How SAS 142 Is Modernizing Audit Evidence Through Technology and Automation

TL;DR

SAS 142 broadens audit evidence beyond invoices and manual ticking to include risk assessments, control testing, substantive analytics, and audit data analytics (ADA) - when relevance and reliability are assessed. Dual-purpose procedures can support risk assessment and substantive testing simultaneously, enabling risk-based profiling without abandoning professional skepticism.

What is SAS 142?

SAS 142 is the AICPA's Statement on Auditing Standards No. 142. It reimagines audit evidence and gives auditors a clear framework to use technology, analytics, and automation while still obtaining sufficient appropriate evidence and applying professional skepticism.

A shift from manual to machine-enhanced auditing

Traditionally, audit evidence meant stacks of invoices, spreadsheets, and transaction ticking. SAS 142 broadens the definition to include evidence from:

1. Risk assessments
2. Control testing
3. Substantive analytical procedures
4. Data analytics

Evidence can be insights from analytics and automated procedures - as long as relevance and reliability are assessed.

Relevance and reliability get a digital upgrade

SAS 142 pays close attention to relevance and reliability in a data-rich environment. Auditors should consider:

1. Source: Is the data externally generated (often less biased)?
2. Nature: Is it documentary or oral?
3. Production controls: How automated is generation, and how strong are internal controls?
4. Bias potential: How much control does management have over the data?

Technology can improve reliability through traceability, transparency, and standardization - the auditor still assesses quality and documents rationale.

From risk identification to substantive testing: the role of ADA

Audit data analytics (ADA) can support both risk assessment and substantive procedures. Tools can apply control points to assess unusual patterns, rare flows, or outliers at the transaction level - visualizing risks across time, region, or department more accurately than manual testing alone.

Dual-purpose procedures: a game-changer

SAS 142 formally endorses dual-purpose procedures - analytics that simultaneously support:

1. Risk assessment - identifying where risks are higher.
2. Evidence gathering - providing substantive support for the audit opinion.

When controls over data production are effective and results are sufficiently persuasive, ADA can replace or supplement traditional substantive tests - profiling transactions by risk and tailoring procedures accordingly.

Analytics does not replace judgment - it refines it

SAS 142 is clear: technology is an enabler, not a replacement for professional skepticism. Auditors must still:

1. Evaluate ADA outputs critically
2. Ask what is abnormal and what needs further inquiry
3. Assess whether data supports or contradicts management assertions

Conclusion

SAS 142 marks a turning point. As firms update methodologies and invest in automation, the standard makes clear that modern analytics are not only permitted - they are expected. Auditors can deliver more than assurance; they can deliver intelligence - empowering humans with better tools, not replacing them.

- Related reading: Redefining audit evidence: smart collection | Accelerate audit testing with AI platforms