Evidence Obtained Directly from Independent Sources: CIA Part 2 Guide to Evidence Reliability
Introduction
In CIA Part 2 (Practice of Internal Auditing), the domain Information Gathering, Analysis, and Evaluation tests whether you can judge the quality of audit evidence. One principle comes up again and again: evidence obtained directly from independent sources outside the entity is generally more reliable than evidence obtained from within the organization or through the auditee. This guide covers what the concept means, why it matters, how it works in practice, and how to answer exam questions on it.
Why It Is Important
1. Supports sound conclusions. The Global Internal Audit Standards (and the earlier IPPF Standard 2310) require internal auditors to identify information that is sufficient, reliable, relevant, and useful. Unreliable evidence weakens every finding built on it.
2. Reduces manipulation risk. Evidence that passes through the auditee's hands can be altered, selected, fabricated or concealed. Evidence from an independent party that the auditor receives directly removes that opportunity.
3. Matters most in fraud and high-risk work. When management override, collusion or misstatement is a concern, independent evidence is often the only dependable kind.
4. Protects credibility. Audit reports based on strong evidence hold up when challenged by management, the board, regulators or external auditors.
5. Tested heavily. Reliability hierarchy questions are a classic CIA exam topic and an easy source of marks once you know the rules.
What It Is
Evidence obtained directly from independent sources is information that meets two conditions:
1. It originates from a party outside the auditee's control, such as banks, customers, vendors, legal counsel, government agencies, custodians or independent experts.
2. It is received directly by the auditor, without passing through the auditee or the audited function.
Both conditions are required. A bank statement is external in origin. However, if the client hands it to you, it has passed through the client's hands and could have been altered. A bank confirmation mailed straight back to the auditor is much more reliable.
The Reliability Hierarchy
Ranked from most to least reliable:
1. Direct personal knowledge of the auditor: physical examination, observation, recomputation, reperformance.
2. External evidence received directly by the auditor: confirmations, a direct bank cutoff statement, an attorney's letter.
3. External evidence held or provided by the auditee: vendor invoices, customer purchase orders, bank statements in the client's files.
4. Internal evidence: sales invoices, receiving reports, internal memos. It is more reliable when internal controls are effective.
5. Oral evidence and representations from the auditee: inquiry and management representations. This is the weakest and needs corroboration.
Related Reliability Principles
- Documentary evidence is more reliable than oral evidence.
- Original documents are more reliable than photocopies or faxes.
- Evidence produced under effective internal controls is more reliable than evidence produced under weak controls.
- Evidence that several independent sources corroborate is more persuasive than a single source.
- Objective, quantitative evidence is more reliable than subjective opinion.
How It Works
Common Techniques
- Confirmations: written requests to third parties to verify balances or terms, such as receivables, payables, bank balances, loans, consigned inventory or contract terms.
- Positive confirmation: the third party must reply whether or not it agrees. It is stronger evidence and suits material balances or higher risk.
- Negative confirmation: the third party replies only if it disagrees. It is weaker. Use it only when risk is low, controls are effective, there are many small homogeneous balances, and recipients are expected to read the request.
- Blank confirmation: the recipient fills in the amount. It is the strongest form of positive confirmation because it avoids blind agreement.
- Legal letters: inquiries sent to outside counsel about litigation, claims and assessments.
- Direct cutoff bank statements: sent by the bank straight to the auditor to test the bank reconciliation and detect kiting.
- Independent databases and public records: credit agencies, regulatory filings, property registries, industry benchmarks.
- Third-party specialists: appraisers, actuaries and engineers engaged by the auditor.
Controls the Auditor Must Keep
- The auditor selects the items to confirm and controls preparing and mailing the requests.
- The auditor verifies addresses, emails and phone numbers independently, for example against public directories rather than the auditee's master file alone.
- Responses are returned directly to the auditor, never through the auditee.
- Electronic confirmations require checks on the authenticity of the sender.
- Non-responses to positive confirmations trigger follow-up requests and then alternative procedures, such as examining subsequent cash receipts, shipping documents or contracts.
- Exceptions are investigated. They may be timing differences, errors or fraud indicators.
Limitations
- Third parties may answer carelessly or without checking their records.
- Collusion between the auditee and an outside party can defeat a confirmation.
- Independent sources may lack the knowledge needed, so competence matters as well as independence.
- Confirmations mainly support existence. They do not prove valuation (collectibility) or completeness well. To test completeness of payables, for example, auditors confirm vendors with small or zero balances and search for unrecorded liabilities.
- They take time and money, so auditors balance them against risk.
Example
An internal auditor suspects fictitious customer accounts. Reviewing aged receivables reports from the accounting system is internal evidence and weak. Examining customer purchase orders kept in the sales files is external evidence held by the auditee, which is better but could be fabricated. Sending positive confirmations to customers at independently verified addresses, with replies returned directly to the auditor, gives the strongest evidence of existence.
How to Answer Exam Questions
Step 1: Identify the source. Does the evidence come from inside the organization or outside it?
Step 2: Trace the path. Did it reach the auditor directly, or did it pass through the auditee?
Step 3: Consider the form. Is it documentary or oral, original or copy, and produced under strong or weak controls?
Step 4: Match the assertion. Confirmations prove existence and rights. Physical inspection proves existence of tangible assets. Searching from source documents to records tests completeness.
Step 5: Rank and choose. Pick the option highest in the hierarchy that is also relevant to the objective.
Exam Tips: Answering Questions on Evidence Obtained Directly from Independent Sources
- Memorize the hierarchy: auditor's own observation and recomputation, then direct external evidence, then external evidence held by the auditee, then internal evidence, then oral representations.
- Watch for the word "directly." A bank statement obtained from the client is less reliable than a confirmation received directly from the bank. Examiners often use this distinction to separate two similar options.
- Spot the trap: a third-party document provided by the auditee is not equivalent to one received directly by the auditor.
- Inquiry alone is never sufficient. If an option relies only on management's word, it is usually wrong when a corroborating alternative exists.
- Use positive over negative confirmations whenever the question signals high risk, material balances, suspected fraud or weak controls.
- Recognize when an option breaks auditor control. Letting the auditee mail confirmations or collect replies destroys independence. Expect that option to be wrong.
- Check independence of the source. Evidence from a related party, subsidiary or affiliate is not truly independent.
- Remember the limits of confirmations. If the question asks about valuation or collectibility, a confirmation is not the best answer. Look for subsequent receipts or aging analysis instead.
- Know the follow-up for non-responses. Send a second request, then perform alternative procedures such as subsequent cash receipts or shipping documents. Never simply accept the balance.
- Read the qualifiers. "MOST reliable," "LEAST persuasive" and "BEST evidence" each call for ranking. Eliminate internal and oral options first.
- Combine principles. An original external document received directly is better than a photocopy of the same document from the auditee.
- Balance cost and benefit. Some questions ask what is most efficient rather than most reliable. Negative confirmations can be appropriate in low-risk, high-volume situations.
Quick Practice
Which evidence is MOST reliable for verifying a customer's receivable balance?
A) Copy of a sales invoice in the auditee's files
B) Customer remittance advice held by the auditee
C) Positive confirmation returned directly to the auditor by the customer
D) Oral assurance from the credit manager
Answer: C. It comes from an independent external source and reaches the auditor directly. B is external but passed through the auditee. A is internal. D is oral and the weakest.
Summary
Evidence is most persuasive when it is independent of the auditee, obtained directly by the auditor, documentary, original and relevant to the objective. Ask two questions every time: Where did it come from? and Who handled it before I got it? Answering both will settle most CIA reliability questions.
