Every audit opinion and every internal audit finding rests on one thing: evidence. If the evidence is thin, unreliable or poorly documented, even a correct conclusion can fall apart under review by a quality inspector, an audit committee or a regulator. ISA 500, Audit Evidence, sets out what counts as audit evidence and what the auditor must do to make sure it is good enough to rely on.
This guide explains what ISA 500 requires, why it matters in practice, where audit teams commonly fall short, and a short checklist you can use on your next engagement. Its principles apply equally to internal auditors and risk and compliance officers.
What ISA 500 requires
The objective of ISA 500 (paragraph 4) is for the auditor to design and perform audit procedures that obtain sufficient appropriate audit evidence to draw reasonable conclusions on which to base the opinion. The key requirements are:
- Paragraph 6 – Sufficient appropriate evidence: design and perform procedures that are appropriate in the circumstances to obtain sufficient appropriate audit evidence.
- Paragraph 7 – Relevance and reliability: consider the relevance and reliability of any information you intend to use as audit evidence.
- Paragraph 8 – Management’s expert: where information was prepared using a management’s expert (for example, a property valuer or actuary), evaluate the expert’s competence, capabilities and objectivity, understand their work, and evaluate whether it is appropriate evidence for the relevant assertion.
- Paragraph 9 – Information produced by the entity: evaluate whether system reports, schedules and other entity-generated information are reliable enough for your purpose, including obtaining evidence about their accuracy and completeness and whether they are sufficiently precise and detailed.
- Paragraph 10 – Selecting items for testing: choose selection methods (all items, specific items or audit sampling) that are effective for the purpose of the procedure.
- Paragraph 11 – Inconsistency or doubts: if evidence from one source conflicts with another, or you doubt the reliability of information, determine what changes or additions to procedures are needed and consider the effect on the rest of the audit.
Sufficiency and appropriateness
Sufficiency is about quantity: how much evidence is needed, which depends on the assessed risk of material misstatement and the quality of the evidence. Appropriateness is about quality: is the evidence relevant to the assertion being tested, and is it reliable? More evidence never compensates for poor-quality evidence.
How reliable is the evidence?
The application material (paragraph A31) gives general guidance, with exceptions acknowledged. Evidence tends to be more reliable when it:
- comes from independent sources outside the entity, such as bank confirmations;
- is generated internally and the related controls are effective;
- is obtained directly by the auditor (for example, by observation) rather than indirectly or by inference;
- is documentary, whether paper or electronic, rather than oral;
- is an original document rather than a copy, fax or scanned version.
The standard also describes the types of procedures used to gather evidence: inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. Inquiry alone is rarely enough.
Why it matters
Audit evidence is where reviewers look first. Quality inspections across many jurisdictions regularly point to weaknesses in the evidence obtained, particularly over system-generated reports and management’s estimates. In Zimbabwe, where auditing standards are set through the Public Accountants and Auditors Board, auditors of banks, listed companies, state-owned enterprises and NGOs face the same scrutiny. Multiple currencies, manual workarounds and heavy spreadsheet use make reliability questions more pressing.
For internal auditors, a finding that can be challenged because its evidence is incomplete undermines the whole function.
Common gaps seen in practice
1. Relying on system reports without testing them
This is the most frequent gap. An auditor receives a debtors’ age analysis, a payroll listing or a fixed asset register from the client and samples from it, without first checking that the report is complete and accurate. If the report omits transactions, the sample can never detect them. Paragraph 9 requires this check. Reconcile the report to the general ledger and test how it was produced. Where the population is large, a dedicated tool such as ProDataTool can help you summarise and reconcile full datasets of millions of rows instead of eyeballing a printout.
2. Over-reliance on inquiry
Working papers that read “per discussion with the finance manager” with no corroboration are a red flag. Inquiry should be followed by inspection, observation or reperformance.
3. Accepting experts’ reports without evaluation
Valuation reports for property, plant and equipment or investment property, and actuarial reports for pension obligations, are often filed without any documented assessment of the expert’s competence, objectivity or assumptions, which paragraph 8 requires.
4. Ignoring contradictory evidence
When a supplier statement does not agree with the creditors’ ledger, or a confirmation reply differs from the books, the difference must be followed up.
5. Copies and scans accepted without question
Scanned invoices and emailed bank statements are now the norm. They can be valid evidence, but the auditor should consider whether originals or direct confirmations are needed, especially where fraud risk is elevated.
A look ahead: ISA 500 is being revised
The IAASB is revising ISA 500 together with ISA 330 and ISA 520 under its Audit Evidence and Risk Response project. An exposure draft of a revised ISA 500 was issued in August 2026, with comments due by 15 December 2026, and the IAASB’s project page indicates approval targeted for December 2027. Its aims include strengthening professional judgement and scepticism and supporting auditors’ use of technology. Until a revised standard is approved and effective, the extant ISA 500 applies.
Practical ISA 500 checklist
| Area | Question to ask | ISA 500 reference |
|---|---|---|
| Procedures | Does each significant risk and assertion have procedures that respond to it, not just generic tests? | Para 6 |
| Relevance | Does the evidence address the specific assertion (for example, existence versus completeness)? | Para 7 |
| Reliability | Is the source external, original and direct where risk is high? | Para 7, A31 |
| System reports | Have you tested completeness and accuracy before relying on or sampling from the report? | Para 9 |
| Experts | Is there a documented evaluation of the expert’s competence, objectivity and work? | Para 8 |
| Selection | Is the selection method (all items, specific items or sampling) suited to the objective? | Para 10 |
| Contradictions | Have all inconsistencies been followed up and resolved, with the effect documented? | Para 11 |
Conclusion
ISA 500 is short, but it underpins every other standard. Good evidence is relevant to the assertion, reliable in its source and form, and sufficient for the level of risk. The quickest wins for most audit teams are to test system reports before using them, to corroborate inquiry, to evaluate experts properly and to follow up every inconsistency.
Keep your audit evidence organised with Auditors Track GRC
Strong evidence also has to be linked to the right risk, finding and report. Auditors Track GRC is internal audit management software that helps organisations across Africa digitise their audit work. It supports risk assessments, audit reviews, findings and report writing, and lets you attach evidence directly to your work. Dashboards by department and engagement type, multi-user department assignments, and built-in libraries of controls, audits, working papers and risks keep your team consistent.
Book a free demo of Auditors Track GRC and see how your team can manage audit evidence in one place.