Audit evidence (ISA 500)

The auditor of a bank signs an opinion that loans of ₦800 billion are fairly stated. Months later the regulator challenges the opinion. The auditor's defence is the evidence on the file: confirmations from borrowers, valuations of collateral, tests of the loan approval controls and analysis of non-performing loans. If the evidence is thin, the opinion cannot be defended.

Every audit opinion is therefore only as strong as the evidence beneath it, and every audit procedure is a way of collecting evidence.

This topic covers the general principles of audit evidence under International Standard on Auditing (ISA) 500, what makes evidence sufficient and appropriate, relevance and reliability, the seven procedures for gathering evidence, what to do if evidence is not enough, and the financial statement assertions. Audit documentation, sampling and the tests themselves follow.

Key terms in plain English

Syllabus check

This topic is in syllabus area C, gathering evidence and audit report (25% of marks). It covers:

• the nature of audit evidence and the sufficiency and appropriateness of evidence (ISA 500)
• the sources and quality of evidence and the methods of obtaining it
• the procedures for gathering evidence in a given scenario

CAMA 2020 and audit evidence

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

General principles

1. The outcome of an audit is a report, usually an opinion.
2. The report and opinion must be supportable if challenged.
3. So the auditor collects evidence on which to base the report and opinion.
4. The auditor carries out procedures, called audit tests, to generate the evidence.
5. The tests, the evidence and the conclusions must be documented in the audit file.

ISA 500 sets the objective of the auditor: to design and perform audit procedures so as to obtain sufficient appropriate audit evidence, draw reasonable conclusions and base the opinion on them. Its other requirements are to:

• consider the relevance and reliability of the information used as evidence;
• where the information was prepared using the work of a management's expert, evaluate the expert's competence, capabilities and objectivity, understand the expert's work and evaluate whether the report is appropriate evidence;
• when using information produced by the entity, judge whether it is reliable enough, which means accurate, complete, precise and detailed;
• use effective means of selecting items for testing, as in ISA 530 on sampling; and
• if evidence from one source is inconsistent with evidence from another, or the auditor doubts its reliability, consider what additional procedures are needed and the effect on other parts of the audit.

Sufficient and appropriate evidence

Sufficient relates to the quantity of evidence. Appropriate relates to quality, which means relevance and reliability. The auditor uses judgement on both. The two are linked: a smaller quantity of high quality evidence may support a conclusion, while a larger quantity of low quality evidence may be needed for the same conclusion. The amount of evidence needed also depends on:

• the seriousness of the risk that the statements are not true and fair: the higher the risk, the more evidence;
• the materiality of the item;
• the strength of the internal controls in the accounting system; and
• the sampling method, which affects the size of the sample.

Relevance

Relevance is the logical connection between the evidence and the purpose of the procedure and the assertion being tested. Four points follow.

• Relevance depends on the direction of testing. To test accounts payable for overstatement, one tests the recorded balances. To test for understatement, testing the recorded balances is not relevant. The auditor instead tests subsequent payments, unpaid invoices, suppliers' statements and unmatched goods received notes.
• A procedure may give evidence about some assertions but not others. Inspecting receipts after the year end gives evidence on existence and valuation of receivables, but not necessarily cut-off.
• Tests of controls are designed to evaluate whether controls operate effectively in preventing, or detecting and correcting, material misstatements. The auditor looks for conditions that show a control was performed and for deviations.
• Substantive procedures are designed to detect material misstatement at the assertion level, so the auditor identifies the conditions that would constitute a misstatement.

Reliability

The seven procedures for gathering evidence

More than one procedure may be used in an area, and not every procedure fits every objective. The auditor selects the most appropriate ones. ISA 500 identifies seven.

Example. To test that plant exists, use physical inspection. To confirm the accuracy of directors' bonuses, use recalculation. To understand an unusual cashbook payment, use inquiry of management, with corroboration.

Types and sources of evidence in a bank audit

The May 2026 examination described New Breath Bank Plc with irregular loan approvals, significant non-performing loans, a whistle-blower alleging diverted funds and hidden assets. Management insisting that there were no going concern issues. Candidates were asked to state the types and sources of audit evidence required under ISA 500 and ISA 580. A good answer groups them as follows.

• Documentary evidence: loan files, approvals, credit committee minutes, collateral documents and valuation reports, bank statements, board minutes and correspondence with the regulator.
• External evidence: confirmations from borrowers and from other banks, replies from the central bank and regulators, legal letters from lawyers and independent valuations of collateral.
• Physical evidence: inspection of cash and of tangible assets held as collateral.
• Oral evidence and representations: inquiries of management, credit officers and internal audit, and written representations from management under ISA 580, particularly on going concern and on completeness of disclosures.
• Analytical evidence: loan loss ratios, non-performing loan trends, interest margins and comparisons with peers.
• Computer-generated evidence: data extracts from the core banking system, tested with audit software.

For the hidden-assets allegation, forensic techniques such as tracing, document examination, data analytics and searches of public records are used to supplement ordinary audit evidence, as the forensic topics later explain.

What if the evidence is not sufficient?

The auditor must decide whether the evidence is enough for the opinion. If not, the auditor may:

• Get more evidence through more tests of controls, which may show the controls are not as weak as feared, or through more substantive procedures, where the controls are weak and the task is to quantify the possible error;
• Discuss the problem with senior management or the audit committee;
• Include the findings in the management letter; and
• Modify the audit report, as an extreme step used only when the other methods fail.

The financial statement assertions

Assertions are the representations by management, explicit or not, embodied in the financial statements, which the auditor uses to think about the possible kinds of misstatement. ISA 315 groups them in two categories.

For sales, the assertions mean:

• occurrence, that every invoice relates to goods dispatched in the year
• completeness, that all dispatches were invoiced and recorded
• accuracy, that prices and discounts are right
• cut-off, that goods dispatched just before the year end are in sales and goods dispatched after it are not
• classification, that all sales are posted to the sales account

For each item the auditor gets evidence on the assertions that matter for it.

Types of audit procedure

ISA 500 distinguishes risk assessment procedures from further audit procedures, which are tests of controls and substantive procedures. In general the auditor tests the controls. If they work well, less substantive testing is needed. If they do not, more is needed. Substantive procedures are tests of detail and analytical procedures.

A quick map: assertion, risk and typical procedure

Information produced by the entity

Much of the information the auditor uses, such as the ageing report, inventory listing or payroll register, is produced by the client's system. The auditor must be satisfied that it is accurate and complete before relying on it. That means testing the report's source data, checking that the report logic is correct, or relying on effective controls over the system that produced it.

An ageing report that leaves out some invoices would make an allowance for doubtful debts look reliable when it is not. Where the client has used a specialist, such as a valuer or an actuary, the auditor must judge the specialist's competence, capabilities and objectivity, understand the work and decide whether it supports the assertion.

Written representations as evidence

Management's written representations are evidence but are weak on their own, because they come from the party being audited. They confirm responses to oral enquiries and cover matters for which other evidence cannot reasonably exist, such as management's intentions. They never replace other evidence that should exist. A later topic on written representations explains the letter in full.

If the other evidence contradicts management's representation, the auditor reconsiders how much to rely on management's representations generally.

Contradictory evidence

An auditor looks for evidence that contradicts management as well as for evidence that supports it. If a customer confirms a lower balance than the ledger, if a count sheet differs from the records or if an expert's valuation differs from management's, the auditor must resolve the inconsistency, by extra procedures, and consider the effect on other parts of the audit. Ignoring contradictory evidence is a failure of professional scepticism.

Worked examples

1. (a) External confirmation.
2. (b) Observation.
3. (c) Recalculation.

1. The confirmation is from an independent external source and was obtained directly.
2. It is more reliable than the client's ledger.

1. Testing the recorded payables is not relevant to understatement.
2. Test payments after the year end, unpaid invoices and suppliers' statements for items not recorded.

1. The test concerns the period in which sales were recorded.
2. The assertion tested is cut-off.

How to score full marks

• Define sufficient (quantity) and appropriate (quality) separately.
• List the seven procedures by name and match one to each situation.
• Rank evidence by reliability and say why.
• Link each test to an assertion.

Common mistakes in the exam

• Saying inquiry alone is enough.
• Confusing sufficient with appropriate.
• Giving only five or six procedures.
• Testing recorded balances to prove completeness.

Quick revision

• Sufficient = quantity; appropriate = relevance and reliability.
• Seven procedures: inspection, observation, inquiry, confirmation, recalculation, reperformance, analytics.
• Reliable: external, direct, documentary, original.
• Assertions for transactions and for balances.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.