Inquiry Alone Is Not Enough

A useful audit interview turns an explanation into something that can be examined. It helps the auditor understand the process, locate records and identify where the account may need further testing.

The difficult step comes afterwards: deciding what the explanation actually supports.

A confident answer may be accurate. It may also describe the intended process, a single occurrence or information the speaker received from somebody else. The auditor needs to establish which of those situations applies before relying on it.

An original hypothetical case

A purchasing manager at a fictional distributor explains: “Purchase orders are approved before release.”

The relevant internal criterion requires the appropriate approval before a purchase order is released. The auditor's question is whether that requirement operated for the transactions and period being reviewed.

The manager's explanation provides a starting point. It identifies a claim that can be tested, the people involved and the records to request. It does not, on its own, demonstrate the sequence of events for the selected orders.

Inquiry — make the claim specific

Ask what “approved” means in this process. Who has authority? What happens when the usual approver is unavailable? Does an emergency route exist? Where is the approval retained?

Distinguish normal policy from actual practice. Ask the interviewee to walk through a particular transaction rather than relying entirely on a general description. Record the source, date and important qualifications in the explanation.

Corroboration — look for another evidence trail

For selected purchase orders, obtain the relevant workflow history, approval record and release evidence. Compare the information with the manager's explanation.

Multiple copies of the same underlying report do not create independent corroboration. Consider how each source was produced and whether one merely repeats another.

Validation — examine the supporting information

Before accepting the records, check that they relate to the selected order and relevant period. Assess the approver's authority against the matrix effective at the time, including any authorised exception route.

Identify which events the created, updated, approved and released fields represent and establish the time basis used. Check whether the extract is complete for its purpose and whether later changes are visible.

In the fictional case, an approval display might show the current status without showing when approval occurred. That display would leave the “before release” question unresolved. Additional history or another suitable record would be needed.

A document's existence and a completed approval sequence answer different questions.

Conclusion — stay within the evidence

Compare the tested condition with the criterion and explain any remaining gaps. A well-supported outcome for selected orders should be described with its selection basis and coverage.

If supporting information cannot be obtained, investigate why. Depending on the facts, the issue may involve record retention, access, an evidence limitation or the control's operation. Missing documentation should not automatically be described as proof that approval never happened.

Where evidence contradicts an explanation, discuss the difference fairly and perform the additional work needed to understand it. Do not silently choose the account that is easiest to report.

A simple working-paper structure

For each important claim, record:

• The explanation and who provided it.
• The relevant criterion and review period.
• The records or other procedures used to test the claim.
• Checks on the evidence's reliability and coverage.
• Any contradictory information and follow-up.
• The conclusion, its basis and its limits.

This creates a visible connection between the conversation and the engagement result.

Practice question

A manager describes a control, shares a policy and shows a screen saying “Approved.” Can the auditor conclude that purchase orders were approved before release throughout the review period?

The available information leaves several questions open: whether the screen represents the selected historical transaction, the approval and release timing, the approver's authority and the coverage of the testing. Define the next procedures around those gaps.

Professional context

For internal audit, The IIA's Standard 14.1 provides the relevant information-quality context. PCAOB AS 1105 includes an explicit limitation on relying solely on company-personnel inquiry for specified financial-statement assertions and control-effectiveness conclusions in its own audit framework. That overseas requirement should not be presented as a universal local legal rule.

Inquiry → corroboration → validation → conclusion is Inside Assurance's practical teaching sequence. The work required depends on the objective, risk and available evidence.

Inside Assurance
Beyond the numbers. Inside the business.