The three methods and what each one proves
Inspection means examining records, documents or physical assets, such as invoices, contracts, bank statements, signed approvals or equipment. Its strength depends on the source: a document from an independent party is more reliable than one the client prepared.
Observation means watching a process being performed, such as an inventory count, a payment run or a month-end close step. It shows the process was performed that way when you watched it, and nothing about the other days in the period.
External confirmation means a direct written response from a third party, usually a bank, lawyer, customer or vendor, sent to the auditor rather than routed through the client.
Decision rule: if a balance is supported only by a client-created schedule, get inspection of source documents, a confirmation, or both before you conclude on it.
Inspection: vouching and tracing invoices
Vouching starts from the recorded amount and works back to the support, which tests whether recorded expenses occurred. Tracing starts from a source document and works forward to the ledger, which tests whether transactions that occurred were recorded. State the direction in the workpaper.
Worked example. The general ledger shows 1,240 vendor invoice postings for the year. Select 30 items at random from a system export you have already reconciled to the trial balance. For each item, pull the invoice from the vendor portal or the original email, not a PDF saved to a shared folder, and check the invoice number, vendor name, invoice date, amount, approval initials and the payment record that clears the posting.
Failure modes to watch for: an invoice dated after the period end but posted to the year, an approver who is not on the authorization list, one invoice number under two vendor names, and a vendor address that matches an employee address. Log each one with the request you sent and the answer you received.
Inspection: judging the reliability of a document
Ask for the document from the most independent source that exists. For a bank balance, that is the statement the bank issued or the confirmation it returns, not a spreadsheet built from the bank portal.
Check that the copy is complete, that dates and signatures are present, and that the file does not show edits after the date printed on it.
Decision rule: if the only copy is a client schedule, trace a sample of its lines to source documents and record the sample and the result.
Observation: attending an inventory count
Before the count, obtain the client's count instructions and record the last receiving and shipping document numbers included and excluded. Ask whether any stock sits at a third-party warehouse or with a customer on consignment, since those items need separate evidence.
During the count, run two test counts in opposite directions. Select items from the count sheets and count them on the floor to test existence. Select items from the floor and find them on the count sheets to test completeness. Record the tag numbers, the counters' names, the item description and the quantity.
Check the tag control. Pre-numbered tags must be accounted for as issued, used, voided or returned. A missing voided tag is a sequence gap that must be resolved before you sign off on the count. Decision rule: if the counters also keep the stock records, ask for an independent recount of a sample of locations before you accept the count.
An observation proves the count happened that day. Roll the count forward to period end using purchases and sales in between, and test costing and pricing separately, because the observation does not prove value.
Observation: controls and their limits
Observing a control shows it was performed the way the client described, at the time you watched, such as the person who releases a payment run checking the approval list.
The limit is time. A monthly control in a 12-month period has 12 instances, and one observation covers 1 of them. Inspect the signed approvals or system timestamps for the other 11 runs so the evidence covers the whole period.
Failure mode: staff perform a control carefully while the auditor is in the room. Fix it by inspecting evidence for periods you did not announce, rather than relying on the observation alone.
External confirmation: bank confirmations done properly
The request should go from the auditor to the bank, not through the client. Take the bank's confirmation address from the bank's website or the prior year's response, not from the client's email. The request lists each account, loan, line of credit, safe deposit box and letter of credit you know about.
The client's role is usually limited to signing the bank's authorization form. Keep the signed form, the date the request went out and the date the response came back to you directly.
Decision rule: if the bank's balance does not match the ledger, do not adjust the ledger from the confirmation. Obtain the bank statement and reconciliation and test the reconciling items in the subsequent period.
If the bank does not respond, send a second request. If it still does not respond, test the bank statement, the reconciliation and the items that cleared after period end, and document the non-response.
Negative confirmations and the receivable presumption
A positive confirmation asks the third party to reply whether the balance is correct. A negative confirmation asks them to reply only if it is wrong. The SEC notice that published the proposed AS 2310, The Auditor's Use of Confirmation, says that generally the auditor obtains significantly less audit evidence when using negative confirmation requests than when using positive ones. Use negatives only for a large population of low-risk balances where you expect few exceptions.
The SEC notice on the proposed AS 2310 also describes a presumption that the auditor will request confirmation of accounts receivable, and the situations in which it may be overcome. Check the final text for the paragraph you cite, and record the reason the presumption was overcome in the workpaper.
Mapping each method to the PBC list
PBC means prepared by client. Each PBC line should carry the assertion it supports, the method you will use and who provides the item. For example: bank statements, supporting existence and completeness of cash, tested by inspection, with the statement sent from the bank.
Track these columns for each request: request ID, assertion, method, source (client, bank, vendor or auditor-generated), route of receipt, date requested, date due, date received, date reviewed by the senior, status and the sample line it supports.
Decision rule: if the client generates a list you will sample from, such as an accounts receivable aging or a vendor master file, ask for the report parameters and a reconciliation to the general ledger before you select the sample. Track that test as its own PBC line.
What the reviewer will ask for in the workpaper
The reviewer looks for the objective, the population and how you confirmed it was complete, the selection method and sample size, the source of each item, the procedure on each item, the exceptions and their resolution, and the conclusion.
For each sample item, record the source reference, the portal ID or file name, the date received, your initials and the date tested. Use a tickmark legend so the reviewer can read the marks without asking you.
Decision rule: if a sample item has no source document, log it as an exception and document why any replacement item was chosen. Do not swap in a convenient item without a note.
Client wording for each method
For inspection, ask the client to send this: "Please send the invoice, the approval and the proof of payment for each item on the attached list, exported from your accounting system or the vendor portal." Do not accept a retyped summary in place of the documents.
For confirmation, write: "We will send the bank confirmation request ourselves. Please sign the bank's authorization form and do not change the address we give the bank." Do not offer to complete the bank's response for the client.
For observation, write: "We would like to attend the year-end inventory count on the date in the attached schedule. Please send the count instructions and the tag log before that day." Then ask for a list of any stock held at a warehouse or with a customer.
Which standards apply to your engagement
PCAOB standards govern audits of issuers, which are companies that file with the SEC. Audits of nonissuers follow AICPA generally accepted auditing standards, the AU-C sections. Cite the standard that governs your engagement in the workpaper.
The PCAOB has proposed amendments to AS 1105, Audit Evidence, on technology-assisted analysis. The proposing release says they would take effect for audits of financial statements for fiscal years beginning on or after December 15, 2025, subject to SEC approval. Check the SEC's order on sec.gov for the approval status and final effective date before you rely on them for a 2026 audit.