When I review audit documentation, I don’t care about grammar, spelling, color, or hyperlinks. I ignore all of that petty detail because it keeps me focused on the minutia instead of the big picture.
What I am looking for is how the key elements of the audit fit together and whether the audit documentation tells an interesting story about how you got from your vague audit assignment to your findings and conclusions.
Key pieces of the audit documentation should link to each other
Audits tend to double back on themselves and can feel quite chaotic as you work through them. No audit is perfectly linear.
However, chaos is NOT the feeling you want to convey to the reviewer of your audit documentation! Instead, lead the reviewer through a logical, organized story.
First explain to the reviewer what your initial audit assignment was and why it was deemed worthy of your team’s time.
Then describe in your audit documentation:
- The research performed to understand the audit subject
- The filters you applied to remove boring or irrelevant subject matter so that the team could focus on the good stuff
- The revised, finite objectives(s) the team is seeking to answer
- The audit methodologies you used to answer the objective(s)
- The findings that result from performing the methodologies
- The conclusion(s) that answer the finite objective(s)
All of the items on that list should connect and flow. Some auditors actually have a formal title for this relationship: linkage.
Audit documentation is very idiosyncratic and therefore I can’t recommend exactly what linkage should look like. I just know that I need to find it somewhere. Maybe it is in a few key memos or audit programs. Maybe it is in a lead sheet.
Just, please, don’t make your reviewer hunt for it! Make the location of all of these pieces – and how they link to each other – obvious.
Consider these two quotes from the GAO’s Yellow Book
GAGAS tells us which pieces of our audit documentation should support each other in these two paragraphs:
8.35 A written audit plan provides an opportunity for audit organization management to supervise audit planning and to determine whether
a. the proposed audit objectives are likely to result in a useful report;
b. the audit plan adequately addresses relevant risks;
c. the proposed audit scope and methodology are adequate to address the audit objectives;
d. available evidence is likely to be sufficient and appropriate for purposes of the audit; and
e. sufficient staff, supervisors, and specialists with adequate collective professional competence and other resources are available to conduct the audit and to meet expected time frames for completing the work.
AND
8.06 Auditors should design the methodology to obtain sufficient, appropriate evidence that provides a reasonable basis for findings and conclusions based on the audit objectives and to reduce audit risk to an acceptably low level.