Audit evidence is the information the auditor uses to reach the conclusions on which the opinion is based. It has to be sufficient, which is a question of quantity, and appropriate, which is a question of relevance and reliability. The two interact but do not substitute: more copies of a weak document do not make it strong, and a highly reliable document that does not address the assertion in question is worth nothing at all. A third property matters in practice and is often ignored — evidence must remain traceable, meaning a reviewer can find the document a figure came from without asking the person who put it there.
Sufficiency and appropriateness, without the circularity
Textbook definitions of these two terms tend to define each in terms of the other. The practical distinction is simpler.
| Property | The question it answers | What increases it |
|---|---|---|
| Sufficiency | Is there enough? | More items tested, or a larger proportion of the population covered. Driven by the assessed risk: higher risk requires more evidence. |
| Appropriateness — relevance | Does this evidence bear on the assertion I am testing? | Choosing a procedure whose direction matches the assertion. A sample vouched from the ledger to invoices is irrelevant to completeness no matter how large it is. |
| Appropriateness — reliability | Can this evidence be trusted? | Independence of the source, the auditor's own involvement in obtaining it, the effectiveness of the client's controls, and whether it is an original rather than a copy. |
The relationship worth remembering is that quantity can partly compensate for lower reliability, but only partly, and never for irrelevance. Thirty weak documents addressing the right assertion may support a conclusion; three thousand addressing the wrong one will not.
Regulatory requirement
SA 500, Audit Evidence, sets the requirement to obtain sufficient appropriate audit evidence and addresses its relevance and reliability. SA 505 deals with external confirmations and SA 530 with audit sampling. This article summarises the practical effect; read the current standards as issued by the ICAI before relying on any summary.
A reliability hierarchy that works in Indian practice
The general principles are that evidence from an independent external source is more reliable than internal evidence, evidence obtained directly by the auditor is more reliable than evidence obtained indirectly, documentary evidence is more reliable than oral, and originals are more reliable than copies. Applied to the documents that actually appear in a mid-market Indian file, that produces a usable ranking.
| Evidence | Reliability | Caveat |
|---|---|---|
| The auditor's own observation, recomputation or inspection of an asset | Highest | Evidence about the moment observed, not about the period. A stock count on 31 March says nothing about 30 September. |
| A confirmation received directly from a bank or supplier | High | Only if it came directly. A confirmation returned through the client has been through the client's hands. |
| A statement downloaded by the auditor from a government portal | High | Record the download date. A GSTR-2B statement can be recomputed after actions in the Invoice Management System. |
| An original third-party document held by the client, inspected by the auditor | Moderate to high | Reliability depends partly on the client's controls over the document. A supplier invoice in a well-controlled file is stronger than one produced on request. |
| A scan or photocopy of a third-party document | Moderate | Say so in the paper. A scan examined is evidence; a scan described as an original misstates the file. |
| An internal document produced in a system with effective controls | Moderate | Depends entirely on the controls, which have to have been tested rather than assumed. |
| An internal document or schedule produced on request | Lower | Agree it to something independent. A schedule prepared for the auditor is management's assertion in a table. |
| Management's oral explanation | Lowest | Corroborate it. An explanation is a lead to follow, not evidence that the thing explained is true. |
How evidence degrades
Evidence rarely fails at the moment it is obtained. It degrades on the way into the file, in ways that are invisible afterwards.
- A confirmation emailed by the supplier to the client's accounts team and forwarded to the audit team stops being directly obtained. The chain now includes a party with an interest in the answer.
- A screenshot of a portal replaces a downloadable statement, losing the ability to reperform anything on it and any record of when it was taken.
- A document filed under a generic name in a shared folder becomes unfindable within a year, so the paper that cites it effectively cites nothing.
- A figure typed from a document into a schedule loses its link to the source, and a transcription error introduced at that point is undetectable on review.
- A PDF of a system report, where the report itself could have been exported, loses the ability to check totals and counts.
Bank and supplier confirmations received by email deserve particular care. Where the reply comes from an address the client supplied, or is forwarded rather than received directly, the evidence is weaker than the working paper is likely to claim. Record how the reply was received, not just that it was received.
Traceability: the third property
Sufficiency and appropriateness are properties of the evidence. Traceability is a property of the file, and it is the one an auditor controls entirely. A figure in a working paper is traceable when a reviewer can get from the figure to the document and the page it was read from, without asking anyone.
- 01Name the document, not the category“Invoice” is not a reference. Vendor, invoice number, date, amount and where the document is held is a reference. A reviewer needs to know which document before deciding whether to open it.
- 02Include the locatorPage, row, or the identifier within the report. A twelve-page bank statement cited without a page is a citation a reviewer will not follow, which means the figure is effectively unsupported.
- 03Keep the evidence with the fileA link to a document held outside the audit file survives only until someone reorganises the folder. What is in the file is what will exist at retention.
- 04Show gaps as gapsWhere a figure has no supporting document, record the absence explicitly. A blank in a schedule is ambiguous between “checked and fine” and “nobody could find it”, and the two have opposite consequences.
- 05Record the basis of any figure that was computed rather than readA derived number needs its inputs and its method, or it cannot be reperformed.
When to stop gathering
There is no arithmetic answer, but three questions usually settle it. Does the evidence address the assertion that was actually assessed as a risk? Is it reliable enough given that assessed risk, or does the risk demand a stronger source? And would a reasonable auditor, seeing only what is in the file, reach the same conclusion?
Where evidence points in different directions, the resolution itself has to be documented. Two documents that disagree, and a conclusion following one of them with no record of why, is the shape of a finding waiting to be raised on review or later.
How we think about this
Lekhya treats evidence as a chain rather than a citation: finding, procedure, transaction, extracted field, source document, page. Every figure carries the document and the locator it came from, and a missing link is shown as a gap rather than omitted. That does not make evidence sufficient or appropriate — those remain the auditor's judgements. It makes it traceable, which is the part that is lost through ordinary carelessness rather than through any failure of skill.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationSA 230: what actually has to be in the fileThe experienced-auditor test explained in plain terms, what documentation has to demonstrate, when the file has to be assembled, and the gaps that most often draw comment on review.
- Audit documentationAudit working papers: what they should containThe anatomy of a paper that stands on its own: objective, population, sample basis, procedure, results, exceptions, conclusion and sign-off, and what each must establish.
- Audit documentationAudit trails: the client's, and your ownThe edit log the Companies Act now requires in the client's software, and the record of what the audit team did to its own file. What each must show, and how to test the first.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.