Module 4 - Introduction to Performance Audit_4C

equirements must be consistent with the organization’s guidelines and any pertinent
regulatory or other requirements.
2330.C1 The chief audit executive must develop policies governing the custody and
retention of consulting engagement records, as well as their release to internal and
external parties. These policies must be consistent with the organization’s guidelines and
any pertinent regulatory or other requirements. 72
The auditor must determine what should be documented while avoiding the temptation to
include every piece of information gathered. Data should only be included if it is used as
evidence to support conditions and recommendations.
While evidence may include physical evidence (such as samples) and testimonials from
individuals and groups, generally evidence is prepared in digital or paper-based format that
are records derived from multiple sources. Documentation requirements also include records
of analysis. The steps taken to establish the sufficiency, reliability, relevance, and usefulness
of evidence should be clear from the documentation.
Potential weaknesses in each major category of evidence are considered by Rauum and
Morgan where the auditor should take extra care, as shown below.
Physical Evidence – be alert to evidence that:
Is collected without a specific methodology and may not be representative (i.e., it may
be an isolated case or an outlier).
Is a photograph without a record of observation or memo to the record.
Lacks a clear chain of custody (e.g., police confiscated drugs).
Lacks a test of inventory (i.e., may look at an oil tank and assume it is full of oil when
actually it contains mostly water with a layer of oil on top).
Is not witnessed (i.e., comes from only one observer).
Is collected by an unqualified observer.
Is a “setup” (i.e., contrived to give a false or misleading impression).
Documentary Evidence – be alert to evidence that is:
Taken out of context (pulled from other documents).
From a newspaper or magazine article (which may be biased by personal, political,
religious, or other opinion).
Other auditors’ work (i.e., relying on their work without checking).
From a secondary, not a primary, source.
Outdated.
Unofficial.
Refutable.
Controversial.
Incomplete.
Unclear (unidentified acronyms, etc.).
Inconsistent.
72
Standard 2330 – Documenting Information, The International Professional Practices
Framework, The IIA, 2016.
50