Is a direct system export usually better evidence than a rekeyed workpaper?

Usually, yes, if the export is generated from the right source system and the extraction criteria are documented. A direct export reduces manual transfer risk and preserves a clearer chain from source system to audit population. But the auditor still needs to evaluate whether the source system and report are reliable enough for the purpose.

A rekeyed or reformatted workpaper may be acceptable if the transformation is necessary and controlled. The auditor should document what changed, who changed it, how it was reviewed, and how the transformed file ties back to the source export.

The strongest answer is not "never transform data." It is "preserve the source, control the transformation, and reconcile the output used for testing."