Memory hook: Sufficient quantity, appropriate quality, traceable conclusion.
Must remember
Evidence must be relevant, reliable and sufficient for the objective. Inquiry alone is usually weaker than corroborated records, observation or reperformance. Observation proves what happened while observed, not necessarily the entire audit period. Evaluate source integrity and completeness before relying on an export or dashboard.
Compliance/control testing checks whether controls operated as designed; substantive testing examines transactions or outcomes directly. Attribute sampling estimates a control-deviation rate; variable sampling addresses numerical values. Statistical methods support quantified sampling risk; judgmental selection can target risk but does not automatically support population-wide statistical conclusions.
Verify the population, period and selection method. Sample size depends on tolerable deviation/error, expected deviation and desired assurance, not only population size. Data analytics can examine larger populations for duplicates, gaps, unusual timing or rule violations, but false positives and incomplete source data still require investigation. AI-generated audit explanations need independent evidence.
A finding connects condition, criteria, cause and effect/risk, then recommends proportionate action. Validate factual accuracy with management while preserving independent judgment. Assign an owner and target date; report material matters to the proper governance level. Follow-up verifies remediation or authorized risk acceptance, rather than accepting a status label as proof.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Prove access reviews happened throughout a quarter | Select appropriate period evidence and test actual review/remediation. |
| Find suspicious duplicate payments | Validated population analytics followed by investigation. |
| Management says an issue is fixed | Obtain evidence and retest the relevant control. |
Traps
- A large sample of an incomplete population can still mislead.
- An exception is not automatically fraud.
Active recall
1. Sufficiency versus appropriateness?
Enough evidence versus evidence of suitable relevance/reliability.
2. Attribute versus variable sampling?
Control characteristics/deviations versus numerical values.
3. Why corroborate interviews?
Statements may be incomplete, mistaken or not reflect actual practice.
4. What belongs in a finding?
Condition, criteria, cause, effect/risk and a useful recommendation.
5. What closes follow-up?
Evidence of effective correction or authorized acceptance of remaining risk.