Documentary Evidence
Documentary evidence is obtained from the audited organization or from third parties, in hard copy or in electronic format. Documentary evidence can include documents prepared by an organization for its oversight body, documents prepared by the oversight body for its own use, and legal documents that set the organization’s operational context.
Obtaining adequate documentary evidence during an audit of oversight may be challenging for a number of reasons:
- Some oversight processes may be informal and/or undocumented (“soft controls”) but nonetheless real.
- Some organizations nowadays put less and less information in their board minutes, limiting the usefulness of this source of evidence.
- Management may be seeking to interpose itself between auditors and board members, controlling the access to documentation.
- It may be impossible for auditors to obtain documentation about what was discussed during in camera meetings (when no record is kept).
To work around these challenges, auditors may need to conduct more interviews to obtain additional details on the nature and results of discussions held during oversight body meetings, and to document informal controls. Auditors may also need to clearly assert their access to information rights as provided in their office’s mandate.
In addition, auditors may face situations where minutes of oversight meetings constitute their main source of documentary evidence for an audit observation. This may be problematic since minutes are considered secondary evidence and it may be difficult to demonstrate that there are sufficient controls in place to ensure that the minutes are reliable. In such a case, to avoid overreliance on minutes, the documentary evidence can be supported by testimonial evidence of some kind (interviews or written assertions). When there is a public version of the minutes and a more complete, internal version, it is suggested that auditors use the internal version.
LinkedIn
Twitter