Auditor’s Guide to Information Systems Auditing

Chapter 9. Audit Evidence Process

This chapter explores the fundamental audit evidence process and the gathering of evidence that may be deemed to be sufficient, reliable, relevant, and useful. Evidence gathering techniques such as observation, inquiry, interviewing, and testing are examined and the techniques of compliance versus substantive testing are contrasted. The complex area of statistical and non-statistical sampling techniques and the design and selection of samples and evaluation of sample results is examined. The essential techniques of computer assisted audit techniques (CAATs) are covered and a case study using the IDEA^© software provided with the book is detailed.

Audit Evidence

As noted in Chapter 3, IS Auditors must gather audit evidence in order to express opinions. Audit evidence itself may be classified as sufficient, competent, relevant, or useful and evidence is typically classified as physical, testimonial, documentary, or analytical.

Audit Evidence Procedures

As has been stated, the auditor gathers evidence by following the audit program, which is a set of detailed steps that the auditor will follow in order to gain the appropriate evidence and, for the Information Systems (IS) Auditor, may well include the use of computerized techniques, although this is not always the case.

The evidence gathered permits the expression of an opinion on the efficiency, economy, and effectiveness of the activities. It lists directions for the examination and evaluation of information ...