Design and evaluate assurance procedures, evidence sufficiency, sampling, and documentation.
Assurance evidence is the support behind the conclusion. A CFE Day 2 assurance response should not merely say that more work is required. It should explain what evidence is missing, why the existing evidence is not enough, which procedure would address the gap, and how the result would affect the conclusion or report.
Evidence has two dimensions: sufficiency and appropriateness. Sufficiency is about quantity. Appropriateness is about relevance and reliability. A large volume of weak evidence may still be inadequate, while one strong external confirmation may answer a narrow question more effectively than several internal explanations. The role-depth task is to judge whether the available evidence supports the decision the engagement team must make.
| Evidence issue | What it tests | Strong response |
|---|---|---|
| Procedure design | Whether the work addresses the risk or assertion. | Name the procedure, source, timing, and purpose. |
| Sufficiency | Whether enough evidence has been gathered. | Explain why more items, coverage, or follow-up work is needed. |
| Appropriateness | Whether the evidence is relevant and reliable. | Compare internal, external, oral, written, original, and generated evidence. |
| Sampling | Whether the selected items support the conclusion. | Discuss population, selection method, exception rate, and follow-up. |
| Documentation | Whether the file supports the work performed. | Identify what should be documented and why it matters. |
A procedure should be written as an action that produces evidence for a specific purpose. “Review receivables” is too vague. A stronger procedure is “inspect subsequent cash receipts for major overdue customer balances to assess collectability at year-end.” This statement identifies the document, the population, the assertion, and the reason for the work.
Useful assurance procedures include inspection, observation, inquiry, confirmation, recalculation, reperformance, analytical procedures, and scanning for unusual items. The exam skill is not naming these procedures from memory. The skill is selecting the procedure that fits the evidence need. If the concern is existence, physical inspection or external confirmation may be more persuasive than management inquiry. If the concern is completeness, tracing from source documents to the ledger may be more useful than vouching ledger entries backward.
Good procedure design also respects timing. A procedure performed after year-end may provide evidence about a balance, but it may not fully answer a cut-off concern unless it is tied back to the reporting date. An observation performed once may show that a control occurred on that date, but not that the control operated throughout the period.
Sufficient appropriate evidence is evidence that is both enough and persuasive enough for the conclusion. If the risk is high, the engagement team usually needs stronger or more extensive evidence. If the evidence is internally generated and the relevant controls are weak, reliability may be lower. If the evidence comes from an independent external party, reliability may be higher, although the exact context still matters.
Management representations can be useful, but they rarely replace other evidence for a significant issue. A representation letter may confirm management’s responsibility or intent, but the engagement team should still consider contracts, invoices, external confirmations, board minutes, legal correspondence, tax filings, valuation reports, or subsequent events where relevant.
When a case asks whether evidence is adequate, do not answer only “yes” or “no.” State the conclusion, identify the evidence already obtained, explain the weakness or strength, and recommend the next procedure if needed. That structure shows judgment and gives the reader a practical path forward.
Sampling issues appear when the response must evaluate whether the testing performed supports the conclusion. The key questions are: what population was tested, how were items selected, what exceptions were found, and whether those exceptions are isolated or systemic. A sample of large or unusual items may be appropriate for a targeted risk, but it does not automatically support a conclusion about the whole population.
Exceptions should not be dismissed casually. One exception may indicate a clerical error, a misunderstanding, a control failure, or a broader population risk. The answer should explain the likely implication and the follow-up work needed. For example, if a sample of revenue transactions reveals missing shipping documents near year-end, the team may need additional cut-off testing, inquiry into process changes, and evaluation of whether the issue affects reported revenue.
Documentation should allow an experienced reviewer to understand the work performed, evidence obtained, significant judgments made, and conclusions reached. In a case response, documentation issues often arise when the file contains a conclusion without support, a procedure without results, or a disagreement without resolution.
Strong answers identify the missing documentation and the risk it creates. If the engagement team relied on an oral explanation for a major estimate, the documentation problem is not merely administrative. The file may fail to support the conclusion, and additional evidence should be obtained or the conclusion should be reconsidered.
| Pitfall | Better approach |
|---|---|
| Saying “perform more testing” without detail. | State the exact procedure and the evidence it should produce. |
| Treating all evidence as equally reliable. | Consider source, independence, form, controls, and relevance. |
| Accepting management explanations too quickly. | Corroborate significant explanations with documents or external evidence. |
| Ignoring exceptions. | Explain whether they are isolated, systemic, or unresolved. |
| Forgetting the reporting consequence. | State whether the evidence supports, limits, or prevents the conclusion. |
Use a risk-to-evidence sentence pattern: “Because the case fact creates this assertion or conclusion risk, the current evidence is insufficient or appropriate for this reason, so the engagement team should perform this procedure before concluding.” This keeps the answer grounded in professional judgment.
The strongest responses do not over-audit every issue. They choose the procedures that matter most for the role, explain why those procedures are needed, and connect the evidence back to the conclusion the engagement team must support.