Herbert M. Chain
Shareholder, Mayer Hoffman McCann P.C. Deputy Technical Director, Global Audit Group, Kreston Global
Herbert M. Chain is a highly experienced auditor and is a financial expert with over 45 years of experience in business, accounting, and audit, having served as a Senior Audit Partner at Deloitte. He holds certifications from the National Association of Corporate Directors and the Private Directors Association, with knowledge of private company governance and effective risk management. He has extensive knowledge in the financial services sector, including asset management and insurance. Herb is a member of MHM’s Audit Methodology Steering Committee.
Contact Herb here
What is Information Provided by the Entity and what should auditors consider?
September 27, 2023
External auditors often have questions about what constitutes Information Provided by the Entity (IPE), and when and how the IPE should be tested. They must determine when a piece of evidence is IPE and then, if so, whether the evidence should be tested as IPE in connection with our auditing procedures. As a result, a “frequently asked questions” document might be helpful.
Understanding Information Provided by the Entity (IPE)
According to professional standards throughout the world, auditors must consider three fundamental attributes when evaluating audit evidence: sufficiency, relevance, and reliability. These criteria are outlined in the professional standards issued by authoritative bodies such as the American Institute of Certified Public Accountants (AICPA), the Public Company Accounting Oversight Board (PCAOB), and the International Auditing and Assurance Standards Board (IAASB).
Sufficiency, relevance, and reliability of audit evidence
- Sufficiency: Sufficiency refers to the quantity of audit evidence obtained. Auditors need to gather enough evidence to support their conclusions and opinions. For example, the U.S. Generally Accepted Auditing Standards (GAAS) emphasize the importance of obtaining “sufficient appropriate audit evidence” to provide a reasonable basis for forming an opinion on the financial statements.
- Relevance: Relevance is the pertinence of the evidence to the audit objective. Auditors should focus on collecting evidence that is directly related to the assertions being tested. Irrelevant evidence may not contribute to reaching the appropriate audit conclusion.
- Reliability: Reliable evidence is trustworthy and dependable. Professional standards emphasize the importance of obtaining evidence that is reliable, which means it is accurate, complete, verifiable, and unbiased.
Reliability is especially critical when evaluating information produced (or provided) by the company (entity). PCAOB AS 1105.10, Audit Evidence, for example, states that “[w]hen using information produced by the company as audit evidence, the auditor should evaluate whether the information is sufficient and appropriate for purposes of the audit by performing procedures to:
- Test the accuracy and completeness of the information, or test the controls over the accuracy and completeness of that information; and
- Evaluate whether the information is sufficiently precise and detailed for purposes of the audit.”
FAQs about Information Provided by the Entity (IPE)
What is “Information Provided by the Entity” (IPE)?
IPE refers to information provided by the audited entity to auditors during an audit, and often serves as evidential matter for the auditor. IPE can be defined as any information provided by the entity using the entity’s IT applications, end-user computing tools, or other means. It is used by management, in either electronic or printed form in the performance of financial reporting, including in the performance internal control procedures, and by external auditors in performing their audit procedures.
Can IPE include non-financial information?
Yes, IPE can encompass both financial and non-financial information relevant to the audit, and is often used in substantive analytical procedures to develop expectations, e.g., number of rooms when auditing revenues for a hotel or shipping statistics when auditing revenues of a manufacturer, or number of employees when auditing salaried expense. (See question no. 8, below.)
What is the relationship between IPE and audit evidence?
IPE is one component of the evidence auditors obtain during the course of audit work. IPE is the information provided by the entity, while audit evidence includes all the information used by auditors to support their conclusions.
Are system-generated reports from service organisations considered IPE?
Service organizations are considered to be a component of a company’s accounting system and financial reporting process. Accordingly, reports produced by a service organisation and used for auditor testing must be tested for accuracy and completeness. This may be accomplished by obtaining and analyzing a SOC 1 Type 2 (or ISAE 3402) report for the service organisation, or by subjecting the reports to accuracy and completeness testing.
Is a bank statement IPE?
While auditors generally obtain bank statements from management, bank statements, executed contracts, etc. are not considered IPE; rather, they are considered to be source documents. If we are directly auditing the information by looking to another source of evidence, the IPE does not need to be tested.
Does all IPE need to be tested?
IPE is required to be tested for completeness and accuracy when relying on the IPE as audit evidence or it is being used to select or identify audit evidence. The audit evidence being relied upon must be evaluated to assess the completeness and accuracy of any IPE identified.
IPE which represents the population that is the subject of a specific audit test does not need to be further tested as IPE. In other words, if a population itself is the subject of sampling procedures or substantive analytical procedures designed to test the accuracy of the population itself, additional tests of the IPE are not necessary (e.g., confirmation of accounts receivable balances).
Does the source of the IPE make a difference as to whether testing is required?
Regardless of whether management provides audit evidence in the form of a manually-built Excel spreadsheet, a system-generated Excel spreadsheet, a system-generated PDF document, or a report generated by the company’s service organization, the auditor is required to test the completeness and accuracy of that report, either substantively or through a test of internal controls.
What is an example of the use of IPE?
IPE is often used for developing expectations for substantive analytical procedures or for auditing management’s estimates. For example:
- Accounts receivable ageing reports are often used to compare the age of receivables from the current year to the prior year and to test the allowance for doubtful accounts;
- Payroll reports can be used to derive full-time equivalents (FTEs) for salary testing; or
- Inventory reports can be used to determine inventory turnover or other inventory metrics to test inventory obsolescence reserves.
When using IPE to establish an expectation, the completeness and accuracy of the IPE is required to be tested.
How do auditors assess the reliability of IPE?
The reliability of evidence is generally affected by accuracy, completeness, authenticity, and susceptibility to management bias. The reliability of information produced by the entity (IPE) depends on the completeness and accuracy of the information included in the IPE.
PCAOB AS 2305.16 states, “Before using the results obtained from substantive analytical procedures, the auditor should either test the design and operating effectiveness of controls over financial information used in the substantive analytical procedures or perform other procedures to support the completeness and accuracy of the underlying information”.
The auditor may test the controls over the completeness and accuracy of the IPE or elect to substantively test the IPE itself by testing completeness by selecting a sample from the report to test for accuracy. In some circumstances, evidence relating to the accuracy of information may be obtained from other audit procedures.
What sampling methodologies can be used to test IPE substantively?
The appropriate sampling methodology for testing the accuracy of IPE would depend on the specific circumstances and the audit objectives. One methodology is attribute sampling. Attribute sampling is designed to assess the occurrence or non-occurrence of a particular attribute within a population of IPE.
Conclusion
Obtaining and assessing the sufficiency relevance and reliability of audit evidence is a fundamental component of audit work and professional responsibilities. IPE constitutes a significant piece of the puzzle and needs to be analyzed and examined for accuracy and completeness if auditors are to use it as a basis for testing.
If you would like to speak to an specialist, please get in touch.
