Relevance, Sufficiency, and Reliability of Evidence
Introduction
In internal auditing, conclusions and recommendations are only as strong as the evidence that supports them. The IIA Standards require internal auditors to identify, analyze, evaluate, and document sufficient information to achieve the engagement's objectives. Three key qualities determine whether audit evidence can support a sound conclusion: relevance, sufficiency, and reliability. This guide explains each quality, why it matters, how it works in practice, and how to answer exam questions on the topic.
Why It Is Important
Internal audit opinions, findings, and recommendations directly influence management decisions and governance. If evidence is weak, irrelevant, insufficient, or unreliable, the auditor risks drawing incorrect conclusions, damaging credibility, and exposing the organization to undetected risks. Sound evidence:
• Supports objective, defensible conclusions
• Protects the auditor and the function's professional reputation
• Satisfies the IIA Standards (notably Standard 2310 – Identifying Information)
• Provides a reliable basis for workpaper documentation and quality assurance reviews
What It Is
1. Relevance
Evidence is relevant when it has a logical, direct relationship to the audit objective, criteria, or specific condition being tested. Relevant evidence actually addresses the question being asked. For example, to test whether purchases were authorized, approval signatures on purchase orders are relevant; supplier marketing brochures are not.
2. Sufficiency
Sufficiency refers to the quantity of evidence. Evidence is sufficient when there is enough of it—factual, adequate, and convincing—to lead a prudent, informed person to the same conclusion as the auditor. Sufficiency is affected by the level of risk, materiality, and the quality (reliability) of the evidence. Higher risk areas generally require more evidence.
3. Reliability
Reliability (sometimes called competence) refers to the quality and trustworthiness of the evidence. The most reliable evidence is the best attainable through appropriate techniques. Reliability generally increases when evidence is:
• Obtained from independent, external sources rather than internal
• Generated under strong internal controls
• Obtained directly by the auditor (e.g., observation, recalculation) rather than indirectly
• Documentary or physical rather than oral
• Based on original documents rather than copies
How It Works
During fieldwork, the auditor gathers evidence through techniques such as inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytical procedures. The auditor then evaluates:
• Does this evidence relate to my objective? (Relevance)
• Do I have enough evidence to support a conclusion? (Sufficiency)
• Can I trust the source and nature of this evidence? (Reliability)
These three qualities work together. Even highly reliable evidence is useless if it is irrelevant to the objective. A large volume of evidence (sufficient quantity) may still be inadequate if each piece is unreliable. The auditor balances all three to reach a conclusion that would convince a prudent person. All evidence and conclusions should be documented in workpapers to support the engagement results.
Distinguishing the Three Concepts
A common exam trap is confusing the terms. Remember:
• Relevance = does it relate to the objective? (appropriateness of content)
• Sufficiency = is there enough? (quantity)
• Reliability = can it be trusted? (quality/source)
How to Answer Exam Questions
CIA Part 2 questions often present a scenario and ask you to identify which evidence quality is being addressed or which evidence is strongest. Approach them systematically:
1. Read the stem carefully and identify whether the question is about quantity (sufficiency), content/relationship (relevance), or trustworthiness (reliability).
2. Map keywords: 'enough,' 'amount,' 'adequate' point to sufficiency; 'relates to objective,' 'pertains to' point to relevance; 'source,' 'external,' 'original,' 'auditor-obtained' point to reliability.
3. For 'most reliable' questions, choose independent, external, auditor-obtained, documentary, and original evidence over internal, oral, or copied evidence.
4. Eliminate answer choices that describe the wrong quality.
Exam Tips: Answering Questions on Relevance, Sufficiency, and Reliability of Evidence
• Memorize the reliability hierarchy: external > internal; auditor-obtained > provided; documentary/physical > oral; original > copy; strong controls > weak controls.
• Link sufficiency to risk and reliability: more or higher-quality evidence is needed when risk is high or evidence quality is low.
• Watch for the 'prudent person' standard as the benchmark for sufficiency.
• Don't confuse relevance with reliability—relevance is about the connection to the objective, not the source.
• Use process of elimination to discard distractors that describe a different evidence quality.
• Remember oral evidence (inquiry) is the least reliable and usually needs corroboration.
• Confirmations and reperformance are among the most reliable techniques—favor them in 'strongest evidence' questions.
• Tie answers back to IIA Standard 2310, which requires sufficient, reliable, relevant, and useful information.
Conclusion
Relevance, sufficiency, and reliability form the foundation of credible internal audit evidence. Mastering the distinctions among these three qualities—and applying the reliability hierarchy and prudent-person standard—will help you both perform effective audits and confidently answer exam questions on evidence.
