3.1Audit evidence and the audit trail

A systems auditor's conclusion must be backed not by impression but by audit evidence. What matters is not whether evidence was gathered but a single question: does that evidence have both the quantity (sufficiency) and the quality (appropriateness, i.e., probative force) to support the opinion? This section covers what sufficiency and appropriateness mean, how the route of acquisition affects reliability, and the role of the audit trail in tracing processing after the fact, alongside real evidence-gathering judgments.

3.1.1Sufficiency and appropriateness

• Sufficiency is the quantitative measure of audit evidence—whether enough evidence has been gathered for the auditor to reach a conclusion. The higher the risk of an area and the greater the materiality of an item, the more evidence is required.
• Appropriateness is the qualitative measure—the probative force—of audit evidence, comprising two aspects: relevance (whether it bears on the audit objective and the assertion being proven) and reliability (whether the evidence itself is trustworthy). No matter how much evidence there is, it cannot support an opinion if it lacks relevance or reliability.
• Reliability hierarchy: evidence the auditor personally obtains, observes, or recomputes is more reliable than evidence handed over by the audited department; evidence from an independent third party (external) is more reliable than internally generated evidence; and documented evidence is more reliable than oral testimony.

3.1.2The audit trail

• The audit trail is the chain of records that lets you trace chronologically how a transaction or process was carried out—from input through processing, output, and recording. Logs, journals, sequential slip numbers, and update histories all serve as an audit trail.
• When an audit trail is in place, the auditor can trace from a result back to its cause (who did what and when), raising evidence reliability. Conversely, a design where batch processing leaves no intermediate records, or where logs can be overwritten or deleted, impairs the audit trail and makes auditing difficult.

Suppose a systems auditor is assigned to verify whether "sales amounts are recorded correctly" in a mail-order company's order-taking system. The audited department, accounting, argues, "We printed and submitted a large volume of the monthly sales summary (produced and output within our department), so that should be enough." The auditor, however, judges that no matter how voluminous these summaries are, they satisfy sufficiency (quantity) but not appropriateness (quality). First, the summary is internal evidence the audited department produced itself, so its reliability is relatively low; second, the summary does not directly prove relevance to the audit objective of "whether the recorded amount is correct." The auditor therefore chooses to gather higher-probative-force evidence directly: (1) re-aggregate the total from the order database with generalized audit software and reconcile it against the summary (auditor's own acquisition and recomputation); (2) for a sample of transactions, reconcile against the bank's deposit records, external evidence from an independent third party; and (3) inspect the update history (audit trail) to confirm no tampering occurred after aggregation. This supports the opinion with a combination of far more reliable evidence than relying on internal material handed over by the audited department. "Being voluminous" and "having probative force" are distinct requirements, and preferring evidence the auditor obtains directly and evidence from an independent external source is the correct way to satisfy both sufficiency and appropriateness.

3.1.3Section summary

• Audit evidence can support an opinion only when it meets both sufficiency (quantity) and appropriateness (quality = probative force = relevance and reliability)
• Evidence the auditor obtains or recomputes and evidence from an independent external source is more reliable than internal evidence produced by the audited department
• The audit trail is a chain of records that lets you trace processing backwards; when it is impaired, evidence reliability and auditability decline