8. When is automatically collected evidence sufficient—and when does someone still need to test the control?

A good answer should distinguish collecting information from reaching an assurance conclusion. Ask what the evidence demonstrates, for which population and period, and with what limitations.

Why it matters to buyers. PCAOB AS 1105 requires auditors using company-produced information to address accuracy, completeness, precision and detail. It also addresses the reliability of externally sourced electronic information provided by the company. These are requirements for relevant PCAOB audits, not universal rules for every GRC workflow. (pcaobus.org)

Put it to: Norman Marks and the buyer’s internal or external assurance specialists.

A strong answer should cover: - The control objective and whether the proposed test addresses design, operation or both. - Source population, reporting period, exclusions and transformations. - Whether a screenshot, configuration extract or ticket history answers the actual testing question. - How contradictory, missing or stale evidence affects the conclusion. - Which conclusions can be automated under an approved method and which require judgement.

Ask for proof: provide an access-review extract with an omitted subsidiary and a reporting period that does not match the review. Ask the expert to identify why a technically successful collection should not automatically produce a passing conclusion.

Follow-up: “What would make you reject this evidence even though it came directly from an authenticated system?”

Expert quote — pending interview: [Insert approved quotation and attribution.]