SA 500 requires the auditor to design and perform procedures that obtain audit evidence that is both sufficient (enough quantity) and appropriate (relevant and reliable enough in quality) to provide a reasonable basis for the auditor's opinion — the two tests are independent, so a large volume of weak evidence does not substitute for a smaller volume of strong evidence, and vice versa. The standard also specifically requires evaluating the reliability of information produced by the entity itself when that information is used as audit evidence or underlies a substantive procedure.
Sufficiency and appropriateness are not the same test
| Test | What it measures | What drives it |
|---|---|---|
| Sufficiency | Quantity of evidence | Assessed risk of material misstatement — higher risk requires more evidence, not just different evidence |
| Appropriateness | Quality — relevance and reliability | The source and nature of the evidence, and the circumstances under which it was obtained |
The reliability hierarchy SA 500 sets out
- Evidence obtained directly by the auditor (e.g. observation, recalculation) is generally more reliable than evidence obtained indirectly or by inference
- Evidence from independent external sources is generally more reliable than evidence generated internally by the entity
- Evidence generated internally is more reliable when the related controls, including controls over its preparation and maintenance, are effective
- Documentary evidence is generally more reliable than oral evidence
- Original documents are more reliable than photocopies, faxes, or documents that have been filmed, digitised or otherwise converted into electronic form
Regulatory requirement
When audit evidence from one source is inconsistent with evidence from another, or the auditor has doubts about reliability, SA 500 requires determining what modifications or additions to procedures are necessary to resolve the matter — it cannot simply be set aside or explained away without further work.
Evaluating information produced by the entity
- 01Evaluate accuracy and completenessBefore relying on a report, listing or extract the entity produced — an aged debtors listing, a fixed asset register extract — assess whether it is accurate and complete enough to be used as evidence or as the basis for further procedures.
- 02Evaluate whether the information is precise and detailed enoughFor the specific audit purpose it's being used for — a summary total may be accurate but too aggregated to test a specific assertion.
- 03Test the controls over its preparation, where relying on those controlsIf reliability is being supported by control effectiveness rather than independent verification, that reliance needs its own basis.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationAudit evidence: what makes it sufficient, appropriate and traceableSufficiency and appropriateness without the textbook circularity, a reliability hierarchy for Indian practice, and what has to be recorded for evidence to be traceable.
- Audit workflow & automationManaging audit evidence across hundreds of client documentsRequesting documents so they arrive usable, classifying what comes in, keeping versions straight, and always knowing what is still outstanding.
- Audit workflow & automationSA 315: identifying and assessing the risks of material misstatementA risk assessment that doesn't name a specific assertion isn't a risk assessment under SA 315 — it's a general impression written down.
- Audit workflow & automationAudit sampling methods for Indian CA firmsStatistical vs judgmental sampling, when full-population testing removes the need to sample, when sampling still applies, and what drives sample size.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.