Information collected from underlying entity records and processes, as well as information from the performance of various audit activities and testing procedures forms part of "Internal Audit Evidence" based on which auditor forms his opinion. Therefore it is critical for an auditor to gather appropriate and reliable audit evidence. So let’s try to understand collection, retention and subsequent review of internal audit evidence.
Evidence is collected either from the underlying company’s books, records, systems and processes or through the performance of audit activities and testing procedures. Documents supporting transactions (e.g., bills/invoices) or business arrangements (e.g., contracts/agreements) are evidences in the nature of the former.
Evidences are collected by performing one or more of the following audit procedures, i.e., checking, inspection, observation, inquiry, confirmation, computation, re-performance, analytical review and using the help of experts.
Sufficiency and appropriateness are inter-related and apply to evidence obtained. Sufficiency refers to the quantum of evidence gathered while appropriateness relates to its quality or relevance and reliability. Normally, the internal audit evidence is persuasive on its own and a number of evidential matters in aggregate, help make it conclusive. Hence, they are persuasive & conclusive in nature. On having the doubt over the reliability of the evidence shall evaluate how the audit procedures need to be modified or expanded to resolve the doubt or conflict. It shall be recoded in a manner which can be reproduced and reviewed independently
Ref: STANDARD ON INTERNAL AUDIT (SIA) 320 INTERNAL AUDIT EVIDENCE