Evidence Strength and Reporting Threshold
Not every analytical output is an audit finding. Exploratory work can be valuable for planning and discussion, but reportable conclusions require stronger evidence, clearer criteria, and appropriate validation.
Evidence-strength scale
| Strength | Typical characteristics | Appropriate use |
|---|---|---|
| Strong | Complete population, validated source, clear control criterion, reproducible test, exceptions reviewed. | Can support audit findings or formal conclusions, subject to normal review. |
| Moderate | Good source data but some assumptions, partial coverage, or manual interpretation remains. | Can support observations, risk discussion, or targeted follow-up. |
| Weak | Exploratory pattern, incomplete data, unclear threshold, or unvalidated assumptions. | Use for planning, hypothesis generation, or discussion only. |
| Not reportable | Data cannot be validated, criterion is missing, or output cannot be reproduced. | Do not use as audit evidence. Consider alternative procedures. |
Minimum questions before reporting
- What is the criterion or expected condition?
- What is the population?
- Is the population complete for the period and scope?
- Are exceptions reproducible?
- Have false positives and business explanations been considered?
- Has the auditee or subject matter expert confirmed relevant context?
- Are limitations disclosed clearly?
- Does the evidence support the wording of the conclusion?
Exploratory output warning
Exploratory analysis may identify unusual patterns, clusters, correlations, or anomalies. These outputs should not be reported as control failures without additional validation. Treat them as leads until the audit team can connect them to criteria, evidence, and impact.
Suggested evidence language
Use precise language:
- Strong: “We identified X transactions that did not meet the documented approval requirement.”
- Moderate: “The analysis indicates a higher-risk subset that warrants follow-up.”
- Weak: “The pattern may suggest an area for further inquiry.”
- Not reportable: “The data quality limitations prevent reliance on this output for audit conclusions.”