The Informed and Competent Person Standard for Evidence: A CIA Part 2 Guide
Overview
In CIA Part 2 (Practice of Internal Auditing), the topic of information gathering, analysis and evaluation includes a key benchmark for judging evidence: would a prudent, informed (competent) person reach the same conclusion as the internal auditor after reviewing the same evidence? This guide explains what the standard is, why it matters, how to apply it, and how to handle exam questions about it.
1. Why This Standard Is Important
Internal auditors issue conclusions, ratings and recommendations that can affect careers, budgets, regulatory standing and strategic decisions. Those conclusions are only credible if the evidence behind them is strong enough to persuade an objective third party, not just the auditor.
The standard matters for several reasons:
• Objectivity safeguard: It is an external, reasonable-person test. It guards against auditor bias, hunches and personal opinion.
• Defensibility: Management, the audit committee, external auditors and regulators may challenge findings. Evidence that meets the standard can withstand that scrutiny.
• Efficiency: It defines when enough is enough. Auditors do not need absolute proof. They need evidence that is persuasive to a knowledgeable, reasonable person. This prevents both under-auditing and costly over-auditing.
• Quality assurance: Engagement supervisors and QAIP reviewers use this benchmark to judge whether workpapers support the reported conclusions.
• Professional conformance: It comes directly from the IIA Standards. Under the 2017 IPPF it appears in Standard 2310, Identifying Information. Under the 2024 Global Internal Audit Standards it appears in Standard 14.1, Gathering Information for Analyses and Evaluation.
2. What the Standard Is
The IIA requires internal auditors to identify, analyze, evaluate and document information that is sufficient, reliable, relevant and useful (2017 wording). The 2024 Standards emphasize information that is relevant, reliable and sufficient. The informed person test sits inside the definition of sufficiency:
Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the internal auditor.
The full set of evidence qualities is:
• Sufficient: Factual, adequate and convincing, so that a prudent, informed person would reach the same conclusion. This is about quantity and persuasiveness.
• Reliable (historically called competent): The best attainable information through the use of appropriate engagement techniques. This is about quality and trustworthiness. Older auditing literature used the term competent evidence, which is why the concept is often labelled the informed and competent person standard.
• Relevant: Supports the engagement observations and recommendations, and is consistent with the engagement objectives. This is about logical connection.
• Useful: Helps the organization meet its goals (2017 IPPF).
Key words to understand
• Prudent: Careful, sensible and reasonable. The person is not reckless and not excessively skeptical.
• Informed or competent: The person has appropriate knowledge of the subject and the context. It is not a layperson with no background, and not necessarily a world expert.
• Same conclusions: The test is whether the evidence would lead an independent reviewer to the auditor's conclusion. It is not whether the reviewer would merely find the evidence interesting.
3. How It Works in Practice
Step 1: Start from the engagement objective. Evidence is evaluated against what the auditor is trying to conclude. For example, the objective might be that purchase orders over $10,000 are properly approved. Evidence that is irrelevant to that objective cannot be sufficient, however much of it there is.
Step 2: Gather reliable evidence. Reliability generally increases when evidence is:
• Obtained from independent external sources rather than from inside the organization, such as bank confirmations versus internal ledgers.
• Obtained directly by the auditor, through observation, physical examination or reperformance, rather than indirectly or by inquiry.
• In documentary form rather than oral.
• An original document rather than a photocopy or scan.
• Produced under effective internal controls rather than weak ones.
• Corroborated by multiple sources that agree.
Step 3: Gather enough evidence. Sufficiency depends on several factors:
• Risk and materiality: Higher risk or larger amounts call for more evidence.
• Quality of evidence: Highly reliable evidence reduces the quantity needed. Weak evidence cannot be fixed simply by collecting more of it.
• Sample size and selection: Statistical or representative samples support conclusions about populations.
• Contradictory evidence: Conflicting information must be resolved before a conclusion is drawn.
Step 4: Apply the test. Ask: If an objective, knowledgeable reviewer who did not participate in the engagement read my workpapers, would they reach the same conclusion?
• If yes, the evidence is sufficient.
• If no, gather more evidence, obtain better-quality evidence, corroborate, or qualify or limit the conclusion.
Step 5: Document. Under the 2017 Standard 2330 and the 2024 Standard 14.6, workpapers must document the information that supports conclusions. The documentation must let an informed reviewer, such as a supervisor, QAIP assessor or external auditor, trace from evidence to conclusion.
Important nuances
• Persuasive, not conclusive: Audit evidence rarely proves something with certainty. The standard requires reasonable, convincing support, not absolute proof.
• Cost versus benefit: Auditors seek the best attainable information. The cost of obtaining evidence should be weighed against its value, but cost is never a valid reason to skip evidence necessary for a conclusion.
• Inquiry alone is weak: Management's verbal assertions generally do not meet the standard on their own. They must be corroborated.
• Supervision link: Engagement supervisors effectively act as the first informed person. They review whether evidence supports the conclusions before the report is issued.
Worked example
An auditor concludes that inventory counts at a warehouse are unreliable. The only basis is a conversation with one warehouse clerk who said, 'counts are always rushed.'
• Reliable? Weak. It is oral, from a single internal source, and uncorroborated.
• Sufficient? No. A prudent, informed person would not conclude that counts are unreliable from one comment.
• Fix: Observe a count, perform test counts and compare them to records, review count variance reports, and check adjustments.
Suppose test counts of 60 randomly selected items reveal 15 discrepancies, and variance reports confirm recurring large adjustments. An informed reviewer would now reach the same conclusion. The standard is met.
4. How Questions Appear on the CIA Exam
Expect scenario-based multiple-choice questions such as:
• Definition questions: 'Information that is factual, adequate and convincing so that a prudent, informed person would reach the same conclusion as the auditor is described as...' The answer is sufficient.
• Distinguishing attributes: You may need to tell sufficient (enough and convincing), reliable (best attainable and trustworthy) and relevant (relates to the objective) apart.
• Ranking reliability: 'Which evidence is most reliable?' Choose external, auditor-obtained, original documentary evidence, such as a confirmation sent and received directly by the auditor.
• Scenario judgment: 'An auditor's conclusion is based solely on management representations. Which evidence attribute is lacking?' The usual answer is sufficiency and reliability. Look for the option that says the evidence would not convince a prudent, informed person.
• Next-step questions: 'Evidence gathered is contradictory. What should the auditor do?' The answer is to obtain additional evidence to resolve the conflict before concluding.
Exam Tips: Answering Questions on The Informed and Competent Person Standard for Evidence
1. Memorize the trigger phrase. 'Factual, adequate, and convincing' plus 'prudent, informed person' always points to sufficiency. Do not confuse it with reliability.
2. Map each attribute to one keyword.
• Sufficient = enough and convincing to others
• Reliable or competent = best attainable and trustworthy
• Relevant = linked to objectives
• Useful = helps the organization meet goals
3. Remember the reliability hierarchy. Rank evidence from strongest to weakest:
• External sources over internal sources.
• Direct auditor evidence over indirect evidence.
• Documentary evidence over oral evidence.
• Originals over copies.
• Evidence produced under strong controls over evidence produced under weak controls.
• Physical examination or reperformance over inquiry.
4. Treat 'absolute,' 'conclusive' or 'proves' as red flags. The standard requires persuasive evidence, not certainty. Answer choices demanding 100% proof or testing every item are usually wrong.
5. Inquiry alone is almost never enough. If a scenario relies only on interviews or management assertions, the correct answer usually involves corroboration.
6. More evidence does not cure poor quality. If the evidence is unreliable or irrelevant, choose answers that improve quality or relevance over answers that simply increase quantity.
7. Think like the reviewer. When stuck, ask: 'Would an objective, knowledgeable outsider reading the workpapers agree?' Pick the option that makes that answer yes.
8. Link to risk. Higher risk, materiality or sensitivity, such as suspected fraud or regulatory issues, requires more and stronger evidence. Watch for scenarios where the stakes justify additional procedures.
9. Do not let cost override necessity. 'Best attainable' allows for cost-benefit judgment. However, an answer that abandons needed evidence purely to save money is wrong.
10. Connect to documentation and supervision. Questions may tie this standard to workpaper requirements or supervisory review. The correct choice usually states that workpapers must enable a reviewer to reach the same conclusion.
11. Watch for both versions of the Standards. Recognize both 2017 IPPF terms (Standard 2310, including useful) and 2024 Global Internal Audit Standards terms (Standard 14.1: relevant, reliable, sufficient). The prudent, informed person test is the same in both.
Quick Recap
The informed and competent person standard asks whether evidence is factual, adequate and convincing enough that a prudent, knowledgeable third party would independently reach the auditor's conclusion. It works together with reliability and relevance. It is applied through risk-based evidence gathering, corroboration and documentation, and it requires persuasive rather than absolute evidence. On the exam:
• Identify the trigger wording.
• Apply the reliability hierarchy.
• Reject absolute-proof answers.
• Favor corroboration and evidence that a reviewer would find convincing.
