The US Public Company Accounting Oversight Board (PCAOB) has published a new guidance for auditors that sets out what to look for when considering the relevance and reliability of external information if it is to be used as audit evidence.
The US auditing standard AS 1105, Audit Evidence, clearly explains what is included and how audit procedures should be designed and performed to provide sufficient audit evidence to support the audit opinion. A related research project on the more general topic of big data and technology has made it clear to US regulators that the use of external (relative to the audited entity) data sources affects not only the amount of information analyzed but also its quality. For example, many interactive applications allow you to get a lot of real-time information, including quite specific, relevant to representatives of individual industries. However, how to determine how reliable they are?
Another, more specialized project on audit evidence suggested that US auditors needed further clarification on the use of AS 1105 in a situation where external sources of information were involved in the audit. A new guidance is designed to help, first of all, in determining the relevance and reliability of information obtained from external sources.
The adequacy of audit evidence is a measure of its volume, and the extent to which it is suitable for audit already reflects its quality. Relevant (in other words, qualitative) audit evidence should be both useful (relevant in the context of the audit) and reliable to support the audit opinion. These two concepts (‘sufficiency’ and ‘appropriateness’) are directly related. The amount of data obtained by the auditor that is required to support the audit opinion depends on the risk of material misstatement in the audited statements, and the risks in the internal controls of financial statements, and the quality of the information that constitutes the audit evidence.
Moreover, it turns out that even the concepts of relevance and reliability of information are not independent. Information can be directly related to the subject of the audit, simply from unreliable sources, or vice versa – from reliable sources, but the benefits may be small. In both cases, the auditor needs additional supporting information.