IAASB Rewrites Audit Evidence: What Accountants Must Know
This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
The auditor emails at 16:40 wanting to know how the revenue figure in the management pack was produced. Not what it is. How it was produced, which system generated it, and why anyone should treat that output as reliable. If you cannot answer that in one email, you are about to lose a week.
That question is going to get sharper. On 5 August 2026 the IAASB put three International Standards on Auditing out for public comment:
ISA 330 on the auditor's responses to assessed risks
ISA 500 on audit evidence, and
ISA 520 on analytical procedures.
Comments close on 15 December 2026. These IAASB standards are adopted in South Africa, so what is agreed in New York eventually lands on your client engagement.
What is actually changing
The headline change sits in ISA 500 on audit evidence. The IAASB is proposing a revised definition of audit evidence built for a digital environment, along with stronger requirements for testing whether information used as evidence is relevant and reliable. It also puts more weight on the purpose of each procedure, clarifies core concepts, and reinforces professional scepticism throughout the audit.
ISA 330 gets clearer treatment of when tests of controls, substantive procedures and analytical procedures do the work. ISA 520 is revised alongside it, which matters because analytics over full data sets keep replacing sample testing.
One deliberate choice is worth noting. The IAASB has not written technology-specific rules. It concluded that a principles-based approach holds up better while the technology keeps moving, with guidance to help auditors judge when using a tool is appropriate. There will be no clause telling anyone how to handle a specific AI product. The judgement stays with the professional, which is harder, not easier.
Together with ISA 315 Identifying and Assessing the Risks of Material Misstatement, these proposals close out a decade of modernising the ISAs.
How This is Relevant to You
These may not be the standards that you apply in your work. But they will still change what is asked of you.
If you hold CIBA's Independent Review licence
Your work runs on ISRE 2400, not the ISAs. But relevance, reliability and sufficient appropriate evidence are the same concepts, and IRBA inspects independent reviewers using the same thinking about documented judgement. When the audit standards tighten the evidence test, review practice follows. Reviewers who cannot show why they trusted a system-generated report are the ones who struggle in inspection.
If you compile financial statements or run the finance function
Your documents when you compile financial statements become somebody else's audit evidence. Under the current standard, evidence from independent external sources already ranks as more reliable than the client's own internal records. Strengthen that test and the practical result is more questions about your systems, your reconciliations and your manual journals. A messy chart of accounts and a spreadsheet nobody can trace will cost your client audit fees, and they will ask you why.
If you use AI to produce schedules or drafts
This is where the two stories meet. The tool is not the professional. When an auditor asks how a figure was derived, "the software did it" is not an answer, and Accounting Weekly has already worked through what documentation holds up in Can You Trust What AI Helped Build?
Four things to do
Read the ISA 500 exposure draft, even if you never sign an audit opinion. It tells you what reliability will mean in practice for the next decade.
Pick your three largest clients and write down, in one paragraph each, where the revenue figure comes from and what makes it reliable. If you cannot, that is the gap.
Fix the audit trail before year end. System-generated reports with no version history, and journals with no supporting note, are the items that will attract scrutiny.
If you review, tighten your documentation of judgement now rather than after an inspection finding.
Comment by 15 December 2026. Small practices and their clients are the ones who carry the cost when standards are written for large firms, and the IAASB is running a survey and webinars during the consultation. The standards are being written to survive whatever the technology does next. That works only if the people producing the underlying records can explain them.
