Prior to conducting an audit, auditors create detailed procedures to obtain sufficient audit evidence. These procedures generally focus on key risk areas that are identified through a risk analysis. To get a complete picture of the organization, it’s necessary to collect audit evidence from a variety of sources.
Before we look at how to collect audit evidence, let’s look at some important things to keep in mind throughout the process.
First, you need to obtain and document sufficient appropriate evidence on which to base your opinion. To form an audit opinion, you need to stay objective and come to your conclusions based on evidence, rather than personal opinion. The amount of evidence collected must be enough that it can be used and considered. The evidence also needs to be to be relevant and credible. That is, you need to be confident that it’s accurate. Characteristics that make a record credible include completeness, if it is dated, if participants are recorded, and if results and subsequent actions are recorded.
Second, it’s impossible to evaluate every process or interview every person in the organization. Rather, take a reasonable sample of evidence given the evidence that is available.
Third, all evidence must be detailed and traceable. This means you must have efficient means of taking notes. Slow down, take your time, and do it right the first time. You will often only have one chance to capture the information you need. Regardless of how efficient it may seem, never ask an auditee to speak into a voice recorder.
Finally, remember to look for positives. An audit should be a balanced snapshot of an organization, and should highlight both positive practices and nonconformities.
Forms of Audit Evidence
While every organization and audit is different, here are some common ways to collect audit evidence:
- Visual observation: Simply looking around is a terrific way to get an understanding of an organization. Try to look at the organization from every angle. Examples of things to look for include housekeeping and organization, informal record keeping, uncontrolled documents, and improvised fixes and repairs. Evaluate what you have observed and determine if certain areas need deeper investigation.
- Records: We have already discussed the need for credible records. During an audit, you need to look for evidence that something has happened: a record. While records are not required of everything that happens in an organization, if a company procedure or applicable standard requires a record, you need to evaluate it as part of the audit.
- Interviews: Speaking with employees is a valuable source of audit evidence. The conversation needs to be structured with the specific objective to capture factual information about the process being audited.
What if Things Change?
No matter how prepared you are for an audit, sometimes auditors encounter unforeseen difficulties in gathering evidence.
Auditors need to be alert to any signs that the evidence-gathering process isn’t achieving the level of assurance required and take appropriate corrective action.
If there are any potential amendments to the audit program, they need to be communicated with senior members of the audit team, along with any other important issues.
In instances where modifications did not take place before field work started, the audit steps can be modified as work progresses. However, any changes to the audit program need to be approved, and should include appropriate information on the nature, timing, and the extent of the steps to be performed.