An auditor tests 60 purchase orders and finds none missing an approval signature. The signatures were photocopied by the buyer who prepared the orders. The evidence is abundant and it proves nothing.
Evidence in an internal audit engagement is judged against three distinct criteria, and the exam rewards you for keeping them apart.
- Relevance: the evidence bears on the specific engagement objective and the assertion being tested. A vendor master listing is relevant to duplicate-vendor risk and irrelevant to whether goods were received.
- Sufficiency: there is enough of it, in quantity and persuasive force, to support the conclusion. Sufficiency is about the amount and the weight together, not headcount alone.
- Reliability: the evidence is dependable given its source, its route to you, and the environment that produced it.
KEY: Reliability is a property of the evidence itself. Sufficiency is a property of the body of evidence. Weak evidence does not become reliable by piling up more of it, but a large body of moderately reliable, corroborating items can become sufficient.
Common mistakes
- Treating volume as sufficiency. Sixty photocopied signatures from the preparer are 60 copies of one weak item. Increasing sample size does not repair a reliability defect in the source.
- Relying on a system report without testing the system. If access and change controls fail, the report inherits the failure. Test completeness and accuracy or drop the reliance.
- Accepting evidence routed through the auditee. A statement the treasurer prints is not a confirmation. Direct receipt from the independent source is what earns the reliability ranking.
Bottom line
- Relevance means the evidence bears on the objective, sufficiency means the body of evidence is enough in quantity and force, reliability means the item is dependable.
- Suitable criteria are relevant, reliable, complete, objective, and understandable, and are agreed with management before fieldwork.
- Reliability rises with evidence obtained directly by the auditor from an independent external source.
- Reliability rises with corroboration from a genuinely separate stream, not repetition of the same source.
Exam shortcut
Run the tests in order: relevance, then reliability, then sufficiency. Irrelevant evidence is discarded before you ever count it, so any answer choice that fixes an irrelevance problem by sampling more items is wrong. Stem signals: "provided by management" or "printed by the controller" means indirect, downgrade it. "Received directly from" plus an outside party means highest reliability, pick it.
The full lesson (about 2,147 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.