Audit programs should take into consideration the audit evidence required/desired as well as the various data gathering techniques.
Rules/standards of audit evidence dictate that the evidence gathered during the audit be:
Sufficient, persuasive. This requires the exercise of good professional judgement. Audit evidence from the most to least persuasive include: physical examination; externally prepared; observations; inquiries/testimonial.
Competent. Obtaining the best quality of evidence available.
Useful. Evidence supporting goals and objectives.
Relevant. Evidence needs to be logical and sensible relative to the audit finding.
The types of audit evidence include:
Analytical. Review of relationships.
Documentary. Evidence exists in some permanent form.
Physical. Evidence is obtained via direct observations.
Testimonial. Statements made by customers/management; typically needs to be corroborated.
Audit programs should also consider the source of information/evidence (has it been "tainted"?):
Internal (bank account reconciliation, for example)
Internal - External - Internal (check)
External - Internal (bank statement)
External (bank account confirmation returned directly to the auditor)
Various techniques are used to gather audit evidence:
When designing detailed audit tests a distinction should be made between "tracing" and "vouching" for two important reasons:
Tracing (going from the source document) is a completeness test; vouching is not.
Tracing detects inappropriate exclusion; vouching may not. Therefore, for example, when looking for fraud tracing and not vouching tests are necessary.
The overall development of the audit program should demonstrate appropriate "linkage" between:
Organization/auditable entity objectives
Management assertions - financial, operational, compliance, specific
Types of audit evidence desired
Data gathering technique