7. Audit Evidence-SS.ppt

Audit EvidenceCollection and DocumentationThe Basics of Internal AuditingOctober 9 ‐ 10, 2014Stephanie Sgouros, CPAOwner, Sgouros Enterprises LLCTALLAHASSEE CHAPTERAgenda Audit Evidence DefinitionsAudit Evidence TypesStandardsSufficiency, Competence, RelevancePreserving Audit EvidenceWorkpapersTALLAHASSEE CHAPTERDefinitions Audit Evidence is defined in the Auditor’sDictionary, by David O’Regan, as “informationthat supports or refutes an audit objective”. Sawyer’s Guide for Internal Auditors statesthat Audit Evidence is “the informationinternal auditors obtain through observingconditions, interviewing people, andexamining records.”TALLAHASSEE CHAPTER1

Legal EvidenceSimilar with a Different Focus Legal Evidence– More testimonial Audit Evidence– Relies more on documentsTALLAHASSEE CHAPTERBest Evidence Also called Primary Evidence More reliable More satisfactory proof of a fact Original documents, especially if signed orinitialedTALLAHASSEE CHAPTERSecondary Evidence Less reliable than primary evidence Use professional skepticism! Example: copy of an invoiceTALLAHASSEE CHAPTER2

TALLAHASSEE CHAPTERSecondary Evidence Copies of originals Oral testimony Written summary notesTALLAHASSEE CHAPTERWhen is a Copy OK? Original was accidentally lost Original was accidentally destroyed Original is not reasonably availableTALLAHASSEE CHAPTER3

Direct Evidence No presumptions or inferences neededto prove a fact Ex. An employee tells you that they arethe person who maintains the payrollregister.TALLAHASSEE CHAPTERCircumstantial Evidence Proves something other than what you aredirectly trying to prove Relies on others making a logicalinference Example: Email has “Pancakes” in thesubject line.TALLAHASSEE CHAPTERCircumstantial Evidence Never put complete trust in circumstantialevidence Use professional skepticism! Ex. Email subject line says “French Toast”TALLAHASSEE CHAPTER4

Conclusive Evidence Incontrovertible Only one reasonable conclusion Overwhelms other evidence Does not require corroborationTALLAHASSEE CHAPTERConclusive Evidence Can be of any type Internal auditors love this type of evidence,but we rarely get it. Ex. An employee claims to have a doctor’sappointment but everyone sees him on theJumb-o-tron at the baseball game.TALLAHASSEE CHAPTERCorroborative Evidence additional evidence, supplementary different in character concerns the same point strengthens or confirms evidence alreadyprovidedTALLAHASSEE CHAPTER5

Opinion Evidence may be– Biased– self-serving– uninformed– useful generally not– included in the workpapers– admissible in courtTALLAHASSEE CHAPTEROpinion Evidence – ExceptionExpert Testimony related to a specific topic such as aprofession, occupation or industry that isbeyond the understanding of the averageperson Experts should possess great skill,knowledge or experience in the area of thetestimony and be acknowledged as experts intheir areaTALLAHASSEE CHAPTEROpinion Evidence – ExceptionExpert Testimony Use when audit area is outside yourunderstanding expert should be free from potential bias, ifpossible If expert is in audit area, be aware ofpotential bias. Mitigate potential bias with corroboratingevidenceTALLAHASSEE CHAPTER6

Hearsay Evidence secondhand evidence generally inadmissible in court Ex. repeating what someone else said Ex. providing a document someone elsepreparedTALLAHASSEE CHAPTERHearsay Evidence – ExceptionBusiness Document made in the ordinary course of business generally trustworthy Assumed valid unless discreditedTALLAHASSEE CHAPTERHearsay Evidence – ExceptionBusiness Document Business documents made in the ordinarycourse of business include––––purchase ordersvouchersgeneral ledgerscompetitive solicitation requests (ITB, RFPand ITN)– contracts for goods or services– logs, exception reports, etc.TALLAHASSEE CHAPTER7

Hearsay EvidencePhotographs admissible when properly authenticated Auditors can observe photographs beingtaken or take the photographs themselves. If observing, auditors should documentcertain thingsTALLAHASSEE CHAPTERBayview Apts.POOLTALLAHASSEE CHAPTERShady PinesShady PinesPOOLTALLAHASSEE CHAPTER8

AUDIT EVIDENCE Audit evidence is whatauditors obtain through–observation (of conditions)–interviews (of people)–examination (of records)TALLAHASSEE CHAPTERAUDIT EVIDENCE Audit evidence is used to provide afactual basis for audit opinions,conclusions and recommendations (tofindings). Categorized as– physical,– testimonial,– documentary, and– analytical.TALLAHASSEE CHAPTERPhysical Evidence Obtained by observing:–People–Property–EventsTALLAHASSEE CHAPTER9

Physical Evidence Includes:– Statements of observation by observer– Photos– X-rays– Charts/Graphs– Maps*Audit horror story*TALLAHASSEE CHAPTERCrazy Eddie FraudInventory Example http://www.youtube.com/watch?feature player detailpage&list PLEF5DBED538D091B1&v CP8iO5lvCoUTALLAHASSEE CHAPTERExample:Photos as Physical AuditEvidence Exceptions to Proper Separation ofDuties:TALLAHASSEE CHAPTER10

TALLAHASSEE CHAPTERExample:Photos as Physical AuditEvidence Proper separation of duties:TALLAHASSEE CHAPTERTALLAHASSEE CHAPTER11

Weaknssess ofPhotographsA Visit to a Storage WarehouseRestroomTALLAHASSEE CHAPTERTALLAHASSEE CHAPTERTALLAHASSEE CHAPTER12

Testimonial Evidence Letters, memos, emails Responses to surveys/questionnaires,inquiries, interviews May be written or oralTALLAHASSEE CHAPTERTestimonial Evidence Not conclusive by itself Should be supported by other documentation Can be an important lead May provide information not obtainable byindependent audit testingTALLAHASSEE CHAPTERDocumentary Evidence Most common type of evidence May be external May be internal (originates withauditee) Source affects reliabilityTALLAHASSEE CHAPTER13

Analytical Evidence Analysis and verification Source computations, comparisons Types:––––––StandardsPrior year or years’ performanceSimilar operationsLaws/regulationsReasoningComponent informationTALLAHASSEE CHAPTERAnalytical EvidenceReal Life Examples Harry Markopolos on 60 minutes:http://www.youtube.com/watch?v s68FR1MXT8Q Tax ReturnsTALLAHASSEE CHAPTERStandards of Audit EvidenceSufficiencyCompetenceRelevanceTALLAHASSEE CHAPTER14

Standards of Audit Evidence Audit evidence must be sufficient,competent and relevant. What if it isn’t? Get more! Note: Auditor opinions requireinconvertible evidence.TALLAHASSEE CHAPTERSufficiency Is it enough? Is the evidence:– Factual?– Adequate?– Convincing? Would a layperson come to the sameconclusion as the auditor? Use your judgment, but be objectiveTALLAHASSEE CHAPTERCompetence Is it reliable? Is there better evidence that can bereasonably obtained? The Best Evidence Rule applies.*Audit Horror story*TALLAHASSEE CHAPTER15

Relevance Is it useful? Does the information have a logical,sensible relationship to the issue? It can be factual, but not relevant.TALLAHASSEE CHAPTERAudit Evidence Legal Authority Florida Statutes Sections:– 20.055[Inspectors General]– 17.03(1)[State CFO – DFS]– 11.45[Auditor General]– 215.97 aka Florida Single Audit Act– Chapter 119 aka Public Records LawTALLAHASSEE CHAPTERAudit Evidence Legal Authority Internal Audit Charter Federal – Freedom of Information Act(FOIA) Contracts Grant Agreements Record Retention PoliciesTALLAHASSEE CHAPTER16

Audit Evidence - Interviews When do you use?Who do you interview?How do you plan the interview?Use a question formatNote takingRecordingTALLAHASSEE CHAPTER“If you tell the truth, you don’t have toremember anything.” Mark TwainTALLAHASSEE CHAPTERFile Reviews Determine Layout/OrderIdentify Key DocumentsReview Correspondence and NotesLook for gaps/inconsistencies– Dates– Missing pages or signatures– Missing sections/informationTALLAHASSEE CHAPTER17

Document ReviewInternal Forms Is it the form used in the usual course ofbusiness? Is it complete? Signed by the appropriate parties? Are amounts correct? Even automatedforms may have errors!TALLAHASSEE CHAPTERDocument ReviewExternal Forms Is a receiving process followed? (ex.date stamp received) Does the document contain what youmight reasonably expect? Is the form accurate? Are forms from same vendorconsistent? (*Audit Horror Story*)TALLAHASSEE CHAPTERCommon Audit EvidenceDeficiencies Failing to scrutinize importantmanagement assertions Failing to maintain auditor independence Senior audit personnel failing toadequately plan or supervise audit Gathering sufficient evidenceTALLAHASSEE CHAPTER18

Audit Documentation TypeExamples Emails Faxes Vendor Documents (invoices,statements, etc.) Internal Memos Correspondence Other Audit ReportsTALLAHASSEE CHAPTERWhy Preserve Audit Evidence? May need for administrative or judicialproceeding Memories fade Witnesses move away, retire Cooperative relationships turncontentiousTALLAHASSEE CHAPTERPreserving Audit Evidence Some tools used to preserve audit evidence:– Statements (may be notarized)– Affidavits (sworn)– Memos of Interview or Understanding– Depositions (sworn)TALLAHASSEE CHAPTER19

Preserving Audit Evidence– Copies (or originals) of Records– Audio and/or Video Recordings– Photographs– Scanned Images– Summary Notes– Webpage screenshotsTALLAHASSEE CHAPTERPreserving Audit EvidenceChain of Custody:Preservation by successivecustodians of a piece of evidence orany relevant writing in its originalcondition.TALLAHASSEE CHAPTERPreserving Audit EvidenceCharts, Schedules, Summaries may summarize large amounts ofother evidence Use objective, non-prejudicial titles Include SourceTALLAHASSEE CHAPTER20

Preserving Audit EvidenceNotes, Diaries, Workpapers, Memos Generally not considered evidenceMay become public recordsMay aid recollectionMay impeach evidenceMay be subject to legal inspectionTALLAHASSEE CHAPTERPreserving Audit EvidenceAudio and Video Recordings Must be a legal recording Not objectionable hearsay Often need additional evidence toprove certain details (such as date,person speaking, etc.)TALLAHASSEE CHAPTERWhy is documenting the dateimportant?*Audit Horror Story*TALLAHASSEE CHAPTER21

Workpapers Sometimes, if it isn’t written down, itnever happened. Some things are easy to understand butdifficult to document (and vice versa). Workpapers are required to documentevidence.TALLAHASSEE CHAPTERWorkpapersRed Book (IIA) Requirements:2300-1 IA must document relevantinformation to support conclusions.PA 2330.A-1 Workpapers includesupport, review notes, correspondence,regardless of storage. It can bephotographs, videos, recordings or otherphysical evidence obtained.TALLAHASSEE CHAPTERAudit DocumentationBest Practices Provide Source and Purpose onWorkpapers Use a numbering/indexing system Use cross-referencing Ensure workpapers can “stand alone”. Check your office SOP regardingworkpapers/documentation.TALLAHASSEE CHAPTER22

Audit DocumentationBest Practices Secure workpapers and limit access,especially to confidential information When preparing, do not blindly followprior year’s workpapers Keep an inventory of workpapers andmaintain a destruction scheduleTALLAHASSEE CHAPTERAudit DocumentationAudit Program ObjectivesScopeLegal AuthorityPlanningField WorkApprovalTALLAHASSEE CHAPTERAudit DocumentationTest Results Summary Documents:– Population– Sampling– Methodology– Evaluation Critieria– Audit Trail– ResultsTALLAHASSEE CHAPTER23

Audit DocumentationLead Schedules Lists each test item and results for eachtested criterion Provides a summary of the numbertested and the number ofexceptions/deviations Helpful in writing findingsTALLAHASSEE CHAPTERHelpful Reminders Have an open mind – never develop atheory before getting all the facts State the obvious Look closely at what’s in front of you Don’t rely on one photo, one day, oneperson’s opinion Beware of shortcutsTALLAHASSEE CHAPTERResourcesSawyer’s Guide for Internal Auditors,6th Edition (IIA)TALLAHASSEE CHAPTER24