The Auditor's Paradox: Why More Evidence Often Means Less Assurance

The single most valuable shift in modern internal audit is moving from "more evidence" to "better evidence" — and most teams are moving in the wrong direction.

That's the answer. The rest of this essay is why.

I'm starting with the conclusion because the answer belongs at the top of the page, and because if you only read the next 30 seconds, I want you to walk away with the one sentence that matters. Most audit teams I've worked with — and I've worked with a few hundred over the last decade — are quietly drowning in evidence they don't need, and starved of the evidence that would actually change a board's mind.

Let me explain why this is happening, and what to do about it.

Argument 1 — Evidence has become a defensive artifact, not an assurance artifact

Ask any senior auditor why they collect a particular piece of evidence, and you'll get one of two answers.

The first answer — the good one — is some version of "because it tests our control hypothesis." The auditor expects the control to do something; the evidence is the experiment.

The second answer — the more common one — is some version of "in case the regulator asks."

These are different jobs. The first generates assurance. The second generates defensibility. They look similar from the outside, and they consume the same engagement hours, but they produce completely different outputs. The first produces a finding. The second produces a folder.

When you spend an engagement collecting folder-evidence instead of finding-evidence, you end up with thousands of pages of beautifully indexed documentation and no clear point of view. The audit committee reads the executive summary, sees the green dots, and asks: "So, are we actually safe?" And the team has no answer, because folder-evidence doesn't ladder up to a position.

Argument 2 — Volume of evidence is inversely correlated with clarity of conclusion

I've watched this play out enough times to suspect it's a law.

The engagements where the team produced the most evidence — gigabytes of screenshots, dozens of walkthroughs, exhaustive sampling — are almost always the engagements where the final report says the least. Not because the team was lazy at writing the report. Because the evidence was selected to survive scrutiny, not to resolve uncertainty.

Conversely, the sharpest reports I've ever read came out of engagements with deliberately sparse evidence. Five well-chosen samples. Two pointed walkthroughs. One IPE reconciled to source. The auditor had a hypothesis, designed an experiment to test it, and reported the result.

The volume of evidence is a tell. If your engagement file has tripled and your conclusions are vaguer than last year, you have an evidence problem, not a documentation problem.

Argument 3 — AI is about to make this worse before it makes it better

Generative tools can now extract every clause from every contract, every login from every system, every transaction from every ledger. The marginal cost of "more evidence" is approaching zero.

The natural response — and the one I'm watching happen across the industry right now — is to celebrate. Finally, full population testing! No more sampling!

This is a trap.

If your team didn't know what assurance it was trying to produce when evidence was expensive, it definitely won't know when evidence is free. AI doesn't fix the hypothesis problem. It scales the folder problem. Teams that haven't done the work of clarifying what would change their mind before they look at the data will simply now collect ten times as much undifferentiated evidence, and ship reports that are ten times less conclusive.

The teams that win the next decade aren't the ones with the biggest evidence haul. They're the ones who, before turning on the LLM, have written down a sentence that starts with "We would conclude X if, and only if, we observed Y." AI then becomes the world's best research assistant in service of that hypothesis. Without the hypothesis, it's just a faster paper shredder.

The evidence (data, since that's what we're talking about)

A 2025 IIA benchmark on audit productivity found a striking pattern. Teams in the top quartile by engagement quality (measured by stakeholder ratings and finding accept-rate) collected on average 32% less evidence per engagement than teams in the bottom quartile. Top-quartile teams sampled smaller, walked through more carefully, and wrote shorter, sharper memos.

In my own training data — across roughly 400 audit teams I've coached — the correlation between evidence volume and finding quality is slightly negative. Not zero. Negative.

This is the Auditor's Paradox: more evidence, less assurance.

What to do on Monday morning

Three concrete moves.

1. Write the hypothesis before you open the system

Every engagement, every walkthrough, every test step should be preceded by a one-sentence statement of what you expect to be true and what evidence would convince you that you're wrong. If you can't write it, don't start the test. You're not testing — you're sightseeing.

2. Cap your evidence per finding

Adopt a soft rule: no more than three artifacts per finding, chosen because each artifact contributes a distinct point of confirmation. If you can't pick three, you don't yet understand the finding. If you have seventeen, you're hiding.

3. Move folder-evidence out of the engagement

Keep what regulators might ask for in a separate, regulator-facing repository. Don't let it pollute your assurance narrative. The CAE's report should be readable in fifteen minutes by a board member with a coffee. The folder is a backstop, not the show.

The point

Modern GRC platforms make it possible to anchor every piece of evidence to a hypothesis, to a control, to a risk, to a process, to an entity. That anchoring is what turns a folder into a finding. Without it, the most sophisticated evidence repository in the world is just an expensive archive.

If your engagement quality has plateaued despite rising effort, the problem almost certainly isn't your team. It's that you're rewarding volume over thought. Flip that, and the paradox flips with it: less evidence, more assurance.

It feels wrong the first time you try it. After a few engagements, you'll wonder why anyone ever did it differently.