Audit Documentation: The Steps of Conducting an Audit Continued

We are almost done with the steps of performing an audit.  This week, audit documentation!

The 14 Steps of Performing an Audit

1. 1. Receive vague audit assignment
   2. Gather information about audit subject
   3. Determine audit criteria
   4. Break the universe into pieces
   5. Identify inherent risks
   6. Refine audit objective and sub-objectives
   7. Identify controls and assess control risk
   8. Choose methodologies
   9. Budget each methodology
   10. Formalize the audit program
   11. Perform & document audit methodologies
   12. Conclude
   13. Draft findings
   14. Finalize the report

Now you need to write it all down

After coming up with your audit plan, it is time to put the plan into action!  And as you go, you need to document every choice you make.

“Exactly what do I have to document,” you ask? I hate to tell you this, but the audit standards are not very specific when it comes to audit documentation.

None of the audit standards dictate the exact content, the ideal sequence, or the physical format of the audit documentation. The standards make very general suggestions regarding the content of audit documentation and leave the form of the documentation up to professional judgment. In other words, your idea of what the documentation should look like is just as good as mine.

From Overly Detailed to Scarily Vague – Sharon and Andrew

I once had the pleasure of working with an audit supervisor named Sharon. Sharon was very meticulous and had high expectations for her audit documentation.

All cross-references had to be two-way (coming and going). Every paper in the binder had to contain a description of the source, purpose, procedure, results, and conclusions of the individual audit document. Each document  had to be uniquely titled and numbered. She had a little list of approved tick-marks that we had to use; if we wanted to create a new tickmark, we had to get her written permission. She went a little too far!

Much of what she required had nothing to do with the standards and everything to do with making her life as a reviewer easier. However, what Sharon required was not universally accepted.

On my next audit, I was tasked with reviewing the audit documentation of another auditor, Andrew. I noticed that he did not apply any of Sharon’s rules. I told him that he needed to cross-reference; put source, purpose, procedures, results, and conclusion on every document; and stamp every page ¼ inch from the top right corner!

Andrew responded, “Who says I need to do that?” I said, “Sharon.” He said, “Sharon is not on this audit. I’m not doing all that stuff.”

He was so right… but I didn’t give the fight for clear audit documentation that easily. I decided to go to the standards to bolster my comments regarding Andrew’s audit documentation; unfortunately, the standards were not very helpful!

Indeed, the standards were so vague that I had to eat quite a bit of crow. And, although initially I couldn’t follow Andrew’s work, with some extra effort and some discussions about how to apply the standards in his audit, I was able to figure out how he supported his conclusions and he agreed to make improvements to his audit documentation. I wasn’t able to get him to put a stamp ¼ inch from the upper right hand corner of every page, but I did get him to describe the source, purpose, procedure, results and conclusion on each major document.

What the Standards Require

The standards also say that you should document:

• The nature, timing, and extent of audit procedures
• The results of procedures performed
• The audit evidence obtained
• Conclusions reached
• Supervisory review before the report is issued

Here is what the GAO requires in the Yellow Book:

8.132   Auditors must prepare audit documentation related to planning, conducting, and reporting for each audit. Auditors should prepare audit documentation in sufficient detail to enable an experienced auditor, having no previous connection to the audit, to understand from the audit documentation the nature, timing, extent, and results of audit procedures performed; the evidence obtained; and its source and the conclusions reached, including evidence that supports the auditors’ significant judgments and conclusions.

8.133   Auditors should prepare audit documentation that contains evidence that supports the findings, conclusions, and recommendations before they issue their report.

8.134   Auditors should design the form and content of audit documentation to meet the circumstances of the particular audit. The audit documentation constitutes the principal record of the work that the auditors have performed in accordance with standards and the conclusions that the auditors have reached. The quantity, type, and content of audit documentation are a matter of the auditors’ professional judgment.

Notice that the standard says nothing about cross-referencing, tick marks, stamping each page, etc. The auditing professional makes up all of those items to keep the audit documentation manageable. The Yellow Book is very open to a variety of formats and styles. As long as someone else can follow your logic, any format is fine.

Audit Documentation Etiquette

I once heard etiquette defined as “little courtesies that smooth relationships.” In other words, etiquette keeps us all from slapping each other silly. It soothes awkward situations and eases our interactions with others. Can you imagine a world where no one apologized when they accidentally step on your foot or hit you with a bag? (I had both happen as I wrote this paragraph sitting on the aisle on an airplane!)

Clear audit documentation is essential audit etiquette. It makes significant audit tasks easier and keeps the audit supervisor and peer reviewer from slapping you silly.

The Yellow Book lists the reasons why audit documentation is necessary:

8.137   Audit documentation is an essential element of audit quality. The process of preparing and reviewing audit documentation contributes to the quality of an audit. Audit documentation serves to (1) provide the principal support for the audit report, (2) aid auditors in conducting and supervising the audit, and (3) allow for the review of audit quality.

Do Everything Possible to Make the Reviewer’s Life Easier

If you have ever reviewed audit documentation, you know how hard it is to follow an auditor’s trail without applying some of Sharon’s techniques. You know how excruciating the job can be if the creator of the documents refuses to play nicely. Audit documentation review is, hands down, the worst job on the audit.

If you make this task any harder for your supervisor or reviewer, you will raise their ire in a seriously large way. Why would you want to risk annoying them so severely? Don’t you need that paycheck?

The Most Significant Way to Smooth the Review Process: Find out What They Want

Who do you have to please here? Your supervisors, managers, quality reviewers, and peer reviewers. I suggest you find out what your reviewers like to see and do it! What rules do they want followed?

If you are unclear or not sure about what the reviewers want, you can ask them whose audit documentation they like. Someone in the office has created documents that meet their standards. You know who I am talking about. Did I hear you whisper, “The kiss-up!”?

You should scrutinize the kiss-up’s audit documentation to discover what makes them so pleasing to the supervisor and then REPLICATE that! Or, if you really want to show off, you can improve on what the kiss-up has done.

And supervisors and managers should do their staff a favor and tell them what they want. It is only fair that they set clear expectations of what they want to see. Otherwise, they really have no right to complain! But that doesn’t mean they won’t! 

Rebel without a Clue

Between my experience working with Sharon and my work with Andrew’s, I rebelled, just like a willfull teenager. I had to learn the hard way that Sharon was right about a lot of things, just like some teenagers have to learn their parents aren’t entirely crazy or stupid.

As an auditor with a whopping four years of audit experience under my belt, I decided that, as soon as I got away from Sharon, I would make up my own standards for audit documentation and blow off all of her crazy, over-the-top requirements. The fact that Sharon was 5 years my senior and a fast rising audit star held no sway with me! (By the way, Sharon is now the audit director for a world-wide recognized institution. She knows her stuff!)

My next audit was an assignment I would hold for three consecutive years. The first year, having just left Sharon’s project, I did a very poor job documenting my audit work. The audit supervisor was going through a divorce, so his review wasn’t thorough. (It happens.) I didn’t realize he was asleep at the wheel and wrongly concluded that my rebellious shortcuts had worked; doing things my own way seemed to have paid off!

But the next year, I got my come-uppance. I was assigned the same audit area, and I couldn’t follow my own documentation. In particular, I could not remember where I had gotten my evidence.

One of the auditees, an investment officer who we’ll call Stan, really didn’t like me. He always sneered at me and did his best to make my life difficult. I didn’t do anything to him; he just took an immediate dislike to me – maybe because I was half-a-foot taller than he was!

When I had to ask Stan for the same information AGAIN, in a lost, befuddled way AGAIN, he nailed me to the wall. “Weren’t you just here asking me these same questions? Don’t you write anything down?” Ewww. Nope. I didn’t. I felt like I was 3 feet tall.

Leaving that meeting, I really appreciated Sharon’s standards. If I had implemented even a few of her ideas, I would have been a lot more prepared and appeared much more credible.

If you are anything like me, you can’t remember what you did last week! How in the heck can you remember, when your audit documentation undergoes peer review, what you did a year ago, or two years ago?

Commonly Used Components of Audit Documentation

Here are some common components of audit documentation that most audit shops require. Not all of them are based on the standards, but on courtesy and tradition. See whether you think these ideas are wise and practical.

Each document:

• Describes the name of project
• Has a title
• Includes the auditor’s initials
• Documents the date completed
• Includes a page number and reference
• Describes the source, purpose, procedures, results, conclusions
• Explains all tick marks
• Ensures that all cross-references go two ways
• Is neat and legible
• Referenced to the program
• Understandable without further explanation
• Indicates that important calculations were verified
• Includes source documents as necessary
• Includes the acronym PBC on the top of the document if the client produced the document (PBC stands for prepared by client)
• Indicates that a review has been performed and that  points were cleared

Let’s look at these ideas in more in-depth. 

1. The Document Is Titled, Signed, and Dated

Each working paper includes:

• Name of project
• A unique title of the working paper
• Auditor’s initials
• Date completed
• Page number and reference

This is just plain practical. I see no reason to ever skip this. But hey, the standards don’t require it. An electronic audit documentation software will automatically take care of most of this. Go ahead and skip it, you rebel you, and see how the review goes! 

2. Source, Purpose, Procedures, Results, and Conclusion on Every Page

Source, purpose, procedures, results, and conclusions, Sharon made me put these so-called “elements of a working paper” on every audit document. Every page, Sharon? How about the first page of each unique working paper? Yes, I like that better.

What do all of the elements of a working paper mean? Here are the questions that each element should answer:

• SOURCE: Where did you get the evidence on the audit document? Who gave it to you? What was the chain of custody of the evidence? What is the nature of the evidence? How can you get to the evidence again?
• PURPOSE: What question does this document seek to answer? Why was this document created and why was this work done? What program step does it satisfy?
• PROCEDURES: What did you do on this document? What methodology did you use? What were the detailed steps and procedures you performed? Go into a lot of detail here!
• RESULTS: What did the procedures yield? What were the results of applying the methodologies? This should contain the same terms and mirror the procedure element. You also want a lot of detail in this section.
• CONCLUSION: What is the answer to the question posed in the purpose? Was the program step satisfied? What did you do with any issues you found? Did you take the issues to a finding or a point disposition sheet?

That kind of information couldn’t be any more helpful to a reviewer or to you when you come back to do the work next year. Without these elements of a working paper, the reviewer has to make all sorts of logical leaps and assumptions to get through the audit documentation.

We all know that five people can look at the same set of data and come to five different conclusions! You need to be making those conclusions for the reviewer. The last thing you want as a preparer is to have some crazy, overworked supervisor making assumptions and leaping around trying to link ideas together! Guide them.

Did you notice the linkage among the elements? If you do it right, the purpose and conclusions match and the procedures and results match. This proves your clarity of thought and supports your logical conclusions. If these elements do not link together, reviewers should return the audit documentation to you until you can show that what you’ve done has meaning.

An example

Here is a simple example.

SOURCE: Project files maintained in the Graceville Public Works Department Office by Julie Neal. Tested projects from 2014.

PURPOSE: To determine whether families receiving weatherization grants are eligible; to satisfy program step 2 at A-PGM.

PROCEDURE: Sampled 30 files out of a population of 503 files. Examined each file to determine whether the most up-to-date checklist was in the file and that the student met federal eligibility requirements.

RESULTS: Out of all attributes tested on 30 files, we noted 10 errors. In 4 out of 30 files tested, the eligibility checklist was not completed. In 6 out of 30 files, the families earned more income than standard and were not eligible to receive assistance.

project #	date	income level	income eligibility meets criteria	eligibility checklist completed
A123	6/1/14	$6100	√	x
B320	7/3/14	$50,000	x	x
A415	9/15/14	$11,400	√	√
C500	11/30/14	$12,050	√	√

CONCLUSION: Not all families receiving assistance are eligible. The eligibility checklist was not filled out for 4 out of our 30 samples. We have expanded testing in order to determine the total questioned cost for the program. See working paper A-7 for the expanded testing.

The source, purpose, procedures, results conclusion formats is – hands down – one of my favorite Sharon requirements. One reason for my adoration is that these elements of a working paper help satisfy a good number of these Yellow Book documentation requirements:

8.132   Auditors must prepare audit documentation related to planning, conducting, and reporting for each audit. Auditors should prepare audit documentation in sufficient detail to enable an experienced auditor, having no previous connection to the audit, to understand from the audit documentation the nature, timing, extent, and results of audit procedures performed; the evidence obtained; and its source and the conclusions reached, including evidence that supports the auditors’ significant judgments and conclusions.

8.133   Auditors should prepare audit documentation that contains evidence that supports the findings, conclusions, and recommendations before they issue their report.

8.135   Auditors should document the following:

1. the objectives, scope, and methodology of the audit;
2. the work performed and evidence obtained to support significant judgments and conclusions, as well as expectations in analytical procedures, including descriptions of transactions and records examined (for example, by listing file numbers, case numbers, or other means of identifying specific documents examined, though copies of documents examined or detailed listings of information from those documents are not required); and
3. supervisory review, before the audit report is issued, of the evidence that supports the findings, conclusions, and recommendations contained in the audit report.

On the left side of the matrix below, I have listed most of the documentation requirements from the Yellow Book above. On the right, I have listed one of the components of SPPRC to show how they help us satisfy our compliance with the standards.

REQUIREMENT	SPPRC ELEMENT
Nature, timing, extent … of procedures performed	PROCEDURE
Results of procedures performed	RESULTS
Source of evidence	SOURCE
Conclusions reached	CONCLUSION
Objective, scope…	PURPOSE
Methodology	PROCEDURE

 

3. Every Tick Mark Is Explained

What, you ask, is a tick mark? A tick mark is a little symbol that indicates a task you have completed. For instance, a ∧ may indicate that a column of numbers has been summed and a √ may indicate that attribute was verified. In the example above, I used an X to indicate an error and a √ to indicate satisfaction of the attribute.

To explain the tick marks in the audit documentation, Sharon had a little tick mark legend, which included about 15 tick marks (and we had to paste the legend into the inside cover of each binder of audit documents). We were not allowed to change the meaning of those tick marks. This sped up her review because she knew what we meant without having to look at a unique legend each time.

4. All Cross-References Are Two-Way

To cross-reference audit documentation, if you got a number for document  A from working paper B, you would write “B” on document A near the number. And on document B, you would write a reference to document A.

A review, especially on a financial audit, is nearly impossible without two-way cross-referencing.  Electronic working papers facilitate cross referencing with hyperlinks. 

5. Each Working Paper Is Neat and Legible

I always got written up for this. Thank the heavens for computers. It saved my auditing career; my handwriting is atrocious.

6. Each Document Is Referenced to the Program

If you can’t tie the document to a program step, then you’d better take it out. Otherwise, you are subverting the audit program. 

7. Each Working Paper Is Understandable without Further Explanation

This is a very high standard, indeed, but a good thing to keep in mind as documenting work. Sharon told us many times her nightmare scenario: a hurricane hits the office and audit documentation ends up scattered all over the street.  Yes, unlikely.  She wanted someone to be able to pick up our working paper and understand exactly what it was and where it went without having to ask any questions.  Everyone realized this would never happen but it did help us understand her expectations. 

8. Important Calculations Were Verified

Verifying important calculations is crucial on a financial audit and why most new financial auditors are required to learn how to use a 10-key calculator their first week on the job. Someone needs to sum or recalculate the numbers. For very significant numbers, the supervisor might even recalculate them, too. 

9. Source Documents Were Included as Necessary

This one is tricky. What does the reviewer actually need to understand about what was tested? Make sure that any source documents that will help the reviewer are included. To determine the right level of documentation, you better check with your own personal Sharon to find out what she wants.

For instance, if you tested 30 files to see that the program director initialed a certain document, do you have to include in the file a copy of all 30 documents? I would say no. That would unnecessarily kill trees.

In my view, you should include only a description of the files or the forms so that, if necessary, someone could replicate your work. you might add a description of the file including the date created, name, director’s initials, and the date of review. You might even copy one of the forms and put it in the file just so a reviewer or a subsequent auditor could easily find the forms again.

If you had a few exceptions you could copy those and put them in the audit documentation with an explanation of how the issue was resolved. You should also consider whether the issue would make it into the report. If it would, you might copy or scan in the exceptions to strengthen your evidence.

The GAO counsels us not to describe the attributes of our evidence, but not to include a picture, scan, or copy of each piece of evidence in the audit documentation:

8.135 b. the work performed and evidence obtained to support significant judgments and conclusions, as well as expectations in analytical procedures, including descriptions of transactions and records examined (for example, by listing file numbers, case numbers, or other means of identifying specific documents examined, though copies of documents examined or detailed listings of information from those documents are not required) 

10. If the Client Produced a Document, Write “PBC” on the Document

PBC stands for Prepared By Client. “PBC” indicates to the reviewer that the auditee created the document, and this matters when determining strength of evidence. Generally, evidence directly obtained by the auditor directly is considered stronger than evidence that the client provides because the client may alter the data to mislead the auditor. 

11. A Review Has Been Indicated

This is not a Sharon standard; it is a Yellow Book and an AICPA standard that the audit documentation should be reviewed before the report is issued.

The reviewer could use any of the following ways to evidence that a review was performed:

• Initial and date each document.
• Initial only significant document.
• Create a checklist and include it at the front of the audit documentation.
• Initial the binder.
• Write up review comments and include them in the audit documentation.

Which approach is right? This is left up to professional judgment. Sharon’s professional judgment told her to initial each document, fill out a review checklist, write review comments, and initial the binder and folder. Like I said, she was very thorough. An audit partner in a busy CPA firm might simply sign off on a checklist. Both approaches evidence supervisory review.

Next week, we are going to wrap up these steps!

Want to learn more about the basics of how to conduct an audit, please enjoy the Essential Audit Skills Bundle.