PCAOB Auditing Standard 1105, "Audit Evidence," states that the auditor must plan and perform audit procedures to obtain sufficient appropriate audit evidence to support the audit opinion. The standard is clear about what evidence must achieve: it must be sufficient (enough of it) and appropriate (reliable and relevant to the assertion being tested). What it does not prescribe is the mechanism for maintaining the chain between raw source material and the working paper conclusion that rests on it.
That gap in prescription is where evidence chains break. Auditors know they need evidence. They collect it. But the structural connection between the figure in the working paper and the specific passage in the source document that supports it is often implicit rather than explicit, and implicit connections do not survive the pressures of a busy audit cycle.
What AS 1105 actually requires
AS 1105 categorizes audit evidence by type: documentary evidence, representations, observations, and analytical evidence. For financial statement assertions, documentary evidence is typically the most important category: documents created by third parties (external reliability) or by the company (internal, lower reliability absent corroborating controls).
The standard also describes factors that affect evidential reliability: independence of the source, effectiveness of internal controls, directness of the auditor's knowledge (evidence obtained directly vs. indirectly), and whether documents are originals or copies. These factors apply to the documents themselves, not to how those documents are connected to working paper conclusions.
This is the standard's structural gap for evidence chain purposes. It tells auditors what to look for in a piece of evidence and how to evaluate its reliability. It does not require a formal linkage system between each piece of evidence and the specific working paper assertion it supports. That linkage is left to the auditor's documentation practices, which are governed more by AS 1215 (Audit Documentation) than by AS 1105.
AS 1215 and the documentation standard
AS 1215 requires that audit documentation be sufficient to enable an experienced auditor, having no previous connection with the engagement, to understand the nature, timing, and extent of audit procedures performed, the results of those procedures, and the conclusions reached. This "experienced third-party auditor" standard is the benchmark for documentation completeness.
In the evidence chain context, this standard implies that the connection between a working paper conclusion and its supporting evidence should be followable by someone who was not present during the audit. In practice, PCAOB inspection reports frequently cite documentation deficiencies where the link between a conclusion and its supporting evidence is unclear or missing. The cited deficiencies include: "the auditor did not document the basis for the conclusion that the evidence was sufficient," "the working paper did not identify the source documents reviewed," and "the connection between the substantive procedure and the account balance tested was not documented."
These are, in essence, evidence chain failures cited under the PCAOB documentation standard. The audit may have been conducted correctly. The evidence may have been sufficient. The connection between the two was not documented in a way that a third party could follow.
Where AS 2301 adds requirements for internal controls
For integrated audits (which include an audit of internal controls over financial reporting under AS 2201), AS 2301 requires that the auditor understand the flow of transactions through the company's systems and identify the controls that prevent or detect material misstatements. This understanding requires tracing transactions from origination through recording to the financial statements.
The transaction trace required by AS 2301 is structurally similar to the evidence chain required for substantive audit purposes, but it operates at the process level rather than the individual figure level. The auditor traces the flow of a type of transaction through the system to understand where controls operate, not to trace the origin of a specific figure in the financial statements.
Both types of tracing are required. AS 2301 process tracing establishes whether the controls that should prevent misstatements are operating. AS 1105/1215 evidence tracing establishes whether the figures that appear in the financial statements are supported by sufficient appropriate evidence. A company can have well-documented control processes and still have evidence chain gaps at the individual figure level, because the two types of tracing are distinct activities.
How PCAOB inspection findings map to evidence chain failures
PCAOB inspection reports are public and provide a detailed view of the types of audit failures that actually surface during inspections. Looking across recent inspection reports, several patterns appear that map directly to evidence chain problems.
Insufficient testing of significant estimates is the most common category. Estimates require tracing back to the management assumptions and market data that support them. When that tracing is incomplete, the auditor may have reviewed the estimate but cannot demonstrate that the review encompassed all relevant supporting evidence.
Revenue recognition evidence gaps appear frequently in inspections of companies using complex recognition methods. The source documents that support the timing and amount of revenue recognition (contracts, invoices, delivery records, acceptance documents) must be traced to the figures in the financial statements. When that chain is not documented, the inspection finding is often framed as "auditor did not test whether [revenue recognition criterion] was met," even when the auditor did test it but failed to document the connection.
Related party transaction substantiation failures appear regularly. Related party transactions require documentation of the terms, the authorization, and the economic substance. When the evidence chain from the financial statement disclosure to the underlying transaction documentation is incomplete, it becomes difficult to demonstrate that the substantive procedures were adequate.
The implication for internal audit and compliance teams
PCAOB standards apply directly to external auditors, not to internal audit functions. However, the external audit process depends heavily on evidence that internal teams produce and maintain. When external auditors request substantiation for figures in the financial statements, they are asking the internal team to produce the evidence chain that AS 1105 and AS 1215 require the external auditor to have. If that chain is not maintained internally, the external auditor must reconstruct it, which increases audit hours and risk of findings.
Internal audit teams that maintain explicit provenance chains for significant figures are, in effect, pre-building the evidence base the external auditor needs. The external auditor can verify the chain rather than constructing it. The inspection risk shifts from "evidence chain not documented" to "evidence chain reviewed and verified." Those are materially different outcomes.
We built Pramaana around this specific dynamic: the external audit's evidential requirements are well-defined by standards like AS 1105 and AS 1215, but the infrastructure to maintain the chains those standards require has historically been left to manual documentation practices. The gap between the standard's requirements and available tooling is where inspection findings live.
Closing that gap does not require reinterpreting the standards. It requires building the documentation infrastructure that makes the standards' requirements practical at the scale and complexity of modern financial reporting. The standard says "sufficient appropriate evidence." The infrastructure question is how you know, quickly and reliably, that you have it.
Internal audit teams that can answer that question with a traced, documented evidence chain are in a fundamentally different position when external auditors arrive than teams that rely on implicit knowledge and reconstructed documentation. The PCAOB inspection record makes clear what the cost of the second position looks like.