Under ISA (UK) 500, audit evidence is sufficient when there is enough of it, given the assessed risk and the quality of what has been obtained, and appropriate when it is both relevant to the assertion being tested and reliable. Whether the evidence is enough is a matter of professional judgement, but the standard sets clear principles: more evidence cannot make up for poor quality, and evidence from independent sources, obtained directly and in documentary form, is generally more reliable.

What does ISA (UK) 500 require?

ISA (UK) 500 Audit Evidence, in its edition updated in September 2025, has a short set of requirements. Paragraph 6 requires the auditor to design and perform audit procedures appropriate in the circumstances to obtain sufficient appropriate audit evidence. Paragraph 7 requires the auditor to consider the relevance and reliability of information used as evidence, including information from external sources. Paragraphs 8 and 9 deal with work by a management’s expert and information produced by the entity, paragraph 10 with selecting items for testing, and paragraph 11 with inconsistent or doubtful evidence. The objective in paragraph 4 is evidence that lets the auditor draw reasonable conclusions on which to base the opinion. For how this fits with the other standards, see ISAs (UK): the auditing standards.

What do sufficient and appropriate actually mean?

Paragraph 5 defines the two terms.

Sufficiency
The measure of the quantity of audit evidence. The quantity needed is affected by the assessed risks of material misstatement and by the quality of the evidence.
Appropriateness
The measure of the quality of audit evidence, meaning its relevance and its reliability in supporting the conclusions on which the opinion is based.

Paragraph A8 links them. The higher the assessed risk, the more evidence is likely to be needed; the higher the quality, the less may be required. But obtaining more evidence may not compensate for its poor quality. Fifty unsigned spreadsheets prepared by the finance director do not equal one bank confirmation.

Paragraph A10 explains that deciding whether enough has been obtained to reduce audit risk to an acceptably low level is a matter of professional judgement, informed by the nature of the procedures, the timeliness of reporting and the balance between benefit and cost. Paragraph A7 connects this to reasonable assurance under ISA (UK) 200.

What makes evidence relevant?

Relevance is about the logical connection between the evidence and the purpose of the procedure. Paragraph A31 gives the classic example of direction of testing. To test whether trade payables are overstated, testing the recorded payables is relevant. To test whether they are understated, it is not: the auditor needs evidence from outside the recorded balance, such as payments after the year end, unpaid invoices, supplier statements and unmatched goods received records.

Paragraph A32 adds that a procedure can be relevant to some assertions but not others. Checking cash received from customers after the year end supports existence and valuation of receivables but not necessarily cut off. Evidence that stock exists, for example from attending the stocktake, says nothing about whether it is valued correctly.

What makes evidence reliable?

Paragraph A35 says reliability depends on the source, the nature of the evidence and the circumstances in which it is obtained, including controls over its preparation. It then gives generalisations, subject to exceptions, summarised here:

More reliable Less reliable
Obtained from independent sources outside the entity Generated inside the entity, unless controls over it are effective
Obtained directly by the auditor, such as observing a control Obtained indirectly or by inference, such as asking about a control
Documentary, whether paper or electronic Oral, such as a later recollection of a meeting
Original documents Photocopies, scans or other transformed copies, depending on controls

The same paragraph warns that external evidence is not automatically good: a source independent of the entity may not be knowledgeable, and a management’s expert may lack objectivity. Paragraph A12 adds that consistent evidence from different sources or of a different nature gives more assurance than individual items considered alone. That is why external confirmations are valued: they are independent, documentary and obtained by the auditor directly.

Is asking management ever enough?

Rarely on its own. Paragraph A6 lists the procedures available: inspection, observation, confirmation, recalculation, reperformance and analytical procedures, often combined, plus inquiry. It states that inquiry alone ordinarily does not provide sufficient evidence of the absence of a material misstatement at the assertion level, nor of the operating effectiveness of controls. Inquiry is a starting point that has to be corroborated.

Paragraph A5 makes two further points. Evidence is cumulative, built up across the audit and sometimes drawing on prior audits if still relevant. And evidence includes information that contradicts management’s assertions, and even the absence of information: a refusal to give a requested representation is itself evidence.

What about reports produced by the client’s own systems?

Paragraph 9 requires the auditor, when using information produced by the entity, to evaluate whether it is sufficiently reliable, including obtaining evidence about its accuracy and completeness and whether it is precise and detailed enough. Paragraph A60 gives the example of testing revenue by applying standard prices to sales volumes: the test is only as good as the price list and the volume data. If a population of payments is incomplete, a test for authorisation drawn from it is less reliable. Paragraph A61 says this evidence may come from the procedure itself, from testing controls over the report, or from separate work.

Where the entity relies on a management’s expert, such as a property valuer or actuary, paragraph 8 requires the auditor, to the extent needed, to evaluate the expert’s competence, capabilities and objectivity, understand their work and evaluate whether it is appropriate evidence. Paragraphs A1 to A4 distinguish external information sources that publish data for a broad range of users, such as published mortality tables or market prices, from an expert commissioned to produce information specific to the entity.

How are items chosen for testing?

Paragraph A63 lists three means of selecting items: all items, specific items, or audit sampling. Paragraph A64 says testing 100 percent may suit a population made up of a small number of large items, a significant risk where nothing else gives enough evidence, or a repetitive automated calculation. Paragraph A65 covers specific items such as high value, unusual or error prone items. Paragraph A66 is the key limit: results from specific items cannot be projected to the rest of the population, so the remainder still needs evidence from another source. Where conclusions about a whole population are needed, audit sampling under ISA (UK) 530 applies.

What if the evidence does not add up?

Paragraph 11 requires the auditor, where evidence from one source is inconsistent with another or there are doubts about reliability, to decide what changes or additions to procedures are needed and to consider the effect on other parts of the audit. Paragraph A68 gives the example of inconsistent answers from management and those charged with governance. ISA (UK) 230 then requires the auditor to document how such an inconsistency was resolved where it relates to a significant conclusion; see audit documentation.

How might this look in practice?

Illustration only. An auditor is testing a 400,000 pounds trade receivables balance at a manufacturer. The aged debt report comes from the client’s system, so the auditor first agrees its total to the ledger and checks a few invoices back into it (paragraph 9). Customer confirmations are sent for the largest balances, and for non replies the auditor checks cash received after the year end to remittance advices. Those receipts support existence, but not cut off (paragraph A32), so invoices either side of the year end are separately matched to despatch notes. A credit controller’s comment that an overdue 30,000 pounds debt is fine is corroborated by correspondence and a later payment before any allowance is judged unnecessary, because inquiry alone is not enough (paragraph A6).

What are the common mistakes?

  • Increasing sample sizes to compensate for weak evidence, which paragraph A8 says may not work.
  • Testing in the wrong direction, for example vouching recorded liabilities when the risk is understatement.
  • Using client reports without checking their completeness and accuracy.
  • Accepting oral explanations without documentary support.
  • Treating a sample chosen by judgement as if its results could be projected. Linking the quantity of evidence to materiality and risk avoids most of these problems.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.