The main goal of an internal audit project is to add value and improve an organization's operations. This goal is accomplished through the identification of control weaknesses, potential process improvements, and positive change opportunities. Audit workpapers facilitate this process by enabling auditors to document work performed from the planning stage to the final closing meeting.
Apart from the final audit report, workpapers represent the main documentary evidence of audit testing, discussions, and observations. While the organization, design, and content of audit workpapers will vary depending on the nature of the engagement, several important considerations are necessary to the creation of effective, high-quality workpapers.
Before understanding the key elements and qualities of audit workpapers, auditors need to understand the main reasons for maintaining workpapers. According to Practice Advisory 2330-1: Recording Information from theInternational Standards for the Professional Practice of Internal Auditing (Standards), audit workpapers should be prepared to achieve four main objectives:
- Document the planning, performance, and review of audit work. Audit documentation provides written support for planning and scoping decisions, testing methodologies and results, and evidence of review and completion of audit program work steps. In this sense, audit workpapers serve as a tool to help complete a value-added project. They document what has been done, why it has been done, and how to re-create what has been done.
- Provide the principal support for audit communication such as observations, conclusions, and the final report. Audit workpapers must contain sufficient evidence to support the auditor's assessment. Practice Advisory 2310-1: Identifying Information from the Standards further clarifies the role of audit workpapers by stating, "Information should be sufficient, competent, relevant, and useful to provide a sound basis for engagement observations and recommendations. Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor."
- Facilitate third-party reviews and re-performance requirements. Third-party reviews may require the external auditors to rely on u.s. Sarbanes-Oxley Act of 2002 testing and quality reviews performed by internal auditors. Audit workpapers provide an audit trail that enables a technically competent individual who has no experience with the prior audit to re-perform procedures.
- Provide a basis for evaluating the internal audit activity's quality control program. Quality verifications are performed after projects are completed. Thus, workpapers often are the only tangible representation of the project that can be assessed during the quality review.
Audit workpapers serve a variety of purposes and impact many different stakeholders, both within and outside of the internal audit function. External stakeholders include external auditors and third party reviewers, as mentioned, but also lawyers and judges in cases of insurance claims, lawsuits, and fraud. Internal auditors should keep these different objectives and stakeholders in mind when preparing workpapers.
Because audit workpapers serve a variety of important objectives, internal auditors need to exercise care when preparing them. There are five essential characteristics of high-quality workpapers that all document preparers should consider throughout the audit process. Ensuring these characteristics are reflected in workpapers is a vital step to achieving workpaper objectives.
Completeness Each workpaper should be completely self-standing and self-explanatory. If a workpaper is separated from the engagement file, readers should be able to ascertain the purpose, work performed, and results based solely on information included on that single workpaper. Because internal and external parties reviewing audit documentation may only select a sample of files, all individual documents must provide adequate evidence of the work performed. One key to achieving complete workpapers is to prepare audit documentation timely. A long time lag between performance and documentation of work generally results in a greater chance of excluding key facts and comments. Additionally, items such as draft reports, open-item lists, sticky notes, and review comments should be removed from the final workpapers, as these indicate incomplete work.
Accuracy High-quality workpapers include statements and computations that are accurate and technically correct. Errors included in final workpapers certainly will shed doubt on the procedures performed and results noted from an internal or external review perspective. One way to verify that workpapers contain accurate computations is to evidence additions of data using defined tick marks and to cross-reference computation data to source documentation. Auditors should also clearly differentiate statements based on facts from those based on inquiry or matters of judgment.
Organization Workpapers should have a logical system of numbering and a reader-friendly layout so a technically competent person unfamiliar with the project could understand the purpose, procedures performed, and results. Workpapers should be arranged logically and cross-referenced from source documentation to test grids and audit work steps. The cross-referencing should extend to an issue summary that links to the audit report, thus clearly communicating the derivation of audit observations.
ss Audit workpapers and items included on each workpaper should be relevant to meeting the applicable audit objective. Writing concise notes and removing unnecessary pages of bulky policies will also help improve the efficiency of review and ultimately the quality of the documentation.
Audit workpapers can be prepared electronically or manually and can vary in type and format (e.g., narratives, memos, flowcharts, test grids, meeting notes, and audit program steps). Regardless of these variations, workpapers should include the following key elements:
- Source. The name and title of the individual providing the documentation should be recorded to facilitate future follow-up questions or audits.
- Scope. The nature, timing, and extent of procedures performed should be included on each workpaper for completeness. It is also helpful to include a statement describing the purpose of the particular document with respect to the audit objective.
- Reference. A logical workpaper number cross-referenced to audit program steps and issues should be included.
- Sign-off. The preparer's signature provides evidence of completion and accountability, which is an essential piece of any third-party quality review.
- Tick mark legend. A concise definition of all tick marks should be included on each audit workpaper or at a central location to clearly describe the work performed during the engagement.
- Exceptions. Audit exceptions should be documented and explained clearly on each workpaper using logical numbering that cross-references to other workpapers.
The consistent inclusion of these key workpaper elements on all audit documentation improves the efficiency of internal and external review processes. Clearly documenting exceptions and appropriately referencing workpapers relative to audit program steps provides strong support for observations included in the final report.
Due to the significant variety of internal audit engagements and related workpapers, assessing the adequacy of audit documentation often can be difficult. The specific audit procedures performed can result in different documentation requirements. For example, if the engagement involves a review of sensitive payroll information, the auditor likely would not be able to retain example information and instead would have to create a detailed memo explaining the procedures performed. The amount of auditor judgment used to determine any observations also will impact documentation requirements. Any assumptions, inferences, or other uses of judgment will need to be documented clearly and reviewed by appropriate levels of internal audit management.
Finally, the quantity and severity of exceptions noted will require varying degrees of audit documentation. If there are no exceptions, one thorough walk-through example of procedures performed likely would suffice. However, if multiple significant exceptions are noted, internal auditors likely would need to obtain all related source documentation and provide detailed explanations for each exception. Keeping these considerations in mind, internal auditors always should try to adhere to any standard in-house workpaper styles and templates. They also should exercise caution when relying on prior year workpapers, as the documentation may not meet current quality standards. Careful consideration of key audit workpaper characteristics and essential elements will improve the quality of audit documentation and reflect on the audit project itself.