3.2Audit techniques

Audit evidence does not accumulate on its own—the auditor actively gathers it by choosing an audit technique. What matters is not memorizing technique names but judging which technique yields which evidence with the greatest probative force for the matter to be confirmed (whether a control's design or operation, the accuracy of records, or the reality of the field). This section covers the characteristics and limits of the main audit techniques, alongside choosing them by objective.

3.2.1The main audit techniques

• Document review (inspection/scrutiny of records) reads through documents such as rules, procedures, design specs, ledgers, and records to verify how a control is defined on paper (its design) and the content of records. It is effective for grasping design status, but does not reveal whether operation actually follows the documents.
• Interviewing (hearing) asks staff or managers questions orally to hear the actual situation and intent. It quickly captures background and context, but testimony can contain subjectivity or error, so oral evidence has relatively low reliability and must be corroborated by other techniques.
• The checklist method systematically lists the items to confirm in advance and inspects them comprehensively without omission. It helps ensure uniformity and coverage, but risks missing unexpected problems not on the list and depends on the design quality of the list itself.
• Reconciliation/matching cross-checks two or more independent records for agreement or discrepancy (e.g., order data vs. shipping data, ledger vs. physical balance, system records vs. external deposit statements). Reconciling independent sources can detect inconsistencies or fraud and carries high probative force.
• On-site inspection (walkthrough/observation) has the auditor go to the field and directly see facilities, work, and operational status. It confirms realities that documents or testimony cannot reveal (whether an operation is actually performed) and, as evidence the auditor obtains firsthand, is highly reliable—though it shows only the state at the moment observed.

Suppose a systems auditor evaluates a company's change-management control that "changes to production programs are applied only after obtaining the manager's approval." The procedure manual clearly documents the approval process, and document review confirms the control is appropriately designed on paper. But the auditor judges that this alone is no evidence the control is actually operating. To test whether operation might deviate from the documents, the auditor combines techniques. First, an interview with the change-management staff hears the operational reality, but oral testimony alone is insufficiently reliable, so it must be corroborated. The auditor therefore reconciles the list of changes actually applied to production (the change-management system log) against the approval records (the workflow approval history), confirming whether an actual approval exists for every production change. If even one production change without an approval record is found in the reconciliation, that is decisive evidence for the diagnosis "the control is designed but there is a deficiency in operation (an operating deficiency)." In addition, the auditor conducts an on-site inspection of an emergency-change work site to directly observe whether anything is applied before approval. Thus the correct judgment—confirming design status by document review and operation status by techniques the auditor verifies himself, such as reconciliation and on-site inspection—evaluates the control's effectiveness with high probative force. Conversely, concluding "the control is effective" from merely reading the procedure manual is a classic error that fails to distinguish a design deficiency from an operating deficiency.

3.2.2Section summary

• Document review is effective for confirming a control's design status but does not show whether operation follows the documents
• Reconciliation/matching verifies agreement between independent records with high probative force, and on-site inspection lets the auditor personally confirm the reality of operation
• The oral evidence from interviews has low reliability; the correct judgment is to combine techniques rather than rely on a single one to confirm both design and operation