3Audit execution & techniques

• 3.1Audit evidence and the audit trail

  Covers the two requirements that audit evidence must meet—sufficiency (quantity) and appropriateness (probative force = relevance and reliability)—the hierarchy that evidence obtained by the auditor directly or from an independent external source is more reliable, and the role of the audit trail in tracing the history of processing, together with judging which evidence to gather to support an opinion.

• 3.2Audit techniques

  Covers the main audit techniques for gathering evidence—document review to scrutinize records, interviews to hear the situation from staff, the checklist method that systematizes items to confirm, reconciliation/matching that cross-checks two independent records, and on-site inspection (walkthrough/observation) to verify the field directly—and building the judgment to choose (or combine) them according to the audit objective, understanding the evidence each excels at and its limits.

• 3.3Choosing among CAATs (computer-assisted audit techniques)

  Precisely distinguishes the five CAAT techniques that verify computer processing itself—test data method (verify processing with auditor-prepared data), parallel simulation (re-process with the auditor's own program and compare), ITF (integrated test facility) (run dummy audit data through production), embedded audit module (build audit functions into the production program), and generalized audit software (extract and reconcile all production data)—and judges which to choose against the audit objective and evidence sufficiency, such as the exhaustive verification of mass transactions.

• 3.4Preparing, reviewing, and retaining audit working papers

  Covers the requirements that audit working papers—the record of audit execution that backs the basis for conclusions—must meet (that a third party can trace and reproduce the procedures performed, evidence obtained, and conclusions reached), how review by a superior secures audit quality, and the need for retention for a set period and for confidentiality—viewing the working papers as determining the evidential force of the audit itself.

• 3.5Sampling (statistical / non-statistical)

  Covers the difference between testing (sampling) that examines part of a population and a complete examination that examines every item, the difference between statistical sampling (probabilistically inferring the population's state from the sample result) and non-statistical sampling (selected by auditor judgment), and sampling risk (the risk that a sample does not represent the population and leads to a wrong conclusion)—alongside judging how to choose testing vs. complete examination and statistical methods according to risk and materiality.