Meredith Mednick

How to prove your quality control system works under PCAOB QC 1000

Earmark Team · September 29, 2026 ·

The manual is thick. The policies are complete. A partner oversees independence, the firm conducts an annual inspection, and every process has a sign-off page. On paper, the firm appears to have quality under control.

Then the same inspection finding returns for the third year.

“We fix the documentation, we don’t fix the problem,” Meredith Mednick, CPA, CA, says in a recent episode of Standard Practice.

PCAOB QC 1000 is designed to address that recurring failure. Effective December 15, 2026, the standard replaces the PCAOB’s interim quality control framework with a risk-based system. Firms must do more than maintain policies. They must show their responses address real risks and work as intended.

Start with risk, not the quality manual

The PCAOB adopted its interim quality control standards in 2003 from AICPA standards that predated the Board. Those standards created a useful baseline, but they were largely prescriptive and static: establish policies, document them, and update them when needed.

They didn’t require a system that learned from its failures. Inspection findings continued to show supervision problems, independence gaps, and weak evidence over complex estimates, even when firms had policies and training in place.

QC 1000 replaces that model with a three-step process:

Establish quality objectives: What should good quality look like at this firm?
Identify and assess quality risks: What could keep the firm from reaching those objectives?
Design quality responses: What targeted actions will reduce those risks to an appropriately low level?

Firms must assess quality risks annually and respond when their circumstances change. A new industry, merger, technology platform, or loss of key personnel may change the firm’s risk profile.

In Meredith’s example, the fictional Clearview Audit Group adds 12 healthcare issuer clients. That growth introduces risks involving revenue recognition, regulation, and specialists. Clearview must update its quality responses before issuing its first healthcare audit report.

“The manual is the output,” Meredith explains. “The risk-based analysis is the input.”

That analysis supports the standard’s central goal of providing reasonable assurance that engagements follow professional and legal requirements and that reports are appropriate in the circumstances.

Eight components must work together

The risk assessment process feeds eight integrated components:

Risk assessment
Governance and leadership
Ethics and independence
Acceptance and continuance
Engagement performance
Resources
Information and communication
Monitoring and remediation

These aren’t separate checklists. A staffing problem can affect engagement performance. A weak reporting culture can undermine monitoring. Outdated technology can create risks across the system.

Governance makes that integration personal. The firm’s principal executive officer, the highest-ranking executive regardless of title, is ultimately accountable for the QC system. Firms must also name one person with operational responsibility for each of three areas: the overall QC system, ethics and independence, and monitoring and remediation. One person may hold several roles, but each role must have one owner.

Firms that issued reports for more than 100 issuers during the prior year must also provide confidential, anonymous channels for complaints and allegations. As adopted in 2024, the standard also required these firms to establish an external QC function to evaluate significant judgments in the annual QC assessment, but the PCAOB voted in September 2026 to rescind that requirement, subject to SEC approval.

Daily audit decisions become quality-control decisions

The standard goes beyond firm leadership. It changes decisions made before and during an engagement.

Independence is an active process. Firms must maintain restricted-entity lists and communicate additions at least monthly. Personnel review them at defined trigger points, such as joining the firm, acquiring an investment, changing roles, or entering a business relationship. The standard requires ethics training near the start of employment and at least annually. Firms above the 100-issuer threshold must automate the process for identifying investments that may impair independence.

Client continuance becomes a quality filter. Firms must consider the integrity and ethical values of management and the audit committee, not only whether the firm has the skills to perform the work. They also need a documented response when they discover, after accepting or continuing an engagement, information that would have caused them to decline it.

Resources include time and technology. Engagement teams need competence, objectivity, and enough time to do the work. AI-assisted tools and third-party platforms must also have suitable capacity, reliability, resilience, and security. Methodologies and templates must be current and used in practice, not left as “wallpaper” on the intranet.

These engagement-level decisions feed the system’s most important feedback loop.

Root-cause analysis must lead to a tested fix

QC 1000 requires engagement monitoring and system-level monitoring. At minimum, firms inspect one completed engagement for each engagement partner on a cyclical basis. Selection must include unpredictability. Firms above the 100-issuer threshold must also monitor in-progress engagements.

When monitoring identifies a QC deficiency, the firm must determine why it happened. Was the cause inadequate training, poor staffing, outdated methodology, weak supervision, failed technology, or a culture that discouraged questions?

The response must address that cause. In the Clearview example, deficiencies involving estimates appear across three issuer audits. Root-cause analysis shows that the firm’s methodology was not updated after the estimates standard changed. The answer is not another generic training session. Clearview must update the methodology, train its people, and monitor later engagements to confirm the fix works.

Work backward from September 30

Each year, firms evaluate their QC systems as of September 30 and reach one of three conclusions: effective with no unremediated deficiencies; effective except for deficiencies that aren’t major; or not effective because major deficiencies exist.

The firm reports its conclusion to the PCAOB on nonpublic Form QC by November 30. The principal executive officer and the person responsible for the QC system certify the filing. The firm must assemble its final QC documentation by December 14 and retain it for seven years. Since we recorded, the PCAOB adopted targeted amendments on September 9, 2026. If the SEC approves them, they would take effect with QC 1000 on December 15, 2026, let each firm choose its own annual evaluation date instead of September 30 (with Form QC due within 60 days after that date), shorten documentation retention to five years, and allow the specified QC roles to be divided among several people or assigned to non-firm personnel.

To prepare, firms should:

Conduct a real gap analysis across all eight components
Assign and communicate accountability roles now
Make monitoring support root-cause analysis, not just list findings
Schedule required work by counting backward from your evaluation date
Map existing ISQM 1 or SQMS 1 programs to QC 1000’s distinct requirements
Track SEC approval of the targeted amendments the PCAOB adopted on September 9, 2026

A thick manual can’t prove audit quality. A working system can. Listen to the full Standard Practice episode to hear Meredith’s complete walkthrough and consider which part of your firm’s QC system needs attention first.

On September 9, 2026, the PCAOB adopted amendments to QC 1000, three months before they take effect. This is a companion to episode two, PCAOB QC 1000, A Firm’s System of Quality Control, covering the recent changes.

IFRS 18 changes the story your income statement tells

Earmark Team · September 29, 2026 ·

Two companies operate in the same industry, under similar conditions, in the same year. One includes share-based payment expense in operating profit; the other excludes it. One includes a goodwill impairment; the other presents it below that line. Both comply with IFRS, yet investors end up “comparing apples to oranges,” Blake Oliver, CPA, said on an episode of Standard Practice.

IFRS 18 was created to address that problem. Host Meredith Mednick, CPA, CA, walked through the new standard with Blake. His first reaction to replacing IAS 1 fell “somewhere between mild panic and deep curiosity.”

Issued in April 2024, IFRS 18 applies to annual periods beginning on or after January 1, 2027. It doesn’t change when companies recognize transactions or how they measure them. Instead, it changes how they present and disclose financial performance. That may sound limited, but the implementation work isn’t.

Operating profit gets a standard foundation

Under IAS 1, companies had broad discretion over how they classified income and expenses and the subtotals shown above profit or loss. Most presented operating profit, but there was no standard definition of what belonged in it.

IFRS 18 introduces five required categories for income and expenses:

Operating
Investing
Financing
Income taxes
Discontinued operations

Operating is the residual category. You first ask whether an item belongs in one of the other four categories. If it doesn’t, it is operating. As Blake explained, “If it doesn’t meet the criteria for another category, it’s operating, full stop.”

That means a company can’t remove a cost from standardized operating profit simply because it is large, volatile, or unusual. For example, restructuring costs remain in operating even if management considers them one-time charges. A gain or loss on production machinery also goes to operating, although the related cash proceeds may appear in investing activities under IAS 7.

That distinction is important because the investing and financing categories under IFRS 18 don’t match the categories with the same names in the cash flow statement.

Classification follows the economics

Although IFRS 18 reduces presentation choices, it doesn’t eliminate judgment. Instead, accountants must determine how an asset or liability produces its return or cost.

The investing category includes specified income and expenses from associates, joint ventures, unconsolidated subsidiaries, cash and cash equivalents, and other assets that generate returns individually and largely independently of the company’s other resources. Dividends or fair value gains from listed shares may qualify. Depreciation on a delivery fleet doesn’t qualify because those vehicles work with employees, warehouses, and other operating resources.

The financing category focuses on liabilities. Its treatment depends on whether a liability arises only from raising finance:

Bonds, bank loans, and similar financing arrangements can place several related gains and expenses in financing
Trade payables, leases, pension liabilities, and provisions generally place only separately identified interest and interest-rate effects in financing

For example, current service cost on a defined benefit plan is operating, while separately identified net interest is financing. Foreign exchange differences generally follow the underlying item: FX on a supplier payable is operating, while FX on a bond payable is financing. Limited relief allows operating classification when allocation would require undue cost or effort, but inconvenience alone is not enough.

Once IFRS 18 establishes those general rules, it adds an important exception for certain business models.

Core financial activities may stay in operating

Investing in assets or providing financing to customers may be a company’s main business activity. This can apply to investment entities, investment property companies, insurers, banks, other lenders, and manufacturers that finance customer purchases.

These entities may have to include items that would normally fall under investing or financing in operating. Otherwise, a lender’s operating profit could exclude the interest spread at the center of its business.

This is a fact-based assessment rather than an accounting policy choice. Evidence may include gross-profit-style measures such as net interest income and information reported under IFRS 8. The assessment also occurs at each reporting level. A subsidiary and its consolidated parent can reach different conclusions, creating a need for consolidation adjustments.

Once you settle those classifications, the new statement structure begins to take shape.

New subtotals and disclosures improve comparability

IFRS 18 introduces two key subtotals: operating profit and profit or loss before financing and income taxes. The second combines operating profit with the investing category, allowing users to compare performance before financing costs and taxes.

An exception applies when an entity provides financing to customers as a main business activity and elects to classify in operating the income and expenses from all its finance-raising liabilities, including those unrelated to customer financing. It can’t present a subtotal labeled “before financing” because that description would be misleading.

Companies may still communicate adjusted measures, such as operating profit before restructuring costs. However, qualifying management-defined performance measures used in public communications will require disclosures in the financial statements. Blake described this as bringing non-GAAP measures into the statements “in a controlled and transparent way.”

IFRS 18 also requires the analysis of operating expenses to appear in the statement of profit or loss by nature, function, or a mix. If the financial statements present expenses by function, the footnotes must also disclose key nature amounts, including employee benefits (including share-based payments), depreciation, amortization, impairments, and inventory write-downs, by function. Companies should use labels like “other” only when they don’t have a more informative description available.

These changes lead directly to the most urgent issue of timing.

The practical deadline arrives before year-end 2027

IFRS 18 applies retrospectively. For a company with a December year-end, that means:

They must apply IFRS 18 to their 2027 annual statements
They must restate their 2026 comparative statement
The financial statements must present a reconciliation from the previous IAS 1 presentation
Its first 2027 interim report must already use IFRS 18 headings and subtotals and include the required comparative reconciliation

As Meredith warned, implementation must be “substantially completed before the first interim financial reporting date of the adoption year, not just before the annual year-end.”

Start by assessing main business activities at every reporting level. Then map each income and expense item to a category, identify data gaps, review your expense presentation, inventory externally reported performance measures, and plan the required systems, training, and consolidation changes.

IFRS 18 doesn’t change what a company earns. It changes how clearly financial statement users can understand and compare that performance. For the full classification walkthrough and implementation discussion, listen to the Standard Practice episode.

How to write audit work papers that still hold up five years from now

Earmark Team · September 29, 2026 ·

Early in her career, Meredith Mednick, CPA, CA, completed an audit procedure, got a result she liked, and decided to document it later.

Later came. The client had moved on, the files had been reorganized, and Meredith’s senior wanted a step-by-step explanation before signing off. Meredith had only a sticky note with a few bullet points and one mysterious abbreviation: “KINV.” She couldn’t reconstruct exactly what she tested, which evidence she reviewed or why the result was acceptable.

That uncomfortable moment frames Episode 4 of Audit Fundamentals, where Meredith points out that your documentation is your audit. Procedures, conversations, and conclusions that live only in your memory can’t support the audit opinion.

Write for the auditor who wasn’t in the room

Audit documentation is the written record of the procedures performed, relevant evidence obtained, and conclusions reached. Each part matters.

The file must show what you actually did, not simply what the audit program instructed you to do. It must include or clearly reference the schedules, confirmations, invoices, bank statements, and other evidence you examined. Finally, every procedure must lead to a conclusion.

This record supports the audit opinion, allows managers and partners to review the work, and gives next year’s team a reliable starting point. It also shows regulators, peer reviewers, and courts that the engagement complied with professional standards.

Under AU-C 230 and PCAOB AS 1215, documentation should allow an experienced auditor with no previous connection to the engagement to understand:

The nature, timing, and extent of the procedures performed
The evidence obtained and results of the procedures
The significant judgments behind the conclusions

Your work paper can’t depend on what your senior already knows or on a conversation from last Tuesday. It must stand on its own.

Give the reviewer enough detail to retrace your work

Once we write for an unknown reviewer, specificity stops looking like busywork.

A heading such as “Revenue testing” provides almost no context. A useful opening identifies the account, assertion, period, objective, population, and sampling method. Meredith offers a stronger example: testing occurrence and cutoff for revenue transactions over $50,000 recorded from December 18 through 31, using 25 randomly selected items from a population of 142.

Procedure descriptions need the same level of detail. “Reviewed inventory balances” is too vague. Instead, explain that you obtained the December 31 inventory summary, agreed it to the trial balance, randomly selected 30 items, located them during the December 28 observation, counted them, compared the results with perpetual records, and tested the roll-forward of activity from December 28 to December 31.

Then organize the evidence so another auditor can follow it:

Identify sampled items by invoice number, date, amount, or another unique detail
Include referenced schedules or clearly cross-reference where they can be found
Define every tick mark in a legend
Connect each supporting document to the procedure and conclusion it supports

A document placed in the file without explanation isn’t useful evidence. It’s clutter.

Show the reasoning, especially when the evidence gets messy

Clear documentation does more than report a clean final answer. It shows how you handled uncertainty and contradictory information.

“Allowance reviewed; deemed reasonable” records a conclusion but not the judgment behind it. For a significant estimate, the file should explain the assumptions evaluated, alternatives considered, information tested, and reasons the team accepted or rejected management’s position.

For example, documentation of a goodwill impairment assessment should cover key assumptions, comparisons with market data or industry benchmarks, sensitivity analysis, testing of the underlying data, and the basis for the conclusion.

Contradictions also belong in the file. If a customer confirmation is $5,000 lower than the recorded receivable, document the difference, your investigation, the evidence obtained, and why you concluded it was a timing difference rather than a misstatement. The investigation is the work.

The same principle applies when management says damaged inventory will sell next quarter or that a related-party receivable is fully collectible. Record how you challenged that explanation and what independent support you examined. As Meredith explains, professional skepticism on the page is intellectual rigor.

Document promptly and protect the record

Good details get harder to capture over time. Under AU-C 230, you generally have to assemble the final file within 60 days of the report release date. PCAOB AS 1215 now allows just 14 days, down from 45, for audits of fiscal years beginning on or after December 15, 2025 (a year earlier for firms that audit more than 100 issuers). Those windows are for assembling the file, not finishing the work: procedures, documentation, and reviews must be complete before the report is released. Once the file is final, nothing can be deleted, and anything you add must record when it was added, who added it, and why; you can’t make additions appear as though they were always present.

Firms generally must retain files for five years for nonpublic audits and seven years for public-company audits. That means today’s work paper may need to speak for you years from now.

Aim to document procedures the same day or the next day. As you work, avoid these common mistakes:

Don’t copy last year’s work paper and merely change the date. Reassess current-year risks and facts.
Don’t describe a procedure without recording its result.
Don’t rely on a client-prepared schedule simply because it foots and ties. Test the completeness and accuracy of its data.
Don’t leave important conversations undocumented. Record who participated, when the discussion occurred, what was said, and how you evaluated it.

Firm templates and review styles may vary, but the professional standard doesn’t.

Treat every work paper as a story

Meredith encourages auditors to think of themselves as authors rather than form-fillers. A strong work paper tells a complete story: what you wanted to prove, what you did, what evidence you examined, what you found, and why the result supports your conclusion.

Before closing a work paper, ask:

Could another auditor understand exactly what I did, found, and concluded without asking me?
Does the file show that I independently evaluated management’s representations?
Would a regulator reviewing it five years from now see that I followed the standards and reached a reasonable conclusion?

If any answer gives you pause, strengthen the file now. Then listen to the full episode for Meredith’s complete examples and guidance. Document your work like it matters, because it does.

Audit Assertions Are the Difference Between Doing Procedures and Proving Something

Earmark Team · September 29, 2026 ·

In her first week at an accounting firm, Meredith Mednick, CPA, CA, looked ready. She had a new laptop bag, a carefully planned business-casual outfit, and the determination to start strong.

Then Dana, her confident third-year senior, dropped a binder on her desk and said, “We’re starting our audit with revenue. Pull the assertions.”

Meredith smiled, nodded, wrote it down, and immediately searched for “audit assertions” under the table.

If that sounds familiar, Episode 2 of Audit Fundamentals is for you. Meredith begins with a question every auditor should ask: If you don’t know what you’re trying to prove, how will you know when you prove it?

Audit assertions answer that question. They connect management’s claims to the evidence we need and give each audit procedure a clear purpose.

Financial statements contain specific claims

Audit assertions are the explicit or implied representations management makes about financial statements and the transactions and balances behind them. When a CFO approves the statements, management claims the information is fairly stated.

Our job isn’t to assume management is wrong. But we can’t simply take management’s word for it. We must gather sufficient, appropriate audit evidence to support or challenge each claim.

Meredith compares this process to buying a used car. The seller says the car runs well, the mileage is accurate, and the title is clear. A careful buyer still consults a mechanic, checks the Carfax, and verifies the title. The buyer isn’t calling the seller a liar when they independently test the claims.

Assertions organize that testing into two groups:

Assertions about transactions and events during the period
Assertions about account balances and disclosures at period-end

Understanding the difference is crucial because transactions and balances can fail in different ways. With that framework in place, we can examine the five transaction-level assertions.

Five questions test activity in the ledger

For every transaction, ask these five questions:

Occurrence: Did it happen? Suppose the revenue ledger includes a $500,000 sale dated December 15. Vouch from the ledger back to the invoice, contract, shipping document, or proof of delivery. This helps detect fictitious or premature revenue.
Completeness: Did we capture everything? Start with source documents and trace them forward into the ledger. For accounts payable, those documents might include vendor invoices, purchase orders, and receiving reports. Occurrence asks whether recorded items are real; completeness asks whether real items are missing.
Accuracy: Is the amount right? Recalculate the price, quantity, terms, and other data. For a foreign-currency transaction, verify the exchange rate and whether they used the correct type of rate, such as the spot rate on the transaction date or a permitted average rate.
Cutoff: Is it in the correct period? If $2 million of inventory ships on December 30 but they process the invoice on January 3, determine which period should include the revenue. Test transactions on both sides of year-end because revenue can be pulled forward and expenses can be pushed back.
Classification: Is it in the right account? A $50,000 exterior paint job is generally an operating expense. If it was part of a major renovation that extended the building’s life, the accounting could differ. As Meredith says, “Context always matters.” Read the supporting agreements and document your reasoning.

Those questions address activity during the year. Period-end balances require a related but different set of tests.

A balance can look right without being right

The five main balance and disclosure assertions focus on what appears in the financial statements at a specific date:

Existence. Are the assets, liabilities, and equity interests real? A schedule listing $10 million of inventory doesn’t prove the goods are present. Attend the inventory count, obtain bank confirmations, send receivable confirmations directly to customers, and inspect fixed assets. If a customer doesn’t answer a confirmation, use alternative procedures such as reviewing later cash receipts, invoices, and shipping documents.
Completeness. Did the client record everything that should be recorded? This assertion is especially important for liabilities. Search for unrecorded obligations by reviewing invoices received after year-end, subsequent events, board minutes, loan agreements, and attorney letters.
Valuation and allocation. Did the client record balances at appropriate amounts? A confirmed $5 million receivable may exist but be worth less than $5 million. Test management’s calculations, methods, and assumptions. If a major customer filed for bankruptcy, an allowance model based on five years of unchanged assumptions may not be reasonable anymore.
Rights and obligations. Does the company own or control its recorded assets, and are its liabilities genuine obligations? An $800,000 machine may exist but be leased, pledged as collateral, or owned by a related party. Consigned inventory shouldn’t appear as company-owned inventory when title hasn’t transferred.
Presentation and disclosure. Did the client properly classify, describe, and disclose all items? Read the statements and footnotes from beginning to end, compare them with the reporting framework, and tie the notes back to the financial statement amounts.

Once we understand these assertions, the next step is to decide which ones matter most for each account.

Risk should drive the audit program

We shouldn’t give every assertion equal attention. The risk of material misstatement determines the procedures we design:

Revenue. Focus on occurrence and cutoff because fictitious or premature sales can inflate results
Inventory. Focus on existence and valuation because inventory is physical and can be difficult to measure
Accounts payable. Focus on completeness because liabilities may be understated

A single issue can affect more than one assertion. For example, a sale recorded on December 31 with a January 2 shipping document raises both cutoff and occurrence concerns.

Turn each procedure into evidence

Meredith compares an audit to a prosecutor’s case. A prosecutor must prove specific elements with specific evidence. Auditors do the same. We test specific assertions for significant accounts and disclosures.

For every procedure, ask:

What am I trying to prove?
Which assertion does this procedure address?
Is this procedure the right one to test that assertion?
Have I documented that connection clearly?

If you can’t identify the assertion, there may be a gap between the work performed and the conclusion reached. Understanding that connection helps us move from completing procedures to understanding why they matter.

Listen to the full Audit Fundamentals episode for Meredith’s complete walkthrough. Above all, keep asking the question behind every procedure: What am I trying to prove?

Is your audit evidence sufficient and appropriate, or just abundant?

Earmark Team · August 25, 2026 ·

Early in her audit career, Meredith Mednick, CPA, CA, received an assignment that sounded simple. She was auditing a midsize manufacturing company and needed evidence that its accounts payable balance was complete. If the company owed money at year-end, the liability needed to be on the books.

Meredith asked the AP manager whether any bills received before year-end had missed the system. The manager smiled and said, “No, I don’t think so.” Meredith wrote down the answer and thought she was finished.

She wasn’t.

Her senior reviewed the working paper and asked, “What else do you have?” Then she explained, “Inquiry alone is rarely enough. What would make you more confident that her answer is right?”

That question changed how Meredith viewed audit evidence. In Episode 3 of Audit Fundamentals, she explains AU-C 500, Audit Evidence, through a fictional client, Harborview Manufacturing. Her central lesson is evidence isn’t a pile of documents collected to complete a checklist. It is the basis for an independent, defensible conclusion.

Good evidence must pass two tests

AU-C 500 defines audit evidence as all the information an auditor uses to reach the conclusions behind the audit opinion. That includes invoices, contracts, bank statements, nonfinancial data, client responses, auditor calculations, and direct observations.

The crucial question isn’t whether something counts as evidence. It’s whether the evidence is sufficient and appropriate.

Sufficiency means quantity. There is no magic sample size. The amount of evidence you need depends on the risk of material misstatement, the population size, the quality of the evidence, and whether initial testing found errors. Higher risk calls for more evidence.
Appropriateness means quality. Appropriate evidence must be relevant to the assertion being tested and reliable based on its source and nature.

Evidence is also cumulative. To test Harborview’s accounts receivable, an auditor might use customer confirmations, year-over-year analysis, transaction testing, a review of the allowance for doubtful accounts, and subsequent cash receipts. Each procedure adds another piece to the case.

But more evidence isn’t always better. A large volume of weak or irrelevant material can’t support a strong conclusion. That makes the connection between the procedure and the assertion essential.

Match each procedure to the assertion

Before performing a procedure, ask, “What assertion am I testing?” and “Does this procedure provide evidence about that assertion?”

Harborview’s inventory shows why this matters:

Existence: Observe the physical count and trace selected items from count sheets to the warehouse
Completeness: Select goods from the warehouse floor and trace them to the count sheets and final inventory listing
Valuation: Inspect cost records, recalculate standard costs, ask about obsolete inventory, and compare unit costs with the prior year
Rights and obligations: Review purchase agreements and confirm consignment arrangements to determine which goods Harborview owns

Seeing inventory in the warehouse supports existence. It doesn’t prove Harborview owns the goods or valued them correctly.

AU-C 500 identifies eight evidence-gathering procedures:

Inspection of records
Inspection of tangible assets
Observation
Inquiry
Confirmation
Recalculation
Reperformance
Analytical procedures

Each has limits. Recalculation can confirm the math in a depreciation schedule, but it can’t prove the estimated useful lives are reasonable. Observation shows how a process worked while you watched, not how it operated all year.

Once you choose the right procedure, you still need to judge the reliability of the evidence it produces.

Stronger evidence comes from stronger sources

AU-C 500 provides a practical reliability hierarchy:

External evidence is generally more reliable than internal evidence
Evidence the auditor obtains directly is generally more reliable than evidence supplied by management
Documentary evidence is generally more reliable than oral evidence
Original documents are generally more reliable than copies

For example, a bank confirmation sent directly to the auditor is stronger than a cash reconciliation prepared by the controller. An auditor’s inventory test counts are stronger than a spreadsheet supplied by management.

This hierarchy helps auditors understand each source’s limits and decide when they need corroboration. Inquiry can point you toward useful evidence, but it rarely supports a conclusion by itself.

That need for corroboration leads directly to professional skepticism.

Professional skepticism starts with following up

AU-C 200 describes professional skepticism as a questioning mind, alertness to possible fraud or error, and critical assessment of evidence. Meredith prefers “remain open, but verify” to the familiar phrase “trust but verify.”

Red flags may include altered documents, unusual year-end transactions, delayed responses, incomplete records, changing explanations, or financial relationships that no longer make sense. For example, if revenue rises while cash collections remain flat, the auditor should investigate why.

The same rule applies to testing exceptions. If a customer confirmation is $15,000 below Harborview’s aging schedule, the difference might reflect timing, a disputed invoice, or a recording error. The auditor must determine which. An unexpected result is a signal, not a conclusion.

Following up is only part of the job. The work paper must also preserve the reasoning.

Document the path to your conclusion

Meredith identifies five common evidence mistakes:

Relying on inquiry without corroboration
Performing procedures without identifying the assertion
Accepting copies without question
Failing to resolve unexpected results
Gathering evidence without documenting a conclusion

Under AU-C 230, a working paper should show the nature, timing, and extent of the procedures; the evidence and its source; the assertion tested; any exceptions and follow-up; and the conclusion.

Meredith suggests asking, “Could a peer reviewer understand, two years later, what you did and why you reached your conclusion?” If not, you’re not done with documentation.

Build confidence one conclusion at a time

After Meredith’s senior challenged her first AP working paper, they reviewed vendor statements and invoices received in January and February. Together, they searched for unrecorded liabilities. They found no material misstatement, but Meredith had evidence supporting a real conclusion. That’s more valuable than a checked box.

On your next working paper, name the assertion, choose procedures that address it, evaluate the reliability of your evidence, resolve every exception, and state your conclusion clearly.

For Meredith’s full walkthrough of AU-C 500, listen to Episode 3 of Audit Fundamentals.