| name | audit-support-workpaper-requirements |
| description | Sub-skill of audit-support: Workpaper Requirements (+2). |
| version | 1.0.0 |
| category | business |
| type | reference |
| scripts_exempt | true |
Workpaper Requirements (+2)
Workpaper Requirements
Every control test should be documented with:
-
Control identification:
- Control number/ID
- Control description (what is done, by whom, how often)
- Control type (manual, automated, IT-dependent manual)
- Control frequency
- Risk and assertion addressed
-
Test design:
- Test objective (what you are trying to determine)
- Test procedures (step-by-step instructions)
- Expected evidence (what you expect to see if the control is effective)
- Sample selection methodology and rationale
-
Test execution:
- Population description and size
- Sample selection details (method, items selected)
- Results for each sample item (pass/fail with specific evidence examined)
- Exceptions noted with full description
-
Conclusion:
- Overall assessment (effective / deficiency / significant deficiency / material weakness)
- Basis for conclusion
- Impact assessment for any exceptions
- Compensating controls considered (if applicable)
-
Sign-off:
- Tester name and date
- Reviewer name and date
Evidence Standards
Sufficient evidence includes:
- Screenshots showing system-enforced controls
- Signed/initialed approval documents
- Email approvals with identifiable approver and date
- System audit logs showing who performed the action and when
- Re-performed calculations with matching results
- Observation notes (with date, location, observer)
Insufficient evidence:
- Verbal confirmations alone (must be corroborated)
- Undated documents
- Evidence without identifiable performer/approver
- Generic system reports without date/time stamps
- "Per discussion with [name]" without corroborating documentation
Working Paper Organization
Organize testing files by control area:
SOX Testing/
├── [Year]/
│ ├── Scoping and Risk Assessment/
│ ├── Revenue Cycle/
│ │ ├── Control Matrix
│ │ ├── Walkthrough Documentation
│ │ ├── Test Workpapers (one per control)
│ │ └── Supporting Evidence
│ ├── Procure to Pay/
│ ├── Payroll/
│ ├── Financial Close/
│ ├── Treasury/
│ ├── Fixed Assets/
│ ├── IT General Controls/
│ ├── Entity Level Controls/
│ └── Summary and Conclusions/
│ ├── Deficiency Evaluation
│ └── Management Assessment