An auditor opens a management-prepared aging report showing $4.2 million in receivables over 90 days and uses it to size the bad-debt allowance. The number ties to the trial balance and the footers add up. Six months later, IT admits the aging logic excludes any invoice with a credit memo applied: the real over-90 balance was $6.8 million. The audit failed when the auditor used the report without testing how it was built.
HIGH-FREQUENCY: AU-C 500 lists four factors that drive evidence reliability. Every reliability question on the exam reduces to one of these.
Source. Evidence from a knowledgeable independent third party outranks evidence generated inside the entity. A bank confirmation returned directly to the auditor outranks a bank statement provided by the client; a signed customer contract outranks the controller's internal sales summary. External wins, all else equal.
Nature. Documentary evidence outranks oral inquiry. An original signed document outranks a photocopy or a scanned image with unclear chain of custody.
Common mistakes
- Treating "ties to the trial balance" as a completeness test. Two reports from the same flawed query will tie to each other. Completeness requires reconciliation to an independent total: system record counts, third-party confirmations, or unrelated control footings.
- Skipping IPE testing because the report came from "the system." System-generated does not equal reliable. Custom queries, ad hoc reports, and analyses built outside the controlled reporting environment are still IPE. Without ITGC coverage of the specific report, direct testing is required.
- Confusing source reliability with evidence sufficiency. A confirmation from a knowledgeable third party is highly reliable, but one confirmation may still be insufficient if the assertion needs broader population coverage. Reliability and sufficiency are separate dimensions.
Bottom line
- AU-C 500 reliability rests on four factors: source, nature, circumstances of preparation, and controls over preparation.
- Hierarchy ranks external over internal, knowledgeable third party over client, documentary over oral, original over copy, and auditor-obtained over management-supplied.
- IPE (any client-generated report, schedule, query, or analysis used as evidence) must be tested for accuracy and completeness before reliance.
- Three source data verification tools: agree to underlying records, recalculate report logic, and confirm independently with a third party.
Exam shortcut
When a question describes the auditor using a client-prepared report, schedule, query, or analysis as evidence, the answer almost always involves IPE testing. Look for the choice that pairs the procedure with both accuracy and completeness. Answers that test only one dimension are incomplete.
The full lesson (about 1,969 words, 13 min read) adds 1 worked example, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- III.A2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.