Want more on finding the “just right” balance in documentation? Check out Sarah Kuhn’s blog “The Documentation Goldilocks Zone.”
New to internal auditing? Build a strong foundation with Tools for New Auditors! This course covers essential skills, industry best practices, and practical insights to help you succeed in the profession. Enroll today and take the first step in your internal audit journey!
View our Podcasts & Video page for more related content!
00:00:03 Desiree Rivera
Hello, welcome to Getting Started With, where our job is to make your job easier.
00:00:09 Desiree Rivera
On this episode, we're getting started with understanding enough evidence.
00:00:13 Desiree Rivera
By the end of this video, you'll understand why balance and documentation matters, how to apply the principles of relevance, reliability, and sufficiency, and some practical tips for improving your work papers.
00:00:25 Desiree Rivera
So let's get started.
00:00:27 Desiree Rivera
Think of documentation like the story of Goldilocks.
00:00:30 Desiree Rivera
New internal auditors often fall into the too much bowl, writing pages of detail that aren't really needed.
00:00:36 Desiree Rivera
Experienced auditors sometimes go the other way and give too little, assuming everyone sees the same connections they do.
00:00:43 Desiree Rivera
The goal is to land in the just right zone, clear, complete, and balanced documentation that supports your conclusions without overwhelming the reader.
00:00:53 Desiree Rivera
How do you know when you've hit that just right point?
00:00:56 Desiree Rivera
Luckily, the standards give us a recipe to follow.
00:01:00 Desiree Rivera
Global Internal Audit Standard 14.1, Gathering Information for Analyses and Evaluation, tells us that documentation should always be relevant, reliable, and sufficient.
00:01:11 Desiree Rivera
These 3 principles are your roadmap for deciding when you've got enough evidence.
00:01:16 Desiree Rivera
Let's start with relevant.
00:01:18 Desiree Rivera
The standards require that documentation be relevant, meaning it's consistent with engagement objectives, stays within the scope, and contributes to your results.
00:01:27 Desiree Rivera
In other words, relevant documentation is the stuff that matters.
00:01:31 Desiree Rivera
It connects directly to your audit's objectives, stays within scope, and actually helps you build your results.
00:01:38 Desiree Rivera
So be sure to ask, does this documentation meet the engagement's objectives?
00:01:43 Desiree Rivera
Is it within scope?
00:01:44 Desiree Rivera
Does it support my conclusion?
00:01:46 Desiree Rivera
Or is it just background filler?
00:01:48 Desiree Rivera
For instance, writing 5 pages on how payroll works may look thorough, but if you only tested one control, all that extra detail isn't relevant.
00:01:56 Desiree Rivera
It's just noise.
00:01:58 Desiree Rivera
The next principle is reliable.
00:02:00 Desiree Rivera
The standards require that documentation be reliable, so factual and current.
00:02:05 Desiree Rivera
Internal auditors are expected to use professional skepticism to decide whether information is reliable.
00:02:12 Desiree Rivera
Reliability is strengthened when it's obtained directly by the auditor, from an independent source, corroborated or drawn from a system with strong governance and controls.
00:02:22 Desiree Rivera
In other words, reliable documentation is trustworthy.
00:02:26 Desiree Rivera
It's up-to-date, fact-based, and something you can stand behind.
00:02:30 Desiree Rivera
So be sure to ask, is this information accurate?
00:02:33 Desiree Rivera
Is it current?
00:02:34 Desiree Rivera
Where did it come from?
00:02:35 Desiree Rivera
Did I collect it myself?
00:02:37 Desiree Rivera
Is it from an independent source?
00:02:39 Desiree Rivera
Or is it backed up by a system with strong controls?
00:02:42 Desiree Rivera
For instance, a system-generated report is...
00:02:45 Desiree Rivera
reliable.
00:02:45 Desiree Rivera
But a casual, don't worry, it's fine from a manager, that's not reliable documentation.
00:02:51 Desiree Rivera
The final principle is sufficient.
00:02:54 Desiree Rivera
The standards require that documentation be sufficient, meaning it allows you to perform analyses and complete evaluations, and it provides enough detail that a prudent, informed, and competent person could repeat your steps and reach the same conclusion.
00:03:09 Desiree Rivera
In other words, sufficient documentation means you've gathered enough.
00:03:12 Desiree Rivera
It gives you the ability to analyze, draw conclusions, and provide a clear trail for another auditor to follow.
00:03:19 Desiree Rivera
So be sure to ask, do I have enough documentation to support my conclusions?
00:03:24 Desiree Rivera
Could another auditor repeat my work and reasonably end up in the same place?
00:03:28 Desiree Rivera
For instance, reviewing 5 transactions when your methodology calls for 30 isn't sufficient.
00:03:34 Desiree Rivera
But reviewing all 5,000 transactions might be overkill.
00:03:38 Desiree Rivera
The goal is to find that just right amount.
00:03:42 Desiree Rivera
Here's a bright idea.
00:03:43 Desiree Rivera
Technology and teamwork can help you find the balance.
00:03:47 Desiree Rivera
If your organization allows it, AI tools can check your documentation against standards or best practices.
00:03:53 Desiree Rivera
Or you can ask a teammate or QA reviewer for feedback.
00:03:57 Desiree Rivera
Sometimes just one extra set of eyes is enough to show if you've gone too far or not far enough.
00:04:03 Desiree Rivera
So what happens if your evidence isn't relevant, reliable, or sufficient?
00:04:08 Desiree Rivera
The standards tell us you have two options.
00:04:11 Desiree Rivera
gather additional information, or if that's not possible, identify the lack of evidence as a potential finding.
00:04:17 Desiree Rivera
In other words, incomplete or weak evidence is a red flag.
00:04:22 Desiree Rivera
Your job as an internal auditor is to recognize it and respond appropriately.
00:04:27 Desiree Rivera
Here's a pro tip.
00:04:28 Desiree Rivera
If you're unsure what's enough, check your department's methodology.
00:04:32 Desiree Rivera
It often provides clear guidance on sampling, evidence, and documentation expectations.
00:04:39 Desiree Rivera
Let's recap.
00:04:40 Desiree Rivera
Documentation is essential, but balance is key to good evidence.
00:04:44 Desiree Rivera
Keep it relevant, reliable, and sufficient.
00:04:47 Desiree Rivera
Avoid rabbit holes, follow your department's methodology, and remember, your goal is to make sure others can follow your logic to the same conclusion.
00:04:57 Desiree Rivera
Thanks for watching Getting Started With, Understanding Enough Evidence.
00:05:01 Desiree Rivera
Next, be sure to check out our episodes on planning, documentation, and writing an audit finding to see how good evidence leads to clearer findings and stronger reports.
00:05:11 Desiree Rivera
You can find these episodes and other helpful resources, including tools, podcasts, and trainings, at the links below.
