Internal Audit / Insight
Eight Ways Auditors Gather Evidence
A practical evidence map linking inspection, observation, inquiry, confirmation, recalculation, reperformance, analytics and scanning to the question being tested—and the limits of each method.
Return to your library resultsAudit evidence should answer the question the engagement is trying to resolve. Collecting more documents does not help if those documents answer a different question.
Consider a fictional distributor reviewing whether recorded receipts represent goods that actually arrived. The criterion might require an authorised receipt supported by a count and a traceable system entry. The auditor then chooses procedures that can test that criterion.
The eight ways below are Inside Assurance's teaching map. They are not an official eight-part IIA classification or a requirement to use every method on every engagement. Scanning is included as a screening activity and can overlap inspection or analytics.
Inspection — examine the record or item
Read the receiving record, inspect the relevant approval and compare the item identifiers. A signed form may support a particular approval; it does not automatically establish that every quantity is correct.
Observation — watch the work happen
Watch a receiving team count a delivery. Record what was observed, when and under what conditions. A well-performed count today does not demonstrate that the same practice operated throughout the review period.
Inquiry — understand the explanation
Ask who records receipts, what happens when quantities differ and which evidence is retained. Use the explanation to identify testable claims and follow-up work.
Confirmation — seek a direct response
Where relevant, obtain information directly from an appropriate party outside the activity being tested. Establish the respondent's identity and the route of the response. A reply still needs to address the question and any restrictions.
Recalculation — check the arithmetic
Recompute the value of a selected receipt using its quantity and agreed price. Correct multiplication does not demonstrate that the quantity was received or the price was authorised.
Reperformance — independently repeat a procedure
Repeat a selected reconciliation or control using the relevant records. Explain the inputs, period and differences. Repeating a process once does not establish how consistently the original owner performed it.
Analytical procedures — test an expectation
Develop a reasonable expectation for a relationship, such as receipts against related purchases. Investigate meaningful differences. Align the periods and scope, evaluate the extract's completeness and allow for valid timing differences before treating a pattern as an exception.
Scanning — identify items needing attention
Screen a receipt listing for unusual dates, repeated references or unexpected descriptions. Record the selection rule and follow up flagged items. Scanning is a way to direct attention; an unusual item is not automatically an error or fraud.
Put the methods together
In the fictional distributor, the receiving manager explains that all deliveries are counted. The auditor observes a current count, inspects selected historical records, traces entries to source documents and investigates differences.
Direction matters too. Starting from a recorded receipt and tracing back to receiving evidence tests support for that selected record. Starting from receiving evidence and tracing into the ledger addresses a different completeness question; the starting population must itself be suitable.
Each step addresses a different gap. The interview describes the process; the observation shows a particular occurrence; the records and follow-up help evaluate the selected historical cases. None should be stretched into a conclusion beyond the work performed.
A useful working-paper question
For each procedure, write down: What claim am I testing? Which criterion applies? What did I examine? What did the result support? What remains unresolved?
Keep the source, period, selection basis and limitations visible. When the evidence conflicts, investigate the difference rather than choosing the more convenient explanation.
Try it
A receipt has an approval signature and an arithmetically correct total. What additional work would help assess whether the goods arrived?
A useful answer identifies a relevant receiving or physical-evidence trail, checks its reliability and explains the time and population covered. The signature and total answer narrower questions.
Different audit procedures answer different assurance questions.
Inside Assurance
Beyond the numbers. Inside the business.
Put the perspective to work.
Use these questions to connect the resource to your own business context.
Which objective and exposure need assurance?
Where could the process or control fail?
What evidence supports the conclusion and its limits?
What response addresses the cause and can be followed up?
References & context.
The IIA — Global Internal Audit Standards (14.1 and 14.6) — https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
PCAOB — AS 1105, Audit Evidence (.15–.21; financial-statement audit context) — https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
Use the framework and jurisdiction applicable to your work. Original examples and templates do not imply endorsement by the referenced organisations.
A question, correction or missing source?
The resource link will be included in your message form.
