ARTICLE ON ISA - 500 AUDIT

ISA 500 - Audit Evidence

In this article, Steve Collings looks at ISA 500 which has been redrafted as part of the IAASB’s ‘Clarity Project’ and considers what constitutes audit evidence and how such evidence should be recorded in an audit file.

ISA 500 stipulates what constitutes audit evidence and lays down the guidance which auditors are required to follow in the design and performance of audit procedures which will allow sufficient appropriate audit evidence to be gathered to give reasonable assurance that the financial statements do not contain a material misstatement. The phrase ‘reasonable assurance’ is a crucial aspect of the auditor’s report because this refers to the fact that the financial statements are not correct in absolute terms simply because of the limitations inherent in an audit. Such limitations are:

• Judgements made on behalf of auditors including risk assessments and materiality as well as judging which tests are appropriate and which tests are not.
  
• It is not practical to test 100% of every item within the financial statements.
  
• Inherent limitations in accounting and internal controls.
  
• Possibilities that client staff and management may not be entirely honest.
  
• Estimates used in the financial statements.
  

It is for the above reasons that auditors ‘express an opinion’ rather than confirm the accounts are completely accurate.

However, auditors cannot use the inherent limitations as an excuse for not performing a full, thorough and efficient audit. I have referred to audit evidence as needing to be ‘sufficient’ and ‘appropriate’. ‘Sufficient’ refers to the quantity, as well as the quality, of the audit evidence. ‘Appropriate’ audit evidence refers to the quality of the audit evidence gathered as well as referring to the relevance and the reliability of the audit evidence gathered. Audit evidence should also be documented sufficiently for quality control reasons so that it can be referred to at a later date as well as for evaluation purposes prior to the issuance of the auditor’s report.

Audit evidence essentially needs to support the opinion given in the auditor’s report and thus it follows that the audit file needs to ‘tell a story’ behind how the auditor has arrived at their audit opinion. Audit firms have been criticised in the past by regulatory bodies because the audit evidence that they have obtained has not been sufficient or appropriate enough to justify the audit opinion. Auditors should therefore ensure that when they design and perform audit procedures, they consider whether those procedures are adequate enough in order to generate sufficient appropriate audit evidence – remember audit procedure and audit evidence are not the same – procedures generate evidence. Auditors should also consider the relevance and reliability of the information to be used as audit evidence.

Sometimes the evidence that the auditor will require is beyond the expertise of the auditor and they will need to rely on the work of an expert. The relevant procedures to be adopted by the auditor where they rely on the work of an expert are discussed further in this article as well as in ISA 620.

Audit evidence can be obtained from other sources outside of the entity being subject to audit. For example, bank confirmations can offer audit evidence concerning the existence of bank accounts at the reporting date and can also offer audit evidence concerning the disclosures made in the financial statements relating to secured debts and the nature of the security. Audit evidence can be positive and negative in nature. For example, audit evidence can serve to corroborate the assertions made by management; conversely, audit evidence can also go to contradict such assertions.

Methods of Obtaining Audit Evidence

Auditors can gather audit evidence using a variety of procedures including:

• Inspection
  
• Observance
  
• External confirmation
  
• Recalculation
  
• Reperformance
  
• Analytical procedures
  
• Inquiry
  

Audit Procedures and the Financial Statement Assertions

The above procedures identified for the purposes of obtaining audit evidence can be linked into the financial statement assertions as shown below. Financial statement assertions are the representations of management that are embodied in the financial statements. By approving the financial statements, management are making representations about the information therein. These representations or assertions may be described as:

• Existence.
  
• Rights and obligations.
  
• Occurrence.
  
• Completeness.
  
• Valuation.
  
• Measurement.
  
• Presentation and disclosure.
  

Inspection of assets that are recorded in the accounting records confirms existence, gives evidence of valuation but does not confirm rights and obligations. Confirmation that assets seen are recorded in accounting records gives evidence of completeness.

Inspection of documentation confirms that an asset exists or a transaction has occurred.

Confirmation that items recorded in accounting records tests completeness. Cutoff can be verified by inspection of reverse population; that is, checking transactions recorded after the reporting date to supporting documentation to confirm that they occurred after the reporting date. Inspection also provides evidence of valuation/measurement, rights and obligations and the nature of items (presentation and disclosure). It can also be used to compare documents and confirm authorisation.

Observation involves watching a procedure being performed (for example an inventory count). This procedure has inherent limitations as it only confirms procedure took place when the auditor was watching.

External confirmations involve seeking information from external sources such as bank audit letters or circularisation of receivables.

Recalculation involves checking the arithmetic accuracy of client’s records.

Reperformance involves reperforming various reconciliations as at the reporting date or at interim periods to check controls have been operating effectively, for example reperforming a bank reconciliation statement.

Analytical procedures consist of comparing items, for example, current year financial information with prior year financial information and analysing predictable relationships such as the relationship of trade receivables with revenue. It can also be used to help identify any unusual trends or characteristics within the financial statements.

Inquiry involves seeking information from client staff or management.

In any audit, it is important that the auditor evaluates whether the audit evidence obtained is sufficiently appropriate. ‘Sufficiency’ and ‘appropriateness’ are interrelated and apply to both tests of controls and substantive testing.

What determines whether audit evidence is sufficient and appropriate will depend on a number of factors, such as:

• The risk assessment.
  
• The nature of the accounting and internal control systems.
  
• Materiality.
  
• The auditor’s experience of previous audits including the auditor’s knowledge of the business and the environment in which it operates.
  
• The results of audit procedures.
  
• The source and reliability of the information available.
  

Practical Illustration – Audit Evidence

Post date events (sometimes referred to as ‘subsequent events’) are those events which occur between the reporting date (period/year end) and the date of the auditor’s report. The auditor’s objective when undertaking a review of post date events is to obtain sufficient appropriate audit evidence to satisfy themselves that all material post date events have been accounted for, and the necessary adjustment or note made in the entity’s financial statements. Audit evidence in this area can be gathered by:

(1) Reviewing the following records for details of any post date events:

(a) cash book

(b) sales day book

(c) purchase day book

(d) journal

(2) Examining minutes of meetings and other correspondence for information relating to subsequent events.

(3) Examining management accounts, budgets and cash flow forecasts prepared for a date after the reporting date.

(4) Reviewing likely risk areas which could give rise to post date events.

(5) Reviewing the register of charges.

(6) Inquiry with management.

(7) Review the bank audit letter for details of any potential post date events.

The auditor will review the evidence gathered and consider those events which have given rise to, or suggest evidence of, post date events and ensure that the post date events have been correctly classified between ‘adjusting’ and ‘non-adjusting’ events per the provisions in IAS 10 ‘Events After the Reporting Date’.

Recurring Audits

It is widely understood that in many cases auditors perform audits for the same audit client from one year to the next. Evidence can sometimes be used from prior year audits, such as where the auditor has undertaken detailed test of controls in the previous year and thus concludes that they can rely on audit evidence gathered in the previous year. Where the auditor places reliance on evidence gained in previous audits, they must ensure that the audit evidence on which they are relying is both relevant and reliable for the purposes of the current year audit. It would not be appropriate for the auditor to rely on audit evidence which is inappropriate for the current year’s audit if it was out of date, for example if the client had undertaken significant changes in various internal controls.

Use of Management Representations as Audit Evidence

Management representations are a common source of audit evidence in the modern auditing profession. The auditor needs to discuss with management and those charged with governance the issues to which they are seeking representation in order to ensure that they know what they are signing. The management representation (frequently referred to as the ‘letter of representation’) should only refer to matters which are material to the financial statements.

Management representations are not to be used as an alternative to gathering sufficient appropriate audit evidence. This is an important concept because where the auditor cannot obtain sufficient appropriate audit evidence then this may constitute a limitation in the scope of an audit for which it may be necessary to consider the implications for the auditor’s report.

The management letter itself should:

• Be addressed to the auditor.
  
• Contain specified information.
  
• Be appropriately dated – usually the same date as the auditor’s report.
  
• Only be approved by those with specific knowledge of the relevant matters.
  

The Use of Experts as Audit Evidence

In many cases, the auditor’s expertise will be limited and therefore it will be necessary to employ someone with different expert knowledge to enable the auditor to gain sufficient appropriate audit evidence. It is important that where the auditor’s experience is limited, that they do employ the work of an expert to ensure that the risk of material misstatement can be reduced to an acceptable level. For example, if an entity operates a defined benefit pension scheme, then actuarial information will be required from the Actuaries. Experts can also be used to:

• Provide specialist advice on a particular matter which affects the financial statements, for example the valuations placed on complex financial instruments, such as derivatives.
  
• Enable the auditors to obtain sufficient appropriate audit evidence concerning certain financial statement assertions.
  

ISA 620 deals with the specific issues concerning the use of an auditor’s expert, but ISA 500 requires the auditor to evaluate the technical competencies of the expert as well as the objectivity of the expert (it is particularly important that the expert is ‘independent’ of the entity). In recognition of this requirement, the auditor should gain an understanding as to the specific matters the expert will undertake and evaluate the appropriateness of the expert’s work to determine whether it is sufficiently reliable. The auditor should also have regard to whether the expert has any financial interest in the entity or whether he has any business or personal relationships or if there are any other circumstances which may affect the independence and objectivity of the expert.

In determining whether the work undertaken by the expert is sufficient and appropriate the auditor should consider the following matters:

• The nature and complexity of the matter which requires the expert.
  
• The expert’s experience and reputation in the field in which the auditor is seeking audit evidence.
  
• The independency and objectivity of the expert – for example is the expert employed by the entity?
  
• The professional qualifications of the expert.
  
• Whether any alternative sources of audit evidence are available.
  
• Whether management have any influence over the performance of the work by the expert or whether they wholly rely on the expert.
  
• The auditor’s previous experience with the work of the expert.
  

Consider an entity which operates a defined benefit pension scheme in the United Kingdom. Defined benefit pension schemes are very difficult to account for because the entity has a commitment to employees to pay a certain level of pension which will usually be based on their final salary and the number of years they have worked for the company.

Such pension schemes in the United Kingdom require the use of actuaries who will calculate the expected liabilities taking into account a certain number of variables, for example the time value of money. Accountants and auditors in the United Kingdom generally do not have the relevant skills and expertise in order to undertake the calculations to determine the expected liabilities in respect of defined benefit pension schemes to be incorporated within an entity’s financial statements. Therefore, the auditor will need to use the work of an expert (the actuary) to provide the actuarial information so that the auditor can gain reasonable assurance that pension fund assets and liabilities and the accounting input has been correctly made.

The illustration concerning a defined benefit scheme highlights the use of assumptions and methods used by actuaries and how auditors should determine the relevance and reliability of such assumptions. Auditors do not have the expertise to judge the assumptions and methods used by the expert; these are the responsibility of the expert. However, the auditors should seek to obtain an understanding of these assumptions to consider their reasonableness based on other audit evidence.

The auditors need to evaluate whether the work of the expert and the evidence gained is sufficient and appropriate. Where the audit evidence from the expert is insufficient and there are no satisfactory alternative sources of evidence, then the auditors should consider the implications for their audit report.

In arriving at their conclusion as to whether the expert’s work is sufficient and appropriate, the auditor needs to take into consideration various factors such as:

• Whether the findings and conclusions reached by the expert are consistent with other sources of audit evidence gained.
  
• Where judgements and assumptions are used (as in the defined benefit pension scheme scenario above), whether these judgements and assumptions are reasonable based on other audit evidence obtained.
  
• Where source data is used, the relevance and completeness of that source data.
  

Selection and Sampling Techniques

A significant method used in gaining sufficient appropriate audit evidence is the use of selection and sampling techniques. ISA 500 suggests three methods of obtaining audit evidence:

• Selecting all items (100% sampling)
  
• Selecting specific items
  
• Audit sampling
  

Selection of all items is only appropriate for certain items. For example, it would be impossible to select 100% testing on sales invoices for a large, multi-national listed entity as clearly this would be uneconomical. 100% selection of all items can be used when there are only a few items which would warrant 100% testing. Other audit procedures such as ‘proof in total’ calculations (often referred to as ‘reasonableness tests’) can also achieve 100% testing such as the recalculation of depreciation charges in the period and comparing the auditor’s outcome to the charges calculated by the client.

The selection of specific items is generally more common in auditing. This involves testing specific items such as high value or key items. Auditors often select high risk items or items material in nature when devising which specific items to test.

It is important to understand that the selection of specific items is not the same as auditsampling, hence the reason why ISA 500 distinguishes audit sampling separately. Sampling is where the auditor applies audit procedures to less than 100% of the population. For example, the auditor may obtain the aged list of receivables at the reporting date. The total amount of receivables shown in the financial statements as ‘trade receivables’ is known as the ‘population’. The auditor may only sample 70% of this population.

If sampling is used and errors are discovered in samples, it will be necessary to ‘project’ these errors, so as to form an opinion as to the number of errors likely to exist in the total population. Selection of specific items differs from sampling because the results from the selection of specific items cannot be projected to the entire population and as such are not representative. Audit sampling and projecting errors can be illustrated as follows:

Illustration – Audit Sampling and Error Projection

We are the auditors of Sampling Inc and we are testing the sales invoices. The population of sales invoices sampled amounted to $100,000 and the values of the invoices in our sample amounted to $35,000. The following are the results of our sampling:

(1) We tested all material items in the sample which amounted to $20,000 and included an error of $1,000. As we have tested all material items in the sample the error will not be reproduced in the remainder of the population and in this respect the likely error from this sample is limited to $1,000.

(2) We tested a number of other invoices amounting to $15,000 and found an error of $500. In contrast to the testing in (1), this error could be reproduced in the sample because both the population and the sample are limited to the remaining non-material items. The ‘projected’ error by extrapolation will be the error discovered ($500) multiplied by the remaining population of ($100,000 - $20,000) $80,000 divided by the sample $15,000 i.e. $2,667.

The total projected error is $1,000 plus $2,667 i.e. $3,667. If management decide to correct the ‘actual’ adjustments which are $1,000 found in (1) and $500 in (2) i.e. $1,500 then the projected error will be $2,167.

If the above samples had not been split into two elements (i.e. material items and non-material items) then the projected error would be found by extrapolating over the total population. This would have increased the errors discovered because the errors would have been calculated as $1,500 multiplied by the population of $100,000 divided by the sample of $35,000 = $4,286.

When devising sample sizes, the auditor needs to ensure that they reflect the assessment of materiality and risk. Auditors also need to consider that when designing tests to generate sufficient appropriate audit evidence they understand that no two audits will be the same, even if the entity being audited is in the similar industry to another audit client which the auditor has had dealings with. Tests therefore need to be tailored to specifics.

Documentation of Audit Evidence

All audit work must be documented because this provides evidence of the audit work done to support the audit opinion. In certain areas of the audit, audit evidence may be difficult to obtain, such as that relating to related parties and the auditor may have made inquiries of management to help towards generating sufficient appropriate audit evidence. Remember, inquiry alone is often complementary to other audit tests; on its own inquiry does not provide sufficient appropriate audit evidence. Where discussions with management, or other client staff, are held then it is important that notes are made of the conversations and any representations are made in writing. Audit working papers should be prepared in accordance with the provisions in ISA 230. Working papers should ordinarily contain the following information:

• The name of the client.
  
• The accounting period.
  
• The title of the schedule.
  
• The source of the data being tested.
  
• A key or legend explaining any ‘ticks’ or audit symbols used.
  
• The initial of the person preparing the schedule and the date the schedule was prepared.
  
• The initial of the person reviewing the schedule and the date the scheduled was reviewed.
  
• The details of the work carried out.
  

Audit documentation needs to be reviewed by an appropriate level of personnel at the audit firm to ensure that:

• The work has been performed in accordance with the audit programme.
  
• The work performed and the results obtained have been adequately documented.
  
• Any significant matters or difficulties encountered have been resolved or are reflected in audit conclusions.
  
• The conclusions expressed are consistent with the results of the work performed and support the audit opinion.
  

Conclusion

It can be seen from the above article that obtaining sufficient appropriate audit evidence is crucial in forming the overall audit evidence and that the standard governing audit evidence is crucial. Audit evidence needs to be properly documented and reviewed in order to ensure that the overall objective of the audit has been achieved, or where objectives have not been achieved, the working papers contain documentation concerning the failure to achieve the objective.

Steve Collings FMAAT ACCA DipIFRS is audit and technical manager at LWA Ltd and also a partner in AccountancyStudents.co.uk. He is also a freelance technical author and lectures on financial reporting and auditing issues.