CAS 200.11 In conducting an audit of financial statements, the overall objectives of the auditor are:
(a) To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and
(b) To report on the financial statements, and communicate as required by the CASs, in accordance with the auditor’s findings.
CAS 330.25 Based on the audit procedures performed and the audit evidence obtained, the auditor shall evaluate before the conclusion of the audit whether the assessments of the risks of material misstatement at the assertion level remain appropriate. (Ref: Para. A60-A61)
Evaluating the Sufficiency and Appropriateness of Audit Evidence (Ref: Para. 25-27)
CAS 330.A60 An audit of financial statements is a cumulative and iterative process. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing or extent of other planned audit procedures. Information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based. For example:
- The extent of misstatements that the auditor detects by performing substantive procedures may alter the auditor’s judgment about the risk assessments and may indicate a significant deficiency in internal control.
- The auditor may become aware of discrepancies in accounting records, or conflicting or missing evidence.
- Analytical procedures performed at the overall review stage of the audit may indicate a previously unrecognized risk of material misstatement.
In such circ*mstances, the auditor may need to reevaluate the planned audit procedures, based on the revised consideration of assessed risks for all or some of the classes of transactions, account balances, or disclosures and related assertions. CAS 315 contains further guidance on revising the auditor’s risk assessment.
CAS 330.A61 The auditor cannot assume that an instance of fraud or error is an isolated occurrence. Therefore, the consideration of how the detection of a misstatement affects the assessed risks of material misstatement is important in determining whether the assessment remains appropriate.
CAS 330.26 The auditor shall conclude whether sufficient appropriate audit evidence has been obtained. In forming an opinion, the auditor shall consider all relevant audit evidence, regardless of whether it appears to corroborate or to contradict the assertions in the financial statements. (Ref: Para. A62)
CAS 330.A62 The auditor’s judgment as to what constitutes sufficient appropriate audit evidence is influenced by such factors as the following:
- Significance of the potential misstatement in the assertion and the likelihood of its having a material effect, individually or aggregated with other potential misstatements, on the financial statements.
- Effectiveness of management’s responses and controls to address the risks.
- Experience gained during previous audits with respect to similar potential misstatements.
- Results of audit procedures performed, including whether such audit procedures identified specific instances of fraud or error.
- Source and reliability of the available information.
- Persuasiveness of the audit evidence.
- Understanding of the entity and its environment, including the entity’s internal control.
CAS 330.27 If the auditor has not obtained sufficient appropriate audit evidence as to a material financial statement assertion, the auditor shall attempt to obtain further audit evidence. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor shall express a qualified opinion or disclaim an opinion on the financial statements.
Forming the Assurance Conclusion
CSAE 3001.68 The practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary in the circ*mstances, attempt to obtain further evidence. The practitioner shall consider all relevant evidence, regardless of whether it appears to corroborate or to contradict the measurement or evaluation of the underlying subject matter against the applicable criteria. If the practitioner is unable to obtain necessary further evidence, the practitioner shall consider the implications for the practitioner’s conclusion in paragraph 69. (Ref: Para.A147-A153)
CSAE 3001.69 The practitioner shall form a conclusion about whether the underlying subject matter is free from significant deviation. In forming that conclusion, the practitioner shall consider the practitioner’s conclusion in paragraph 68 regarding the sufficiency and appropriateness of evidence obtained and an evaluation of whether identified deviations are significant, individually or in the aggregate. (Ref: Para.A5, A120 and A154-A155)
CSAE 3001.70 If the practitioner is unable to obtain sufficient appropriate evidence, a scope limitation exists and the practitioner shall express a qualified conclusion, disclaim a conclusion, or withdraw from the engagement, where withdrawal is possible under applicable law or regulation, as appropriate. (Ref: Para.A156-A158)
CSAE 3001.83 If the practitioner identifies information that is inconsistent with the practitioner’s final conclusion regarding a significant matter, the practitioner shall document how the practitioner addressed the inconsistency.
Significance
CSAE 3001.49 The practitioner shall consider significance when: (Ref: Para.A90-A98)
(b) Evaluating whether the underlying subject matter is free from significant deviation.
Forming the Assurance Conclusion
Sufficiency and Appropriateness of Evidence (Ref: Para.14(j), 68)
CSAE 3001.A147 Evidence is necessary to support the practitioner’s conclusion and assurance report. It is cumulative in nature and is primarily obtained from procedures performed during the course of the engagement. It may, however, also include information obtained from other sources such as previous engagements (provided the practitioner has determined whether changes have occurred since the previous engagement that may affect its relevance to the current engagement) or a firm’s quality control procedures for client acceptance and continuance. Evidence may come from sources inside and outside the appropriate party(ies). Also, information that may be used as evidence may have been prepared by an expert employed or engaged by the appropriate party(ies). Evidence comprises both information that supports and corroborates aspects of the underlying subject matter, and any information that contradicts aspects of the underlying subject matter. In addition, in some cases, the absence of information (for example, refusal by the appropriate party(ies) to provide a requested representation) is used by the practitioner and, therefore, also constitutes evidence. Most of the practitioner’s work in forming the assurance conclusion consists of obtaining and evaluating evidence.
CSAE 3001.A148 The sufficiency and appropriateness of evidence are interrelated. Sufficiency is the measure of the quantity of evidence. The quantity of evidence needed is affected by the risks of the underlying subject matter containing a significant deviation (the higher the risks, the more evidence is likely to be required) and also by the quality of such evidence (the higher the quality, the less may be required). For certain types of direct engagements such as performance audits, there may also be a higher risk of concluding that there is a significant deviation when that is not the case. The appropriateness of the practitioner’s decision regarding whether a matter identified is a significant deviation is affected by the quantity and quality of evidence obtained.
CSAE 3001.A149 Appropriateness is the measure of the quality of evidence; that is, its relevance and its reliability in providing support for the practitioner’s conclusion. The reliability of evidence is influenced by its source and by its nature, and is dependent on the individual circ*mstances under which it is obtained. Generalizations about the reliability of various kinds of evidence can be made; however, such generalizations are subject to important exceptions. Even when evidence is obtained from sources external to the appropriate party(ies), circ*mstances may exist that could affect its reliability. For example, evidence obtained from an external source may not be reliable if the source is not knowledgeable or objective. While recognizing that exceptions may exist, the following generalizations about the reliability of evidence may be useful:
- Evidence is more reliable when it is obtained from sources outside the appropriate party(ies).
- Evidence that is generated internally is more reliable when the related controls are effective.
- Evidence obtained directly by the practitioner (for example, observation of the application of a control) is more reliable than evidence obtained indirectly or by inference (for example, inquiry about the application of a control).
- Evidence is more reliable when it exists in documentary form, whether paper, electronic, or other media (for example, a contemporaneously written record of a meeting is ordinarily more reliable than a subsequent oral representation of what was discussed).
CSAE 3001.A150 The practitioner ordinarily obtains more assurance from consistent evidence obtained from different sources or of a different nature than from items of evidence considered individually. In addition, obtaining evidence from different sources or of a different nature may indicate that an individual item of evidence is not reliable. For example, corroborating information obtained from a source independent of the appropriate party(ies) may increase the assurance the practitioner obtains from a representation from the appropriate party(ies). Conversely, when evidence obtained from one source is inconsistent with that obtained from another, the practitioner determines what additional procedures are necessary to resolve the inconsistency.
CSAE 3001.A151 In terms of obtaining sufficient appropriate evidence, it is generally more difficult to obtain assurance about the underlying subject matter covering a period than about underlying subject matter at a point in time. In addition, conclusions provided on processes ordinarily are limited to the period covered by the engagement; the practitioner provides no conclusion about whether the process will continue to function in the specified manner in the future.
CSAE 3001.A152 Whether sufficient appropriate evidence has been obtained on which to base the practitioner’s conclusion is a matter of professional judgment.
CSAE 3001.A153 In some circ*mstances, the practitioner may not have obtained the sufficiency or appropriateness of evidence that the practitioner had expected to obtain through the planned procedures. In these circ*mstances, the practitioner considers that the evidence obtained from the procedures performed is not sufficient and appropriate to be able to form a conclusion on the underlying subject matter. The practitioner may:
- Extend the work performed; or
- Perform other procedures judged by the practitioner to be necessary in the circ*mstances.
Where neither of these is practicable in the circ*mstances, the practitioner will not be able to obtain sufficient appropriate evidence to be able to form a conclusion. This situation may arise even though the practitioner has not become aware of a matter(s) that causes the practitioner to believe the underlying subject matter may have a significant deviation, as addressed in paragraph 54L.
Evaluating the Sufficiency and Appropriateness of Evidence (Ref: Para.69)
CSAE 3001.A154 An assurance engagement is a cumulative and iterative process. As the practitioner performs planned procedures, the evidence obtained may cause the practitioner to change the nature, timing or extent of other planned procedures. Information may come to the practitioner’s attention that differs significantly from that expected and upon which planned procedures were based. For example:
- The extent of deviations that the practitioner identifies may alter the practitioner’s professional judgment about the reliability of particular sources of information.
- The practitioner may become aware of discrepancies in relevant information, or inconsistent or missing evidence.
- If analytical procedures were performed towards the end of the engagement, the results of those procedures may indicate a previously unrecognized risk of significant deviation.
In such circ*mstances, the practitioner may need to reevaluate the planned procedures.
CSAE 3001.A155 The practitioner’s professional judgment as to what constitutes sufficient appropriate evidence is influenced by such factors as the following:
- Importance of a potential deviation and the likelihood of its having a significant effect, individually or when aggregated with other potential deviations, on the practitioner’s report.
- Effectiveness of the appropriate party(ies)’s responses to address the known risk of significant deviation.
- Experience gained during previous assurance engagements with respect to similar potential deviations.
- Results of procedures performed, including whether such procedures identified specific deviations.
- Source and reliability of the available information.
- Persuasiveness of the evidence.
- Understanding of the appropriate party(ies) and its environment.
