auditor biases may affect the auditor’s professional
skepticism and professional judgment, including, for example, in the design and
performance of audit procedures or the evaluation of audit evidence. Examples of
unconscious auditor biases that may impede the maintenance of professional skepticism
and, therefore, the reasonableness of the professional judgments made by the auditor in
complying with the requirements of this SAS, may include the following:
• Availability bias, which is a tendency to place more weight on events or

experiences that immediately come to mind or are readily available than on those
that are not
• Confirmation bias, which is a tendency to place more weight on information that
corroborates an existing belief than information that contradicts or casts doubt
on that belief
• Overconfidence bias, which is a tendency to overestimate one's own ability to
make accurate assessments of risk or other judgments or decisions
• Anchoring bias, which is a tendency to use an initial piece of information as an
anchor against which subsequent information is inadequately assessed
• Automation bias, which is a tendency to favor output generated from automated
systems, even when human reasoning or contradictory information raises
questions about whether such output is reliable or fit for purpose
[Paragraphs .A27–.A86 have been renumbered.]
[No amendment to paragraphs .A27–.A75.]
.A76 The auditor is required by paragraph .23b to use the objectives stated in the
relevant AU-C sections to evaluate whether sufficient appropriate audit evidence has
been obtained in the context of the overall objectives of the auditor. If, as a result, the
auditor concludes that sufficient appropriate the audit evidence has not been obtained is
not sufficient and appropriate, then the auditor may follow one or more of the following
approaches to meeting the requirement of paragraph .23b:
28
• Evaluate whether further relevant audit evidence has been, or will be, obtained
as a result of complying with other AU-C sections, in particular, AU-C section
330.
• Extend the work performed in applying one or more requirements.
• Perform other procedures judged by the auditor to be necessary in the
circumstances.
When none of the preceding is expected to be practical or possible in the circumstances,

the auditor will not be able to obtain sufficient appropriate audit evidence and is required
by GAAS to determine the effect on the auditor’s report or on the auditor’s ability to
complete the engagement.
[No further amendment to AU-C section 200.]
AU-C Section 230, Audit Documentation
.06 For purposes of GAAS, the following terms have the meanings attributed as follows:
Audit documentation. The record of audit procedures performed, relevant audit

evidence obtained, and conclusions the auditor reached (terms such as working
papers or workpapers are also sometimes used)…
AU-C Section 315, Understanding the Entity and Its Environment and Assessing the
Risks of Material Misstatement
[No amendment to paragraphs .01–.A80.]
.A81 Audit evidence for elements of the control environment. Relevant aAudit evidence
related to elements of the control environment may be obtained through a combination of
inquiries and other risk assessment procedures, such as corroborating inquiries through
observation or inspection of documents. For example, through inquiries of management
and employees, the auditor may obtain an understanding of how management
communicates to employees management’s views on business practices and ethical
behavior. The auditor may then determine whether relevant controls have been
implemented by considering, for example, whether management has a written code of
conduct and whether it acts in a manner that supports the code.
29
AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and
Evaluating the Audit Evidence Obtained
.06 The auditor should design and perform further audit procedures whose nature, timing,
and extent are based on, and are responsive to, the assessed risks of material misstatement
at the assertion level and in a manner that is not biased towards obtaining audit evidence
that may be corroborative or towards excluding audit evidence that may be contradictory.
When evaluating audit evidence with respect to the assessed risks of material
misstatement, the auditor maintains professional skepticism, including when
considering information that may be used as audit evidence and what procedures would
be appropriate in the circumstances.
.28 The auditor should conclude whether sufficient appropriate audit evidence has
been obtained. In forming a conclusion, the auditor should consider all relevant audit
evidence, regardless of whether it appears to corroborate or contradict the assertions in the
financial statements.
[No amendment to paragraphs .29–.A47.]
.A48 The nature of the risk and assertion is relevant to the design of tests of details. For
example, tests of details related to the existence or occurrence assertion may involve
selecting from items contained in a financial statement amount and obtaining relevant
audit evidence. On the other hand, tests of details related to the completeness assertion
may involve selecting from items that are expected to be included in the relevant
financial statement amount and investigating whether they are included. For example, the
auditor might inspect subsequent cash disbursements and compare them with the
recorded accounts payable to determine whether any purchases had been omitted from
accounts payable.
.A51 External confirmation procedures frequently may be relevant when addressing

assertions associated with account balances and their elements but need not be restricted
to these items. For example, the auditor may request external confirmation of the terms of
agreements, contracts, or transactions between an entity and other parties. External
confirmation procedures also may be performed to obtain audit evidence about the
30
absence of certain conditions. For example, a request may specifically seek confirmation
that no "side agreement" exists that may be relevant to an entity’s revenue cut-off
assertion. Other situations in which external confirmation procedures may provide
relevant audit evidence in responding to assessed risks of material misstatement include
the following:
• Bank balances and other information relevant to banking relationships

• Inventories held by third parties at bonded warehouses for processing or on
consignment
• Property title deeds held by lawyers or financiers for safe custody or as security
• Investments held for safekeeping by third parties or purchased from
stockbrokers but not delivered at the balance sheet date
• Amounts due to lenders, including relevant terms of repayment and restrictive
covenants
• Accounts payable balances and terms
.A52 Although external confirmations may provide relevant audit evidence relating to
certain assertions, some assertions exist for which external confirmations provide less
persuasive audit evidence, for example, external confirmations provide less persuasive
audit evidence relating to the recoverability of accounts receivable balances than they do
of their existence.
.A59 Audit evidence in the form of external confirmations received directly by the
auditor from appropriate confirming parties may assist the auditor in obtaining audit
evidence with the high level of reliability that the auditor requires to respond to significant
risks of material misstatement, whether due to fraud or error. For example, if the auditor
identifies that management is under pressure to meet earnings expectations, a risk may
exist that management is inflating sales by improperly recognizing revenue related to sales
agreements with terms that preclude revenue recognition or by invoicing sales before
shipment. In these circumstances, the auditor may, for example, design external
confirmation procedures not only to confirm outstanding amounts but also to confirm the
details of the sales agreements, including date, any rights of return, and delivery terms. In
addition, the auditor may find it effective to supplement such external confirmation
procedures with inquiries of nonfinancial personnel in the entity regarding any changes in
sales agreements and delivery terms.
.A66 An effective test provides appropriate audit evidence to the extent that it will be
sufficient for the auditor’s purpose when taken with other audit evidence obtained or to be
obtained. In selecting items for testing, the auditor is required by AU-C section 500 to
consider determine the relevance and reliability of information to be used as audit
31
evidence;fn12 the other aspect of effectiveness (sufficiencyextent) is an important
consideration in selecting items to test. The means available to the auditor for selecting
items for testing are
a. selecting all items (100 percent examination),
b. selecting specific items, and
c. audit sampling.
fn 12
[Footnote omitted for purposes of this SAS.]
.A75 By performing audit procedures, the auditor may determine that the accounting
records are internally consistent and agree to the financial statements. However,
accounting records alone do not provide sufficient appropriate audit evidence on which
to base an audit opinion on the financial statements.
[Paragraph .A75 is renumbered as .A76.]
.A76A77 The auditor’s conclusion of whether sufficient appropriate audit evidence

has been obtained is both at the relevant assertion level as well as the financial
statement level. AU-C section 500 enables the auditor to evaluate the results of audit
procedures to inform the auditor’s overall conclusion about whether sufficient
appropriate audit evidence has been obtained as required by paragraph .28. The
auditor’s professional judgment about what constitutes sufficient appropriate audit
evidence is influenced by the following additional such factors: as the
• Ssignificance of the potential misstatement in the relevant assertion and the

likelihood of its having a material effect, individually or aggregated with other
potential misstatements, on the financial statements (see section 450, Evaluation
of Misstatements Identified During the Audit).
• Eeffectiveness of management’s responses and controls to address the risks.
• Eexperience gained during previous audits with respect to similar potential

misstatements.
• Whether the audit procedures that were performed identified specific instances of
fraud or error.
• source and reliability of the available information.
• persuasiveness of the audit evidence.
• Uunderstanding of the entity and its environment, including its internal control.
32
[Paragraph .A76 is renumbered as .A77.]
AU-C Section 501, Audit Evidence — Specific Considerations for Selected Items
NOTE
Although SAS No. 142 supersedes SAS No. 122, as amended, AU-C section 500
(codified as AU-C section 500A in AICPA Professional Standards until the effective
date of SAS No. 142), SAS No. 142 transfers the management’s specialist content from
AU-C section 500A to AU-C section 501.
The following paragraphs have been transferred from AU-C section 500A to AU-C
section 501 and revised, as necessary:
1. Paragraph .05, definition of management’s specialist
2. Paragraphs .08, under the “Information to Be Used as Audit Evidence” heading, and
corresponding application paragraphs .A35–.A49
Scope of This Section
.01 This section addresses specific considerations by the auditor in obtaining sufficient
appropriate audit evidence, in accordance with section 330, Performing Audit
Procedures in Response to Assessed Risks and Evaluating the Audit Evidence
Obtained; section 500, Audit Evidence; and other relevant AU-C sections,
regarding certain aspects of (a) investments in securities and derivative
instruments; (b) inventory; (c) litigation, claims, and assessments involving the
entity; and (d) segment information in an audit of financial statements; and (e)
use of management’s specialists.
[No amendment to paragraph .02.]
Objective
.03 The objective of the auditor is to obtain sufficient appropriate audit evidence
regarding the
a. valuation of investments in securities and derivative instruments;
b. existence and condition of inventory;
c. completeness of litigation, claims, and assessments involving the entity;

and
33
d. presentation and disclosure of segment information, in accordance with
the applicable financial reporting framework; and
e. use of management’s specialists.
Definition
.04 For purposes of GAAS, the following term has the meaning attributed as follows:
Management’s specialist. An individual or organization possessing expertise

in a field other than accounting or auditing, whose work in that field is
used by the entity to assist the entity in preparing the financial
statements.
[Subsequent paragraphs renumbered. No amendment to paragraphs .05–.25.]
Use of Management’s Specialists
.26 If information to be used as audit evidence has been prepared using the work of a
management’s specialist, the auditor should, to the extent necessary, taking into
account the significance of that specialist’s work for the auditor’s purposes (Ref:
par. .A69–.A71)
a. evaluate the competence, capabilities, and objectivity of that specialist; (Ref:

par. .A72–.A78)
b. obtain an understanding of the work of that specialist; and (Ref: par. .A79–
.A82)
c. evaluate the appropriateness of that specialist’s work as audit evidence for

the relevant assertion. (Ref: par. .A83)
Use of Management’s Specialists (Ref: par. .26)
.A69 The preparation of an entity’s financial statements may require expertise in a

field other than accounting or auditing, such as actuarial calculations, valuations, or
engineering data. The entity uses a management’s specialist in these fields to obtain
the needed expertise to prepare the financial statements. Failure to do so when such
34
expertise is necessary increases the risks of material misstatement and may be a
significant deficiency or material weakness. fn 12
.A70 When information to be used as audit evidence has been prepared using the
work of a management’s specialist, the requirement in paragraph .26 applies. For
example, an individual or organization may possess expertise in the application of
models to estimate the fair value of securities for which no observable market exists. If
the individual or organization applies that expertise in making an estimate, which the
entity uses in preparing its financial statements, the individual or organization is a
management’s specialist, and paragraph .26 applies. If, on the other hand, that
individual or organization merely provides price data regarding private transactions
not otherwise available to the entity, which the entity uses in its own estimation
methods, such information, if used as audit evidence, is subject to paragraph .07 of
section 500, but it is not the use of a management’s specialist by the entity.
.A71 The nature, timing, and extent of audit procedures with regard to the
requirement in paragraph .26 may be affected by such matters as the following:
• The nature and complexity of the matter to which the management’s

specialist relates
• The risks of material misstatement of the matter
• The availability of alternative sources of audit evidence
• The nature, scope, and objectives of the work of the management’s

specialist
• Whether the management’s specialist is employed by the entity or is a party

engaged by it to provide relevant services
• The extent to which management can exercise control or influence over the
work of the management’s specialist
• Whether the management’s specialist is subject to technical performance

standards or other professional or industry requirements
fn 12
See section 265, Communicating Internal Control Related Matters Identified in an Audit, for further guidance.
35
• The nature and extent of any controls within the entity over the work of the
management’s specialist
• The auditor’s knowledge and experience of the field of expertise of

• The auditor’s previous experience of the work of that specialist
The Competence, Capabilities, and Objectivity of a Management’s Specialist (Ref: par.

.26a)
.A72 Competence relates to the nature and level of expertise of the management’s
specialist. Capability relates to the ability of the management’s specialist to exercise
that competence in the circumstances. Factors that influence capability may include,
for example, geographic location and the availability of time and resources. Objectivity
relates to the possible effects that bias, conflict of interest, or the influence of others
may have on the professional or business judgment of the management’s specialist.
The competence, capabilities, and objectivity of a management’s specialist, and any
controls within the entity over that specialist’s work, are important factors with regard
to the reliability of any information produced by a management’s specialist.
.A73 Information regarding the competence, capabilities, and objectivity of a

management’s specialist may come from a variety of sources, such as the following:
• Personal experience with previous work of that specialist
• Discussions with that specialist
• Discussions with others who are familiar with that specialist’s work
• Knowledge of that specialist’s qualifications, membership in a professional

body or industry association, license to practice, or other forms of external
recognition
• Published papers or books written by that specialist
• An auditor’s specialist, if any, that assists the auditor in obtaining sufficient

appropriate audit evidence with respect to information produced by the
.A74 Matters relevant to evaluating the competence, capabilities, and objectivity of a

management’s specialist include whether that specialist’s work is subject to technical
performance standards or other professional or industry requirements, for example,
ethical standards and other membership requirements of a professional body or
industry association, accreditation standards of a licensing body, or requirements
imposed by law or regulation.
36
.A75 Other matters that may be relevant include the following:
• The relevance of the capabilities and competence of the management’s

specialist to the matter for which that specialist’s work will be used,
including any areas of specialty within that specialist’s field. For example, a
particular actuary may specialize in property and casualty insurance but
have limited expertise regarding pension calculations
• The competence of the management’s specialist with respect to relevant

accounting requirements, for example, knowledge of assumptions and
methods, including models, when applicable, that are consistent with the
applicable financial reporting framework
• Whether unexpected events, changes in conditions, or the audit evidence

obtained from the results of audit procedures indicate that it may be
necessary to reconsider the initial evaluation of the competence,
capabilities, and objectivity of the management’s specialist as the audit
progresses
.A76 A broad range of circumstances may threaten objectivity, for example, self-
interest threats, advocacy threats, familiarity threats, self-review threats, and
intimidation threats. Safeguards may reduce such threats and may be created either by
external structures (for example, the profession, legislation, or regulation of the
management’s specialist) or by the work of the management’s specialist’s environment
(for example, quality control policies and procedures).
.A77 Although safeguards cannot eliminate all threats to the objectivity of a

management’s specialist, threats such as intimidation threats may be of less
significance to a specialist engaged by the entity than to a specialist employed by the
entity, and the effectiveness of safeguards such as quality control policies and
procedures may be greater. Because the threat to objectivity created by being an
employee of the entity will always be present, a specialist employed by the entity cannot
ordinarily be regarded as being more likely to be objective than other employees of the
entity.
.A78 When evaluating the objectivity of a specialist engaged by the entity, it may be
relevant to discuss with management and that specialist any interests and relationships
that may create threats to the specialist’s objectivity and any applicable safeguards,
including any professional requirements that apply to the specialist, and to evaluate
whether the safeguards are adequate. Interests and relationships creating threats may
include the following:
• Financial interests
• Business and personal relationships
• Provision of other services
37
Obtaining an Understanding of the Work of the Management’s Specialist (Ref: par.
.26b)
.A79 An understanding of the work of the management’s specialist includes an

understanding of the relevant field of expertise. An understanding of the relevant field
of expertise may be obtained in conjunction with the auditor’s determination of
whether the auditor has the expertise to evaluate the work of the management’s
specialist or whether the auditor needs an auditor’s specialist for this purpose. fn 13
.A80 Aspects of the field of the management’s specialist relevant to the auditor’s
understanding may include
• whether that specialist’s field has areas of specialty within it that are
relevant to the audit.
• whether any professional or other standards and regulatory or legal

requirements apply.
• what assumptions and methods are used by the management’s specialist and
whether they are generally accepted within that specialist’s field and
appropriate for financial reporting purposes.
• the nature of internal and external data or information the management’s

specialist uses.
.A81 In the case of a management’s specialist engaged by the entity, there will
ordinarily be an engagement letter or other written form of agreement between the
entity and that specialist. Evaluating that agreement when obtaining an understanding
of the work of the management’s specialist may assist the auditor in determining for
the auditor’s purposes the appropriateness of
• the nature, scope, and objectives of that specialist’s work;
• the respective roles and responsibilities of management and that specialist;

and
• the nature, timing, and extent of communication between management and

that specialist, including the form of any report to be provided by that
specialist.
fn 13
Paragraph .07 of section 620, Using the Work of an Auditor’s Specialist.
38
.A82 In the case of a management’s specialist employed by the entity, it is less likely
that there will be a written agreement of this kind. Inquiry of the specialist and other
members of management may be the most appropriate way for the auditor to obtain the
necessary understanding.
Evaluating the Appropriateness of the Work of the Management’s Specialist (Ref: par.
.26c)
.A83 Considerations when evaluating the appropriateness of the work of the

management’s specialist as audit evidence for the relevant assertion may include
• the relevance and reasonableness of that specialist’s findings or

conclusions, their consistency with other audit evidence, and whether they
have been appropriately reflected in the financial statements;
• if that specialist’s work involves use of significant assumptions and

methods, the relevance and reasonableness of those assumptions and
methods; and
• if that specialist’s work involves significant use of source data, the

relevance, completeness, and accuracy of that source data.
AU-C Section 530, Audit Sampling
[No amendment to paragraph .01. Footnote intentionally omitted.]
.02 This section complements section 500, Audit Evidence, which addresses the auditor’s
responsibility to design and perform audit procedures to obtain explains what constitutes
sufficient appropriate audit evidence and addresses how an auditor evaluates
information to be used as audit evidence.to be able to draw reasonable conclusions as a
basis for forming the auditor’s opinion. Section 330, Performing Audit Procedures in
Response to Assessed Risks and Evaluating the Audit Evidence Obtained, provides
guidance on the means available to the auditor for selecting items for testing, one of
which is audit sampling.
AU-C Section 540, Auditing Accounting Estimates, Including Fair Value Accounting
Estimates, and Related Disclosures
[No amendment to paragraphs .01–.A27. Paragraph .A28 shown for contextual purposes.]
39
Management’s Use of Specialists fn 11 (Ref: par. .08c(iii))
.A28 Management may have, or the entity may employ individuals with, the experience
and competence necessary to make estimates. In some cases, however, management may
need to engage a specialist to make estimates or assist in making them. This need may
arise because of, for example,
• the specialized nature of the matter requiring estimation (for example, the
measurement of mineral or hydrocarbon reserves in extractive industries).
• the technical nature of the models required to meet the relevant requirements
of the applicable financial reporting framework, as may be the case in certain
measurements at fair value.
• the unusual or infrequent nature of the condition, transaction, or event

requiring an accounting estimate.
See AU-C section 501, Audit Evidence — Specific Considerations for Selected Items. See Paragraph
fn 11
.08 of section 500, Audit Evidence, which addresses management’s specialists.
.A70 In accordance with AU-C section 500, Audit Evidence, the auditor is required to
evaluate information to be used as audit evidence by taking into account, among other
things, the relevance and reliability of the information, including its source. The
auditor’s evaluation of such information to be used as audit evidence is required to
include evaluating whether the information is sufficiently precise and detailed for the
auditor’s purposes and obtaining audit evidence about the accuracy and completeness
of the information, as necessary. fn 18
evaluate whether the data on which the estimate is based is sufficiently reliable for the
auditor’s purposes, including, as necessary.
a. obtaining audit evidence about the accuracy and completeness of the data.
b. evaluating whether the data is sufficiently precise and detailed for the
auditor’s purposes.
fn 18
Paragraphs .09 .07 and .08 of section 500.
40
A69.
Exhibit A — Using ADAs to Simultaneously Accomplish Multiple Audit Procedures (Ref:

par. A46 and par. A61)
This exhibit illustrates the use of an audit data analytic (ADA) that simultaneously accomplishes
the objectives of both risk assessment and substantive audit procedures.
Background
The fact pattern in this example, in which the auditor uses a revenue transaction scoring model,
will focus on the audit of an entity that recognizes revenue when control of the product (or
satisfaction of the performance obligation) transfers at a specific point in time,1 such as a
manufacturer of external data storage devices.
For purposes of this example, assume the following:
• Revenue was determined to be a material account during initial planning and scoping
with the occurrence (including cut-off) and accuracy assertions being more susceptible
to misstatement.
• The ADA was performed after initial planning and scoping as part of the ongoing and
iterative risk assessment process.
• All transactions within the account were subject to the same processes and controls.
• The purpose of the ADA was to design the nature, timing, and extent of the audit
procedures and to obtain audit evidence.
• Based on the understanding of controls, the auditor has concluded that the controls over
revenue were effectively designed and have been implemented, the auditor has tested
certain relevant controls and determined they are operating effectively, and the auditor
is otherwise satisfied the entity has appropriately applied the requirements of the
applicable financial reporting framework (for example, FASB Accounting Standards
Codification (ASC) 606, Revenue from Contracts with Customers).
• Data used in the ADA are relevant and reliable and have been tested for accuracy and
completeness.
• Customers tend to purchase consistent quantities throughout the year, with the
exception of purchases just prior to major retail holidays, such as Memorial Day, Black
1
FASB Accounting Standards Codification 606-10-25-30.
41
Friday, and Christmas.
• Some customers only purchase in bulk a few times a year, but most customers
consistently purchase quantities one to two times a month.
• The customer base does not fluctuate significantly from period to period.
• Revenue is recognized when control transfers at a free-on-board (FOB) shipping point.
• Invoicing occurs the day the product ships from the entity’s warehouse.
• Warehouse personnel typically do not work weekends.
• The company does not sell product to any related parties.
All items that are determined to be individually material were excluded from the ADA and
substantively tested separately. The remaining population that was subject to the ADA
comprised routine, non-complex transactions with third parties. The processing and recording of
transactions are highly automated and less likely to be susceptible to management override.
Description of the ADA
ADA Scoring Model — A complete population of transactions (at the individual item level) for
one material account (excluding individually significant items) was subjected to an ADA designed
to identify and assess risk and obtain audit evidence specific to a relevant assertion using different
routines. The scoring of each routine is based on the evidence expected to be provided by that
routine in relation to the auditor’s assessment of the risks of material misstatement.
The routines were as follows:
42
Transaction
Risk
Routine Description Characteristic Scoring Relevant Fact Pattern
Score
Model
Some customers only purchase in bulk a few times a
Less than 6
2 year, but most customers consistently purchase
Identify customers transactions
quantities one to two times a month.
with infrequent
6–12 Some customers only purchase in bulk a few times a
1 revenue activity Volume
1 year, whereas others purchase smaller quantities one
(less than X transactions to two times a month.
transactions)
More than 12
0
transactions
Customers tend to purchase consistent quantities
Identify customers
Greater than throughout the year, with the exception of purchases
with a significant 2
70% variance just prior to major retail holidays, such as Memorial
fluctuation in
Day, Black Friday, and Christmas.
volume of
2 Volume Some customers only purchase in bulk a few times a
products 30% to 70%
1 year, but most customers consistently purchase
purchased (item variance
quantities one to two times a month.
level) on a period-
Less than 30%
over-period basis 0
variance
Customer for 6 The customer base does not fluctuate significantly
1
months or less from period to period.
Identify activity
3 Volume Customer for
for new customers
greater than 6 0
months
Identify all Within 3 days Revenue is recognized when control transfers at
1
transactions of quarter end FOB shipping point.
4 recorded within X Timing Greater than 3
days of quarter- days of quarter 0
end. end
Identify revenue Invoicing occurs the day the product ships from the
Transaction on
5 transactions with Timing 2 company’s warehouse.
a
an invoice date on
43
Transaction
Risk
Routine Description Characteristic Scoring Relevant Fact Pattern
Score
Model
an unusual date weekend/holid Warehouse personnel typically do not work
(for example, ay weekends.
weekend or Transaction on
holiday) 0
a weekday
Invoice and
shipping
document do
Revenue is recognized when control transfers at
not match, and 4
FOB shipping point.
invoice date is
before
shipping date.
Identify instances
Invoice and
in which the
shipping
6 shipping document Timing
document do
date and invoice Invoicing occurs the day the product ships from the
not match, and 2
date do not match. company’s warehouse.
shipping date
is before
invoice date.
Invoice and
shipping
0
document
match.
44
Running the revenue transaction level detail through the ADA routines produces a total score for
each transaction. The auditor then groups each transaction into a sub-population based on the
individual transaction score. The number of sub-populations may differ depending upon the type
of ADA developed, the scores produced by the ADA, and the auditor’s assessment of those scores.
For purposes of this example, the auditor grouped the population of the account into sub-
populations as follows:
Assessed Risk Total Risk Score

Group
High risk 8–12 A
Moderate risk 4–7 B
Low risk 0–3 C
• Group A – High risk - Comprises items with characteristics deemed to present a higher risk of
material misstatement.
Approach - The auditor would perform additional substantive procedures to provide more
persuasive audit evidence for the items identified by the ADA. For example, the nature of the
substantive procedure may be confirmation as opposed to inspection; the extent of testing may
be greater (larger proportionate sample size); or the timing of the procedure may be at or near
the financial statement date as opposed to earlier in the period.
• Group B – Moderate risk - Comprises items that warrant further procedures but do not have
characteristics of those in the higher risk group.
Approach - The auditor would perform substantive procedures appropriate for the items
identified by the ADA in less depth relative to the higher risk population. For example, the
nature of the substantive procedure may be limited to inspection of documents and records; the
extent of testing may be less (smaller proportionate sample size); and the timing of the
procedure may be earlier in the period.
• Group C – Low risk - Comprises items that demonstrate no unusual characteristics based on
the procedure performed using the ADA.
Approach - The results of other audit procedures performed throughout the audit would be
evaluated for contradictory information regarding the assessed risk of material misstatement.
45
In the absence of contradictory information, as the routines of the ADA are sufficiently
precise for the auditor to conclude that the risks of material misstatement have been
addressed, no additional substantive procedures may be warranted for any reason other than
to incorporate an element of unpredictability in the selection of auditing procedures to be
performed from year to year.
As a result of the previous procedures, the auditor concluded

• Groups A, B, and C comprise a material account in the aggregate for which each group
has differing risks.
• for Group C, the audit evidence provided over the transactions (within the population
analyzed by the ADA in combination with the audit evidence provided by testing of
certain key controls over revenue as determined by the auditor and the absence of
contradictory audit evidence from the testing of related accounts) was sufficiently
persuasive for the auditor to conclude that the risk of material misstatement was
addressed.
• for Groups A and B, the audit evidence provided by the ADA was not sufficiently
persuasive, and further substantive procedures were required to address the risk of
material misstatement.
46

Statement On Auditing Standards 142: Audit Evidence

Uploaded by

Copyright:

Available Formats

Statement On Auditing Standards 142: Audit Evidence

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Statement On Auditing Standards 142: Audit Evidence

Uploaded by

Copyright:

Available Formats

Statement on July 2020

Auditing Standards 142

Issued by the Auditing Standards Board

• SAS No. 122, as amended

Robert Dohrer Hiram Hasty

Appendix A — Considerations Regarding the Use of External Information

Audit Procedures as a Basis for Concluding on the Sufficiency and Appropriateness of

Inconsistencies in, or Doubts About the Reliability of, Audit Evidence

Application and Other Explanatory Material

Definitions (Ref: par. 6)

Sufficient Appropriate Audit Evidence

Evaluating Information to Be Used as Audit Evidence (Ref: par. 7–8)

• oral information obtained through a verbal response to an inquiry of management or

• electronic information, which includes

— documents obtained in electronic documentary form (for example, a scanned version

— data stored in the entity’s IT system or obtained electronically from an external

A18. In certain circumstances, the source of information may be a combination of management

Relevance and Reliability

• The classes of transactions, account balances, or disclosures or assertions to which the

• The period of time to which the information relates.

• Inspection of a document constituting a financial instrument, such as a stock, bond, or a

• Susceptibility to management bias

Controls Over Information to Be Used as Audit Evidence

A29. Similarly, when a significant amount of information is electronically initiated, recorded,

• confirming directly with the third party.

• using the work of a specialist to assess the document’s authenticity.23

Susceptibility to Management Bias

a. The ability of the entity to influence the external information source

Corroborative or Contradictory Information (Ref: par. 7b)

Accuracy and Completeness (Ref: par. 8b)

A43. Audit procedures performed on information may include inspection, observation,

a. Risk assessment procedures

A59. Analytical procedures consist of evaluations of financial information through analysis of

Appendix A — Considerations Regarding the Use of External Information Sources (Ref:

1. As defined in paragraph 6 of this SAS, an external information source is an external

2. External information sources may include pricing services, governmental organizations,

• Prices and pricing-related data

• Documents or records on websites or in databases or distributed ledgers

3. As set forth in generally accepted auditing standards, an external individual or organization

4. However, an external individual or organization may, for example, be acting as a

• An external individual or organization may be providing information about real estate

• information about the external information source,

6. Obtaining an understanding of why management or, when applicable, a management’s

i. Performing a comparison of information obtained from the external

Appendix B — Amendments to Various Sections in Statement on Auditing Standards No.

(Boldface italics denote new language. Deleted text is shown in strikethrough.)

[No amendment to paragraphs .01–.13.]

[No amendment to paragraphs .15–.18.]

Sufficient Appropriate Audit Evidence and Audit Risk

[Subsequent footnotes renumbered.]

[No amendment to paragraphs .20–.A26. Paragraph .A26 included for contextual

• Availability bias, which is a tendency to place more weight on events or

[Paragraphs .A27–.A86 have been renumbered.]

[No amendment to paragraphs .A27–.A75.]

When none of the preceding is expected to be practical or possible in the circumstances,

[No further amendment to AU-C section 200.]

AU-C Section 230, Audit Documentation

[No amendment to paragraphs .01–.05.]

Audit documentation. The record of audit procedures performed, relevant audit