An auditor confirms a $12 million accounts receivable balance with the customer's accounts payable clerk by phone. The clerk says, "yeah, that sounds about right." The auditor checks the box for confirmation and moves on. The exam question is not whether the balance is correct. It is whether what the auditor obtained counts as audit evidence at all.
HIGH-FREQUENCY: AU-C 500 requires evidence to be both sufficient and appropriate. Treat them as two separate tests; the exam loves answer choices that satisfy only one.
Sufficiency is the measure of quantity. How much is enough depends on the assessed risk of material misstatement (higher risk = more evidence) and the quality of the evidence obtained (higher quality = less needed).
Appropriateness is the measure of quality, with two parts: relevance (does the evidence address the specific assertion?) and reliability (is the source trustworthy?). A bank confirmation is highly reliable but not relevant to inventory valuation. A reliable source pointed at the wrong assertion is wasted evidence.
Common mistakes
- Treating quantity as a substitute for quality. Doubling the sample size on internal documents does not turn weak evidence into appropriate evidence. Appropriateness must be addressed first.
- Ignoring the assertion link. Every procedure must point at a specific assertion. Inspecting a fixed asset on the floor confirms existence, not valuation. If an answer choice claims a procedure supports "all assertions," it is wrong.
- Accepting client-routed external evidence as direct. A confirmation arriving via the client's mailroom is no longer external direct evidence. AU-C 505 requires the response to come directly to the auditor: to the auditor's office or through controlled electronic platforms.
Bottom line
- Sufficiency is the quantity of evidence, driven by the risk of material misstatement and the quality of evidence already obtained
- Appropriateness is the quality of evidence: relevance (addresses the assertion) plus reliability (trustworthy source); AU-C 500 requires both
- More reliable evidence means less is needed and weaker evidence means more, but no amount of weak evidence replaces reliable evidence
- Reliability hierarchy: auditor-generated > external direct > external with entity processing > internal with strong controls > internal with weak controls > management oral
Exam shortcut
When a question asks whether evidence is sufficient, run the two-step check: (1) is the source appropriate per the reliability hierarchy, and (2) is the assertion addressed? If either answer is no, the evidence is not sufficient appropriate, regardless of how much was obtained. When a question describes inquiry as the only procedure performed, the answer is always that the evidence is not sufficient.
The full lesson (about 3,931 words, 26 min read) adds 8 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- III.B1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.