Audit evidence is the information an independent auditor gathers and evaluates to reach the conclusions that support the opinion on a company’s financial statements. It includes everything from bank confirmations and inventory counts to system logs and management’s written representations, and under Public Company Accounting Oversight Board (PCAOB) standards it must be both sufficient in quantity and appropriate in quality before the auditor can issue an opinion. Evidence that confirms what management has reported and evidence that contradicts it both count; an auditor who looks only for the first has not done the work.1Public Company Accounting Oversight Board. AS 1105 Audit Evidence
What the Evidence Has to Prove
Every number and disclosure in a set of financial statements carries an implicit claim by management. Audit evidence exists to test those claims. PCAOB standards sort them into five assertion categories, and every procedure in a well-designed audit program is pointed at one or more of them.
- Existence or occurrence. Assets and liabilities on the balance sheet actually exist, and recorded transactions actually happened in the period.
- Completeness. Everything that should be in the statements is in them, with nothing omitted.
- Valuation or allocation. Items are recorded at the right amounts.
- Rights and obligations. The company owns or controls the assets it reports, and the liabilities are genuinely its own.
- Presentation and disclosure. Items are properly classified, described, and disclosed.
Mapping evidence to assertions keeps the audit honest. A bank confirmation goes to existence of cash. A year-end search for unrecorded invoices goes to completeness of liabilities. Without that mapping, an auditor can accumulate a pile of paperwork that tests the same thing repeatedly while leaving other assertions untouched.1Public Company Accounting Oversight Board. AS 1105 Audit Evidence
Sufficiency and Appropriateness
Two standards govern whether the auditor has collected enough of the right evidence. They sound abstract but drive every practical decision about scope.
How Much Is Enough
Sufficiency is about quantity. The auditor needs enough evidence to support the opinion with reasonable assurance, and how much that turns out to be depends on risk. When the risk of material misstatement is high because of weak internal controls, a complex estimate, or a fraud factor, more evidence is required. Lower risk permits smaller samples and lighter testing.2Public Company Accounting Oversight Board. AS 2301 The Auditors Responses to the Risks of Material Misstatement
Materiality works the same way, in reverse. A lower materiality threshold means smaller misstatements matter, so the volume of testing goes up to catch them.
Relevance and Reliability
Appropriateness has two parts. Relevance is the logical connection between the evidence and the assertion. A bank confirmation is relevant to the existence of a cash balance. A sales invoice is not relevant to the valuation of inventory. Reliability is whether the auditor can trust what the evidence says.
Sufficiency and appropriateness are judgment calls, not formulas. No rule tells the auditor to collect exactly 47 confirmations. But the judgment has to account for assessed risk, materiality, the strength of internal controls, and the nature of what’s being tested. An auditor who claims professional judgment but cannot explain the reasoning behind the scope of testing will struggle to defend the work.
What Makes Evidence Reliable
Not all evidence carries equal weight. PCAOB standards set out principles for evaluating reliability that experienced auditors apply as second nature.
- Independent sources beat internal ones. Evidence from a knowledgeable party outside the company, like a bank or a customer, is more reliable than a document the company prepared itself, because the outside party has no stake in the outcome.
- Direct evidence beats indirect evidence. Something the auditor observes firsthand, such as counting inventory or inspecting equipment, carries more weight than something learned by asking management.
- Original documents beat copies. A signed original is more reliable than a photocopy or scanned PDF. Where documents have been converted to electronic form, reliability depends on the controls over the conversion.
- Strong internal controls raise reliability. Information produced under effective controls, including IT general controls and automated application controls, is more trustworthy than the same information from a company with weak controls.
These principles compound. A bank confirmation is powerful because it comes from an independent source and arrives directly in the auditor’s hands. A client-prepared reconciliation is weaker on origin, but if the company’s controls are strong and the auditor reperforms the reconciliation independently, the combined evidence may be persuasive enough.1Public Company Accounting Oversight Board. AS 1105 Audit Evidence
One qualifier: when a third party provides evidence subject to restrictions, limitations, or disclaimers, the auditor must consider what effect those caveats have. A confirmation marked “provided without guarantee of accuracy” is worth less than one without the caveat.1Public Company Accounting Oversight Board. AS 1105 Audit Evidence
The Forms Audit Evidence Takes
Evidence comes in three physical forms, each with its own strengths and limitations.
Documentary
Paper and electronic records make up the bulk of most audits. Vendor invoices, purchase agreements, board minutes, loan agreements, bank statements, and shipping documents all fall here. The auditor uses documentary evidence to test nearly every balance in the financial statements. Reliability depends on whether the document originated inside or outside the company and whether the auditor obtained it directly.
Physical
Physical evidence comes from the auditor’s direct observation or examination of tangible assets. Counting inventory, inspecting equipment, and verifying the condition of property all fit here. The evidence is highly reliable because the auditor gathers it firsthand. It directly supports the existence assertion and can inform valuation when observed condition points to impairment.
Electronic
System-generated data, access logs, automated transaction records, and database extracts dominate modern audits. When the auditor tests an automated control, the evidence is almost entirely electronic. The catch is that electronic evidence is only as reliable as the IT environment that produced it. Weak controls over access, change management, or backups mean the data cannot be trusted at face value, and the auditor evaluates those controls before placing reliance on any system-produced information.
Internal and External Sources
Evidence is also classified by where it originates, and this drives how much weight the auditor can place on it.
External evidence comes from sources independent of the company: bank confirmations, customer responses, vendor statements, brokerage reports, and letters from outside legal counsel. Its value lies in the fact that the source has no incentive to help management present a favorable picture. A bank has no reason to overstate a client’s cash balance.
Internal evidence is anything the company generated itself: journal entries, trial balances, internal memos, management-prepared reconciliations, and depreciation schedules. It is essential for understanding how transactions flow through the system, but it carries inherent risk because the people who prepared it are the people whose work is being audited. Effective internal controls raise its reliability, and auditors routinely corroborate internal documents with external sources where possible.
How Auditors Gather It
Auditors use a defined set of techniques. Each generates a different type of evidence and tests different assertions, and a well-planned audit combines several to build a body of evidence that is both sufficient and appropriate.
Inspection
Inspection means examining records, documents, or tangible assets. For documents, it runs in two directions. Vouching starts with a recorded entry and traces backward to the supporting document, testing whether recorded transactions actually occurred. Tracing starts with a source document and follows it forward into the accounting records, testing whether real transactions were captured. The distinction matters: vouching primarily tests existence, tracing primarily tests completeness.
Inspecting tangible assets works differently. The auditor might check serial numbers on equipment against the fixed asset register, or examine the physical condition of inventory to assess whether write-downs are needed.
Observation
Observation is watching a process as someone else performs it. The classic example is the year-end inventory count: the auditor watches client personnel count items, checks that they follow procedures, and performs independent test counts. Observation gives real-time evidence about how a process works, but it has a built-in limit. People perform better when they know they are being watched, and the observation only covers the moment it happens. The auditor cannot assume the process runs the same way every other day.
Inquiry
Inquiry means asking knowledgeable people, inside or outside the company, about facts, plans, or intentions. It is the most common audit procedure and also the weakest standing alone. Responses to inquiry almost always need corroboration. An auditor who asks management whether any litigation is pending and accepts the answer without checking with outside counsel or reviewing correspondence has not done enough. Professional skepticism matters most here, because the people being asked often have an interest in presenting the most favorable picture.
Confirmation
Confirmation involves sending a request directly to a third party and receiving a direct written response. The auditor must keep control over the whole process, from selecting items to confirm through receiving the responses, to prevent interception or alteration by the client.3Public Company Accounting Oversight Board. AS 2310 The Auditors Use of Confirmation
A positive confirmation asks the recipient to respond either way. A negative confirmation asks the recipient to respond only if they disagree, and is appropriate only when the risk of misstatement is low, balances are small, and recipients are likely to actually read the request. When no response comes back to a positive confirmation, silence is not agreement. The auditor must follow up and, if nothing arrives, perform alternative procedures such as examining subsequent cash receipts or shipping documents.3Public Company Accounting Oversight Board. AS 2310 The Auditors Use of Confirmation
Recalculation and Reperformance
Recalculation is checking the math: re-footing an invoice total, recomputing depreciation expense, verifying interest on a loan schedule. It is highly reliable because the auditor does the work independently, and any error becomes immediately apparent.
Reperformance is broader. The auditor independently re-executes a control or procedure the client’s staff originally performed. If the client reconciles the bank account monthly as a control, the auditor might reperform that reconciliation from scratch. Reperformance tests both the accuracy of the underlying data and the operating effectiveness of the control.
Analytical Procedures
Analytical procedures evaluate financial information by studying relationships among financial and nonfinancial data. Comparing the current year’s gross margin to the prior year, or revenue per employee to an industry benchmark, are straightforward examples. PCAOB standards require them at two stages: during planning to identify elevated-risk areas, and near the end as an overall review. Between those bookends, the auditor can also use them as substantive procedures to test specific account balances.4Public Company Accounting Oversight Board. AS 2305 Substantive Analytical Procedures
Effectiveness depends on the precision of the auditor’s expectation. Analyzing data at the business-unit level is sharper than analyzing consolidated totals, because offsetting changes between segments can mask errors at the top. Monthly data catches what annual data buries. When a significant unexpected fluctuation appears, or an expected one doesn’t, the auditor must investigate with additional substantive procedures.
When the Auditor Uses a Specialist
Some audit areas require expertise the auditor does not have. Fair value measurements, actuarial calculations, environmental liability estimates, and mineral reserve valuations are common examples. When the auditor engages a specialist, that work becomes part of the audit evidence.
The auditor cannot simply hand the question off. Before relying on the work, the auditor evaluates the specialist’s qualifications, including certifications, experience, and reputation, and assesses objectivity by looking for financial, employment, or family relationships with the client that could compromise impartiality.5Public Company Accounting Oversight Board. AS 1210 Using the Work of an Auditor-Engaged Specialist
A documented understanding between auditor and specialist must cover scope and objectives, who is responsible for testing data and evaluating assumptions, and the requirement to produce a report describing the work, the results, and the conclusions. If the specialist lacks sufficient knowledge, skill, or ability, the auditor cannot use the work at all.5Public Company Accounting Oversight Board. AS 1210 Using the Work of an Auditor-Engaged Specialist
Management Representation Letters
Near the end of every audit, the auditor obtains a written representation letter from management. The letter confirms management’s responsibility for the financial statements, the completeness of information provided, and specific representations about areas where other evidence is limited. It counts as audit evidence, but it sits at the bottom of the reliability hierarchy.6Public Company Accounting Oversight Board. AS 2805 Management Representations
The letter is not a substitute for actual audit procedures. It complements other evidence and fills gaps where corroborating evidence is thin. If a representation contradicts other evidence the auditor has already collected, the auditor must investigate the conflict and reassess the reliability of the representation. A lot of auditors have been tripped up in enforcement actions for accepting management’s word when the other evidence pointed the other way.6Public Company Accounting Oversight Board. AS 2805 Management Representations
Responding to Higher Risk
When the auditor identifies a risk of material misstatement, especially one involving fraud, the evidence-gathering requirements intensify. The auditor can adjust the nature of procedures (shifting to techniques that produce more reliable evidence, such as confirmation instead of inquiry), the timing (performing procedures closer to year-end or at points when fraudulent transactions are more likely), and the extent (increasing sample sizes or applying computer-assisted techniques to entire populations). Certain procedures should be performed on a surprise basis, such as observing inventory at unexpected locations or counting cash without advance notice, to prevent anyone concealing fraud from preparing for the visit.7Public Company Accounting Oversight Board. AS 2401 Consideration of Fraud in a Financial Statement Audit
Increasing extent alone does not fix the problem if the evidence being collected is weak. Testing more items from an unreliable source just produces more unreliable information. The nature of the procedure has to match the risk.2Public Company Accounting Oversight Board. AS 2301 The Auditors Responses to the Risks of Material Misstatement
When Evidence Falls Short
If the auditor cannot obtain sufficient appropriate evidence, the consequences reach both the opinion and the auditor.
An unqualified (clean) opinion requires that the audit was performed fully in accordance with PCAOB standards, with every necessary procedure applied. A scope limitation, whether the client restricted access, records were inadequate, or circumstances made a procedure impossible, forces the auditor to issue a qualified opinion or a disclaimer. The choice depends on how significant the missing evidence is. If the limitation affects a single account but the auditor can still form an opinion on the statements as a whole, a qualified opinion may be appropriate. If the missing evidence is so pervasive that no opinion can be formed, a disclaimer is required. When the client itself imposes the restriction, a disclaimer is ordinarily the right call.8Public Company Accounting Oversight Board. AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances
Auditors also face personal and firm-level consequences for evidence failures. The PCAOB can impose civil money penalties, bar individual auditors from practicing, and censure firms. In a December 2025 enforcement action, the PCAOB sanctioned an engagement partner who authorized audit reports without performing adequate procedures on material accounts, and censured and fined the firm.9Public Company Accounting Oversight Board. PCAOB Sanctions CPA for Violations Related to Audit Evidence and Her Former Audit Firm for Quality Control Issues The evidence requirements are enforceable standards, not aspirational guidelines.
Documentation and Retention
Collecting evidence is only half the obligation. The auditor must document it so that an experienced auditor with no prior connection to the engagement could understand what was done, what evidence was obtained, and what conclusions were reached. The Sarbanes-Oxley Act requires registered firms to retain audit documentation for at least seven years from the date the audit report is released.10Public Company Accounting Oversight Board. AS 1215 Audit Documentation – Appendix A
After the report is issued, the auditor has 45 calendar days to assemble the final audit file. Once that deadline passes, documentation cannot be deleted or discarded, and any additions must be clearly marked as subsequent changes. The file must include information about significant findings or issues that are inconsistent with the auditor’s final conclusions, not just the evidence that supports the opinion. That requirement exists to stop auditors from keeping only the favorable material.10Public Company Accounting Oversight Board. AS 1215 Audit Documentation – Appendix A
Specialist work must be documented in the audit file too, covering objectives, procedures performed, and conclusions reached. Inquiries with management are documented whenever they are important to a particular procedure. For every audit procedure, the file should contain a final conclusion unless it is readily apparent from the documented results. Evidence that is not documented, in a very real sense, is evidence the auditor cannot show was ever gathered.