COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.
Substantiation is not a concept referred to in CSAE 3001. The CSAE 3001 requires that the audit team prepares audit documentation and that sufficient appropriate evidence be obtained to provide the engagement leader with a reasonable basis to support the conclusions expressed in the report (OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence and OAG Audit 7040 Audit conclusion).
Substantiation is prepared by linking the evidence gathered throughout the audit and the audit documentation that includes logical deductions, judgments, and conclusions to the statements identified. It helps the presenter of the report to quickly locate the source and substance of supporting evidence when needed, such as when debriefing the entity’s management of audit findings, briefing the Auditor General on the draft audit report, acting as a witness at parliamentary committee hearings, or answering queries from the media.
CSAE 3001 Requirements
There are no directly applicable CSAE 3001 requirements and no related application material.
Statements requiring substantiation in the audit report shall be identified by audit team members and reviewed by the engagement leader. [Aug-2021]
Substantiation provides a link or connection between (1) the evidence gathered throughout the audit and the audit documents, such as audit programs and working papers that include logical deductions, judgments, and conclusions and (2) the statements in the audit report. Using the guidance provided below, auditors use professional judgment to determine the statements of the report that would require this link for the purpose of facilitating an easy and straightforward retrieval of underlying information.
The substantiation process
The audit team is responsible for identifying the statements for substantiation in the report. Each of these statements is linked (or connected) to the relevant audit documentation that supports it, for example, evidence collected throughout the audit, audit programs that present conclusions, and working papers that present logical deductions and professional judgments. At the time of performing this exercise, the audit evidence had already been gathered and evaluated (OAG Audit 1051 Sufficient appropriate audit evidence and OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence), and conclusions have been reached and documented. Only in those rare instances when the auditor is not able to connect a statement to existing audit documentation, the rationale supporting the statement is added as part of the substantiation process and will be part of the audit documentation.
Further, if in exceptional circumstances new evidence is brought to the attention of the audit team after substantiation has been performed, this new evidence will be incorporated into the audit documentation.
Roles and responsibilities for substantiation
The preparation and review of substantiation is a team effort and involves all members of the team, as team members have an in-depth understanding on the areas they worked on. The substantiation is prepared by team members and consists of links to audit programs, source documents, evidence, and working papers, including those that explain how the source documents logically support the findings and conclusions (OAG Audit 7030 Drafting the audit report). The specific responsibilities of each team member are defined below:
Auditors prepare substantiation to support the statements in the findings and conclusions. As explained below, in rare circumstances, statements requiring substantiation may be found in other sections of the report. The auditors indicate which statements they have prepared and reference those statements to evidence already obtained.
The audit director reviews the substantiation prepared by audit team members for the principal’s (PX) draft and submits it to the engagement leader for the final review before the PX draft is issued to the audited entity.
The audit director also reviews the substantiation adjusted by the audit team members for the transmission draft and submits it to the engagement leader for the final review before the transmission draft is issued to the audited entity. The substantiation is adjusted only if
significant changes to the report affected statements in such way that the link between the audit evidence and documentation is broken
statements requiring substantiation were added in the report
- The engagement leader documents a review of the substantiation of statements in the report.
- Before issuing the PX draft, the engagement leader reviews the substantiation.
- Before issuing the transmission draft, the engagement leader reviews the adjusted substantiation.
- Internal specialists may review the substantiation for the statements related to their area of expertise.
Principles for substantiation
The following principles outline the format and approach that can be followed in the preparation and review of substantiation.
When thinking about substantiation, the auditor should understand the difference between
linking (or mapping) evidence to audit work such as audit programs and working papers, which is done to support the engagement leader in reviewing the completeness and appropriateness of audit evidence to reduce the risk of error in the report
linking (or mapping) evidence or audit documentation to the audit report statements (that is, substantiation), which is done to facilitate an easier and quicker response if the facts are questioned when the report is presented to third parties
1. Ensure the preconditions for substantiation are met
In order to perform an efficient and useful substantiation, the following preconditions should be met:
Audit teams should clear issues, observations, facts, findings, information received in a timely manner. Clearance with the audited entity should happen and be documented periodically throughout the engagement. Further, it should be performed at the right level (such as the operational or management levels) using the appropriate format (such as emails or periodic status meetings).
The sufficiency and appropriateness of audit evidence should be evaluated throughout the audit and be finalized before commencing the substantiation. In accordance with OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence, the engagement leader is accountable and should ensure that there is sufficient appropriate evidence to support the conclusion of the audit report.
Audit documentation is reviewed and signed off by the engagement leader in a timely manner.
2. Substantiate only what is important
Before undertaking a substantiation exercise, the audit team should determine which statements in the audit report should be substantiated. Substantiation is more suitable for statements that
- are sensitive in nature
- involve complex calculations or analysis
- involve significant judgments
- relate to a significant deviation identified
- are or might be contentious with the entity
- are significant to the well-being of Canadians
- are or might be a source of public debate or media attention
- are key to the conclusion reached
Statements requiring substantiation are mainly found in the “Findings” and “Conclusions” sections of the audit report. As an exception, they might also be found in the “Introduction” section. It is expected that no statements requiring substantiation be identified in the other sections, such as “Recommendations,” “Responses,” or “About the Audit.”
3. Choose the substantiation format and assemble the evidence clearly and logically
Substantiation can be documented in a variety of ways. Two options are
Footnotes—Statements identified in the PX draft are linked to corresponding or supporting evidence or audit documentation using footnotes. As the PX draft changes into the transmission draft, the wording or the sequence of the statements might change, but the links follow them. This method might offer some advantages. For example, as the report draft is reworded, it might be sufficient to review the corresponding sources or links to ensure they still best reflect the new wording.
Appendix—A simple table can be attached to the PX draft with 2 columns: statement (as it appears in the report) and reference or source documentation. Optionally, a third column for paragraph numbers can be added to indicate where the statement is located in the report.
Clear references to audit documentation should be used to document the location of the evidence that supports the statements. At the time of performing substantiation, the audit documentation that is linked to the statements should already include the necessary contextual information, explanations, assumptions, or logic arguments required to understand the evidence. For this reason, when the draft report is reworded, the link that connects the audit documentation to the statement should not be affected. Further, the relevant extract from the audit documentation should be easy for a reviewer to find.
As evidence is obtained and added to the file during the audit, the naming convention for working papers, documents, and interview notes should be followed by the audit team. This will help ensure that the evidence used for substantiation is organized and documented consistently. A protocol has been established that covers file naming conventions and other topics. When interview notes are referenced in the substantiation, include the interviewee’s approval or “sign-off” of the notes.
Determining the appropriate level of substantiation for each statement is a matter of judgment. Auditors should present the strongest or best evidence first and then add supplementary sources only where necessary.
|Tips for performing an easy, straightforward, and efficient substantiation|
|Example of the substantiation process|
Step 1: The auditor goes back to the initial working paper where the related audit work was described.
Step 2: The auditor amends the working paper as necessary based on the new information or evidence.
Step 3: The auditor rechecks if the highlighted paragraphs are still relevant.
Step 4: Nothing—there is no need to go back to substantiation file. The link protects the auditor from having to duplicate work.