Audit Assertions and Evidence Explained for CPA AUD

Audit assertions and evidence are the two halves of every audit opinion. Assertions are the claims management builds into the financial statements. Evidence is the information the auditor gathers to test those claims. Cash is $2 million, says management. Revenue is complete, says management. Nothing material hides off the books, says management. The auditor takes none of that at face value. Instead, the auditor breaks each claim into testable pieces and gathers evidence piece by piece.

The topic carries real exam weight. According to the AICPA CPA Exam Blueprints, Area III, Performing Further Procedures and Obtaining Evidence, accounts for 30-40% of the AUD exam, more than any other area. Assertions and evidence sit at the center of that area. So master this framework early, and plan your sessions with our free study timetable generator so AUD gets the hours it deserves.

Audit assertions and evidence: what assertions are and why auditors care

AU-C 315, as revised by SAS 145, gives the formal definition. Assertions are representations, explicit or otherwise, with respect to the recognition, measurement, presentation, and disclosure of information in the financial statements. Those representations are inherent in management stating that the statements follow the applicable financial reporting framework. SAS 145 applies to audits of periods ending on or after December 15, 2023, so this is the framework current AUD materials test.

Take reported inventory of $5 million. That single number makes several claims at once. The inventory exists. The company owns it. Every item the company owns is recorded. And the value reflects condition and cost correctly. Each claim is a separate assertion, and each one needs its own evidence. A warehouse count supports existence, for example, but it says little about ownership.

Not every assertion matters equally on every audit. An assertion is a relevant assertion when it has an identified risk of material misstatement. Auditors make that call on inherent risk, before considering any related controls. Relevant assertions then drive the nature, timing, and extent of testing. This is where assertions meet the audit risk model: assessed risk at the assertion level decides how much evidence counts as enough.

The assertion categories in audit assertions and evidence

Current AU-C 315 uses two categories, not three. Older notes often show a separate bucket for presentation and disclosure. SAS 145 retired that layout. Today, related disclosures ride inside each of the two categories below.

Category	Assertions	What you are really checking
Classes of transactions and events, and related disclosures	Occurrence, completeness, accuracy, cutoff, classification, presentation	The period’s activity: did it happen, is it all recorded, and did it land in the right period and the right account?
Account balances, and related disclosures	Existence, rights and obligations, completeness, accuracy, valuation and allocation, classification, presentation	The ending numbers: do they exist, does the company own or owe them, and are they valued and placed correctly?

Classes of transactions and events: did the period’s activity get recorded right?

• Occurrence: recorded transactions and events actually happened, and they pertain to the entity. A sale booked for goods a customer never received fails here.
• Completeness: everything that should have been recorded was recorded.
• Accuracy: amounts and other details were recorded correctly.
• Cutoff: transactions landed in the correct accounting period. A December 31 sale that shipped in January fails here.
• Classification: transactions sit in the proper accounts. Repairs belong in expense, not in equipment.
• Presentation: transactions are appropriately aggregated or disaggregated and clearly described, and related disclosures are relevant and understandable.

Account balances at period end: is the ending number right?

• Existence: the assets, liabilities, and equity interests exist.
• Rights and obligations: the entity holds or controls the rights to its assets, and the liabilities are obligations of the entity.
• Completeness: everything that should be recorded is recorded.
• Accuracy, valuation and allocation: amounts are appropriate, and valuation adjustments such as depreciation, allowances, and impairments are recorded properly.
• Classification: balances sit in the proper accounts.
• Presentation: balances are appropriately aggregated or disaggregated and clearly described, and related disclosures are relevant and understandable.

The same two lists, adapted as appropriate, also cover disclosures that do not tie directly to a recorded transaction or balance. Above all, remember that disclosure coverage now lives inside both categories. No third list exists in the current standard.

Issuer audits follow a different map. The PCAOB does not use the AU-C 315 lists at all. Instead, AS 1105 groups assertions into five categories for every account: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure. This note teaches the AICPA lists, because AUD tests those for audits under GAAS. However, recognize the PCAOB set when a question switches to an issuer.

One pairing unlocks dozens of exam questions. Occurrence and existence guard against overstatement: things recorded that should not be there. Completeness guards against understatement: things missing that should be there. When a scenario describes an inflated balance, reach for occurrence or existence. When it describes a hidden one, reach for completeness.

Direction of testing: vouch for existence, trace for completeness

How you test depends on which assertion carries the risk. To test existence or occurrence, start from the recorded amount and vouch back to supporting documents. For example, pick balances from the receivables ledger and confirm them with customers. To test completeness, reverse direction and trace forward from source documents into the books. Shipping records and cash disbursements after year end are classic starting points. The search for unrecorded liabilities works exactly this way, which is why auditors scan payments made after the balance sheet date.

Worked example: testing December revenue

A client reports December revenue of $1.2 million and receivables of $860,000 at year end. First, the auditor selects 25 recorded December invoices and vouches each one to a signed shipping document and a customer order. That step tests occurrence. Next, the auditor takes the final 15 shipping records of December and the first 10 of January. Then the auditor traces each shipment into the sales journal and checks the recorded date. That step tests completeness and cutoff together. A January shipment recorded as December revenue would surface immediately, and revenue would fall by that amount.

Exam trap: external confirmations are powerful for existence and weak for completeness. A customer will happily confirm a recorded balance. That same customer will never report an invoice the client forgot to record, because the confirmation starts from the client’s own list.

Audit assertions and evidence: types of evidence and the reliability hierarchy

Auditors gather evidence through seven procedures: inspection of records, documents, or tangible assets; observation; external confirmation; recalculation; reperformance; analytical procedures; and inquiry. AU-C 500, Audit Evidence, is the AICPA standard that governs how that evidence is judged.

Not all evidence deserves equal trust. AU-C 500 offers five generalizations about reliability, and it calls them generalizations for a reason. Important exceptions exist, so treat the list as a strong default rather than a strict ladder.

1. Evidence from knowledgeable independent sources outside the entity beats evidence from inside it. A bank confirmation the auditor receives directly outranks a client-prepared schedule.
2. Internal evidence grows more reliable when the controls over it work effectively.
3. Evidence the auditor obtains directly beats evidence obtained indirectly or by inference. Watching a count beats hearing about one.
4. Documentary evidence, on paper or in electronic form, beats oral evidence.
5. Original documents beat photocopies or facsimiles. For digitized documents, reliability depends on the controls over how they are prepared and maintained.

Exam trap: inquiry alone ordinarily does not provide sufficient appropriate evidence. It does not prove the absence of a material misstatement at the assertion level, and it does not prove that a control operates effectively. Asking management whether revenue is complete and noting the answer proves nothing on its own. Corroborate inquiry with inspection, confirmation, or recalculation instead.

Sufficiency vs appropriateness: how much evidence is enough

Evidence must be sufficient and appropriate, and candidates mix the two up constantly. Sufficiency is quantity: how much evidence did you gather? Appropriateness is quality, and quality has two parts. Relevance asks whether the evidence addresses this specific assertion. Reliability asks whether you can trust it. The two ideas trade off in a predictable way. Higher assessed risk calls for more evidence. Higher quality evidence means less of it may be needed. Meanwhile, one rule never bends: more evidence does not compensate for evidence of poor quality. A mountain of irrelevant paper is still irrelevant. In short, sufficiency and appropriateness work as a pair, and a weakness in one cannot hide behind strength in the other.

Exam traps in audit assertions and evidence

• The three-bucket trap. Older prep notes list a separate category for presentation and disclosure. SAS 145 removed it. Presentation now appears inside both categories, and classification appears in both lists as well.
• The controls trap. Relevant assertions are identified on inherent risk, before controls enter the picture. An answer choice that makes relevance depend on control testing contradicts the standard.
• The confirmation trap. Confirmations start from recorded amounts, so they test existence well and completeness badly.
• The inquiry trap. Inquiry alone ordinarily is not sufficient, no matter how confident management sounds.
• The quantity trap. Doubling a weak procedure does not fix it. An appropriateness failure stays a failure at any volume.

One-Page Revision: audit assertions and evidence

FAQ

What is the difference between sufficiency and appropriateness?
Sufficiency is the quantity of evidence. Appropriateness is its quality, built from relevance and reliability. A procedure can produce plenty of evidence and still fail, if that evidence targets the wrong assertion or comes from a source you cannot trust. You need both, every time.

Which assertions do bank confirmations test?
Primarily existence: the cash balance at that bank really exists. They also support rights and obligations. A bank confirmation can even surface an account or loan at that same bank that the client left off the books, so it gives limited completeness evidence for that one institution. However, it says little about completeness overall, because accounts at other banks stay invisible.

Are assertions the same as audit objectives?
No. Assertions are management claims about the statements. Audit objectives are the goals the auditor frames from those assertions, such as determining that recorded receivables exist. You test assertions in order to meet your objectives.

How many assertion categories are there?
Under current AU-C 315, two: classes of transactions and events with related disclosures, and account balances with related disclosures. Under PCAOB standards, five categories apply to all accounts. Older three-category lists come from the pre-SAS 145 standard, so retire any notes built on them.

Found this useful? Share it with your study group: WhatsApp | Telegram