A larger evidence file can still support a weaker conclusion. Under ISA 500, published by New Zealand's External Reporting Board, sufficiency concerns quantity, while appropriateness concerns relevance and reliability. Collecting more documents doesn't resolve a problem with their source, accuracy or relevance. That distinction matters whenever someone relies on a financial figure, a case summary or an AI-generated answer. The accountable reviewer needs to know what supports the conclusion, how it was checked and which uncertainties remain. Understanding what audited accounts actually tell you starts with recognising the difference between obtaining records and obtaining persuasive evidence. Practical rule: Define the claim before collecting the evidence. A document can be authentic without proving the proposition for which someone presents it.
Common audit evidence examples include original documents, external confirmations, physical inspection records, recalculation workpapers, analytical procedures, management representations, system reports, walkthroughs, sampling records and AI verification trails. Their value depends on the assertion being tested. An invoice can support a transaction's recorded amount without establishing delivery; an observation can support what happened at a particular time without establishing consistent performance. A defensible record therefore connects the source to the procedure, the result and the conclusion, while preserving contradictory information. For AI-assisted work, the same discipline means retaining the underlying material, the transformations, the checks and the reviewer's decision, not merely the final answer.
1. What Do Original Documents and Source Records Prove?
Original documents provide direct records of transactions, agreements and decisions. They can support the terms or amount recorded, but their evidential value depends on authenticity, completeness and relevance to the assertion under examination.
The ISA 500 guidance published by the Malaysian Institute of Accountants explains that original documents are generally more reliable than copies, while the reliability of digitised records depends on controls over their preparation and maintenance. An original-looking PDF therefore isn't automatically stronger than a controlled electronic record.
Connect the document to the assertion
For a recorded sale, vouch the ledger entry to the invoice, signed customer order and shipping record. The invoice supports billing details; the order supports agreed terms; the shipping record supports dispatch. None independently establishes every condition for recognising revenue.
For a board decision, compare the resolution with the approved minutes and relevant attachments. Record whether the version examined was final, signed or subsequently amended.
- Collection: Identify the custodian, receipt method and original filename.
- Structure: Index the relevant pages, clauses and transaction references.
- Verification: Record authenticity checks, missing attachments and conflicting versions.
- Limitation: State which assertion the document doesn't establish.
For AI-assisted extraction, retain the source beside the extracted fields. A correct quotation can still be assigned to the wrong party, date or obligation.
2. Why Are External Confirmations Stronger Than Internal Assertions?
External confirmations can provide independent corroboration of balances, transactions or terms. Their strength comes from the respondent's knowledge and independence, together with a reliable route from the respondent to the reviewer.
A bank response obtained directly by the auditor may corroborate account balances or specified borrowing terms. External counsel's response may address identified pending claims within its stated scope. Neither should be treated as an unrestricted assurance about matters the request didn't cover.
Preserve independence throughout the exchange
The European Court of Auditors' audit-evidence methodology distinguishes evidence by source and form, giving greater weight to independent and auditor-generated evidence than unsupported internal explanations. The practical implication is to examine how the response was obtained, not merely whose logo appears on it.
Verify contact details independently before sending a request. Retain the request, the respondent's identity, the response and any restrictions, then reconcile differences against the organisation's records.
A missing response leaves a gap; it isn't confirmation of agreement. Document follow-up and any alternative procedures without presenting them as equivalent unless their relevance and reliability justify that conclusion.
Independent corroboration requires an independent source, not simply a second document repeating the same assertion.
For AI verification, several outputs repeating the same underlying text aren't separate corroboration. Preserve the underlying sources and identify whether reviewers examined different evidence or merely restated a shared input.
3. What Can Physical Inspection and Observation Records Establish?
Physical inspection can support an asset's existence and observed condition. Observation can support what a person did during a specified procedure, but neither establishes ownership, valuation or consistent operation throughout a wider period without additional evidence.
At an inventory count, select entries from the inventory listing and locate the goods to test recorded existence. Also select goods on the premises and trace them into the listing to investigate completeness.
Record the boundary of the observation
Document the date, time, location, personnel, asset identifiers and test-count results. Explain discrepancies and retain evidence of their resolution rather than replacing the original count with an unexplained corrected figure.
For a branch cash-handling procedure, distinguish what the reviewer directly observed from what staff described. An employee's explanation of normal practice isn't evidence that the practice occurred on other days.
- Observed fact: Record the action, item or condition directly examined.
- Supporting record: Connect the observation to count sheets, asset registers or transaction records.
- Remaining uncertainty: Identify ownership, valuation or period-wide questions requiring separate procedures.
This distinction also matters when exercising contractual audit rights for concrete AI inspection evidence. A demonstration shows what occurred during that demonstration; operational records are needed to examine actual use.
For AI-assisted work, preserve the test environment, inputs and observed output. A successful demonstration doesn't establish how the system performed on confidential casework, different document types or earlier versions.
4. How Do Recalculation and Re-performance Workpapers Support a Conclusion?
Recalculation supports mathematical accuracy, while re-performance records the reviewer's independent execution of a procedure. Both can produce direct evidence of the work performed, but neither validates unsupported inputs merely because the resulting arithmetic is correct.
Consider depreciation. Recalculate the schedule using the recorded asset cost, useful life, method and commencement date, then separately examine the evidence supporting those inputs.
Make the work reproducible
For a bank reconciliation, obtain the relevant ledger and bank records, independently reconstruct the reconciliation and examine outstanding items. Reusing management's completed spreadsheet without checking its formulas and source data isn't the same as independently performing the procedure.
Keep the workpaper understandable without relying on the preparer's memory. Preserve input references, formulas, assumptions, results and explanations for differences.
- Input evidence: Identify the source and version of each material input.
- Method: Retain formulas, calculation logic or executable steps.
- Exceptions: Preserve the original discrepancy and the evidence supporting its resolution.
For AI-generated calculations, use an independently constructed spreadsheet, calculator or query to check the result. Asking the same system to reconsider its answer may help identify an error, but it doesn't provide independent arithmetic verification.
The distinction is consequential: a reproduced answer supports repeatability; a separately performed check supports accuracy. The conclusion should say which procedure occurred.
5. What Makes Analytical Procedure Documentation Persuasive?
Analytical documentation becomes persuasive when it records a reasoned expectation, reliable inputs, an investigation threshold and corroborated explanations for differences. A chart showing a fluctuation identifies a question; it doesn't establish its cause.
Suppose payroll costs rise while headcount remains stable. Develop an expectation using pay changes, overtime, vacancies, bonuses and employment dates, then compare it with recorded payroll expense.
Separate detection from explanation
For revenue, compare monthly amounts with shipments and relevant contract milestones. Account for timing differences and changes in the business before treating a relationship as evidence of an error.
An explanation such as seasonal demand or delayed billing should lead to supporting records. Retain the evidence that confirms or contradicts it, rather than closing the matter with management's account alone.
- Expectation: Explain the relationship and assumptions before evaluating the outcome.
- Tolerance: Record the basis for deciding which differences require investigation.
- Resolution: Link each significant difference to corroborating documents and a conclusion.
Review boundary: An unusual pattern is a reason to investigate, not a finding of misconduct.
For AI-assisted analysis, retain the dataset, filters, transformations and instructions used to identify anomalies. Record whether the tool analysed the full defined population or only an extract.
A model-generated explanation should remain a hypothesis until checked against underlying records. The valuable evidence is the documented comparison and follow-up, not the fluency with which the system describes a possible cause.
6. What Do Written Representations from Management Actually Establish?
Written representations establish management's stated position on specified matters. They can formalise accountability for disclosures and explanations, but they don't independently establish that the underlying information is complete or correct.
Examples include representations about disclosed related-party transactions and known or suspected fraud. The wording should identify the relevant entity, period, subject matter and responsible signatories rather than offer a broad assurance that everything is accurate.
Compare the statement with the record
Suppose management represents that all related-party transactions have been disclosed. Compare that statement with the relationships, transactions and exceptions identified during the engagement, and investigate contradictions before relying on the representation.
For suspected fraud, distinguish management's knowledge from the reviewer's findings. A statement that management knows of no misconduct doesn't resolve an unexplained transaction or override contradictory documentary evidence.
- Specificity: Preserve the precise subject and scope of the representation.
- Authority: Record who signed and the responsibility relevant to the statement.
- Consistency: Link conflicting evidence to the follow-up and resulting conclusion.
The same boundary applies to AI-use declarations. A caseworker's statement that an AI-generated summary was reviewed records an assertion about review; it doesn't show which clauses were checked or what errors were corrected.
Retain the declaration alongside review evidence, not instead of it. A defensible file separates the person's representation, the procedures performed and the reviewer's conclusion, so later readers can assess each on its own merits.
7. When Can System-Generated Reports and IT Audit Logs Be Relied On?
System reports and logs can support conclusions when their completeness, accuracy and relevance have been evaluated. Automatic generation doesn't establish reliability, particularly when report parameters, permissions or extraction logic can change the result.
For US public-company audits, PCAOB AS 1105 requires evaluation of company-produced information, including testing accuracy and completeness or relevant controls, and assessing whether it is sufficiently precise and detailed for the purpose.
Test the report, not its appearance
For a user-access review, preserve the system extract, extraction parameters, reviewer approvals and evidence of follow-up. For a production change, connect the change log to approval, testing and deployment records.
- Population: Reconcile the extract to the relevant system scope and control totals.
- Integrity: Examine who can alter, delete or disable the records.
- Context: Retain extraction time, operator, filters and report logic.
Cloudvara's guide to audit trails provides introductory context; the evidence question remains whether the particular trail reliably records the events being examined. An attractive dashboard can create an appearance of control without adequate audit evidence.
For AI workflows, connect processing logs to document versions and actual reviewer actions. A recorded model call establishes that an event was logged, not that its output was accurate or meaningfully reviewed.
8. What Does a Process Walkthrough Prove About Controls?
A walkthrough can show how a selected transaction moved through a process and whether identified controls were implemented in that instance. A narrative or flowchart describes the design, but neither alone establishes consistent operation throughout the period.
Trace a purchase from requisition through approval, purchase order, receipt, invoice matching and payment. At each stage, retain the actual record and identify who performed the action.
Distinguish described practice from demonstrated practice
Compare the written process with what employees do. If staff bypass an approval step or use an undocumented spreadsheet, record the difference and assess its relevance rather than editing the narrative to conceal it.
For payroll, a flowchart can identify intended segregation of duties. Supporting access and transaction records are needed to examine whether the named people performed incompatible activities.
- Transaction trace: Preserve evidence for each material hand-off.
- Control ownership: Identify the performer, reviewer and exception route.
- Change history: Date the narrative and record process changes.
For an AI-assisted legal summary, the walkthrough might follow document intake, privacy screening, extraction, drafting, source checking and approval. Record the actual path, including manual interventions and failed checks.
The resulting narrative should help a reviewer understand where errors could enter and which controls address them. It shouldn't imply that a well-designed workflow operated effectively in every case because the selected example followed it.
9. What Should Sampling Workpapers and Test-of-Controls Records Contain?
Sampling workpapers should explain the population, selection method, procedures, exceptions and basis for the conclusion. Test-of-controls records should identify the control tested and the evidence of its operation for each selected item.
In US public-company auditing, PCAOB AS 2315 recognises statistical and nonstatistical sampling, with professional judgement required in planning, selection, performance and evaluation. The approach's label doesn't by itself establish that the sample is sufficient.
Define the population before drawing conclusions
For purchase approvals, establish the relevant transaction population and period before selecting invoices. Retain evidence of population completeness, the selection logic and the authorisation criteria applied.
For new-user access, connect each selected account to its request, approval and granted permissions. Record exceptions consistently, including missing approvals and permissions that exceed the approved request.
- Selection basis: Explain random, systematic or judgemental selection and its intended purpose.
- Test result: Record the evidence examined and outcome for each item.
- Evaluation: Explain how exceptions affect reliance and further procedures.
A targeted selection of unusual transactions can be useful for investigation. It shouldn't be presented as representative coverage without a defensible basis.
For AI document review, record which files, pages or claims received human checking. Reviewing selected passages doesn't establish that every extracted obligation or factual statement was verified, even if the final report appears thorough.
10. What Belongs in an AI-Assisted Analysis and Verification Trail?
An AI verification trail should connect the source material, processing steps, raw outputs, independent checks, corrections and final human decision. It supports scrutiny of the work without establishing that the output is correct merely because the process was recorded.
The IAASB's technology programme addresses technology-enabled audit procedures and the implications of automated tools for evidence. The editorial implication is straightforward: increased processing scale doesn't remove the need to evaluate the information and challenge the result.
Preserve evidence separately from explanation
For a draft legal summary, retain the contract version, relevant clauses, instructions, generated text and the reviewer's clause-by-clause corrections. For compliance observations, preserve the original output alongside the officer's amendments and reasons.
- Provenance: Record the tool, available version identifier, date and source documents.
- Transformation: Retain extraction steps, prompts, filters and intermediate outputs.
- Challenge: Check source accuracy, missing context and plausible alternative interpretations.
- Decision: Record the reviewer, corrections, unresolved issues and approved use.
The distinction between an AI explanation and proof in a layered audit record matters here. A system's account of its reasoning isn't a substitute for inspectable source evidence.
Apply access and privacy controls to the trail itself, especially where prompts or outputs contain confidential records. Test those controls locally before sensitive use, and retain only the material appropriate to the purpose and applicable obligations.
How the ten audit evidence types compare
- Original Documents and Source Records — Evidence origin: Original transaction or decision records; Main limitation: Authenticity and completeness must be verified; Typical use: Trace ledger entries to contracts, invoices, or minutes
- External Confirmations from Independent Third Parties — Evidence origin: Written responses sent directly by banks, customers, or advisers; Main limitation: Low response rates, delays, or misdirected requests; Typical use: Confirm balances, terms, or legal matters
- Physical Inspection and Observation Records — Evidence origin: Auditor's direct examination of assets or observation of processes; Main limitation: Time-limited view; observation may affect behavior; Typical use: Verify inventory, asset condition, or control procedures
- Recalculation and Re-performance Workpapers — Evidence origin: Auditor independently recalculates amounts or repeats procedures; Main limitation: Depends on accurate, complete inputs; Typical use: Check calculations, reconciliations, or controls
- Analytical Procedure Documentation — Evidence origin: Comparisons of financial and non-financial data against expectations; Main limitation: Weak expectations or uncorroborated explanations reduce reliability; Typical use: Identify unusual trends and focus further testing
- Written Representations from Management — Evidence origin: Formal statements signed by management; Main limitation: Not independent proof and cannot replace other procedures; Typical use: Document management's assertions and responsibilities
- System-Generated Reports and IT Audit Logs — Evidence origin: Records produced by applications, databases, or security tools; Main limitation: Reliability depends on system controls and report completeness; Typical use: Review access, changes, and transaction activity
- Process Walkthrough and Control Narrative Documentation — Evidence origin: Transaction tracing, interviews, narratives, and flowcharts; Main limitation: Does not establish that controls operated consistently over time; Typical use: Assess process understanding and control design
- Sampling Workpapers and Test-of-Controls Records — Evidence origin: Defined populations, selected items, and documented test results; Main limitation: Incomplete populations or selection methods can bias conclusions; Typical use: Test control operation and support conclusions about a population
- AI-Assisted Analysis Trail and Verification Records — Evidence origin: Prompts, source documents, tool outputs, and human review records; Main limitation: A documented trail does not prove output accuracy; Typical use: Trace and review AI-assisted analysis and findings
What Should a Decision-Maker Ask For Before Relying on Evidence?
Ask for a record that connects the proposed decision to its supporting sources, procedures, exceptions and responsible reviewer. The central question isn't whether a file exists, but whether its contents justify the particular reliance being proposed.
The US Government Auditing Standards distinguish sufficient evidence from appropriate evidence, with quality assessed through relevance, validity and reliability. This framework provides a useful decision discipline beyond financial audit, although the professional requirements applicable to a legal filing, clinical record or regulatory submission depend on the relevant jurisdiction and engagement.
Request a traceable basis for reliance
Obtain the source register first. It should identify the material relied on, its owner or origin, the version examined and the conclusion it supports, with unresolved authenticity or completeness concerns clearly visible.
Where sampling was used, ask for the population definition, completeness checks and selection basis. Where management supplied representations, retain the actual signed statements and the evidence used to evaluate them.
- Evidence connection: Can the reviewer trace each material conclusion to the records and procedures supporting it?
- Contradictory information: Were conflicting documents, unexplained differences and failed checks investigated?
- Scope boundary: Does the conclusion stay within the period, population and assertions examined?
- Accountability: Is the person approving reliance identifiable, with the decision and remaining uncertainty recorded?
For AI-assisted work, request the source documents, processing record, raw output and verification history. A final polished answer doesn't reveal whether the reviewer checked the underlying clause, independently recalculated the figure or merely accepted another model's agreement.
More articles on this subject are collected in the AI verification overview.
Sources and references
Sources: Key standards claims are attributed to ISA 500 as published by New Zealand's External Reporting Board and the Malaysian Institute of Accountants, with the European Court of Auditors' methodology supporting the point on source and independence.