Internal Audit Polices and Procedures
Chapter 15 - Working Paper Documentation
Proper working papers demonstrate professionalism and document the work that was done from the preliminary stages of a project audit through the final report. Audit working papers also show whether due professional care was exercised and illustrate compliance with professional auditing standards. This section of the manual contains characteristics of well-organized and documented working papers and should be used in evaluating the adequacy of working papers. Careful documentation of work performed is necessary to support the findings, recommendations, and opinions contained in the final audit report or close-out letter.
The degree of documentation is based on the judgment of the individuals responsible for forming an opinion, the nature of a project, and the adequacy and effectiveness of the system of internal controls. Guidance regarding exercise of judgment relating to working papers is found in several professional standards.
The Codification of Standards for The Professional Practice of Internal Auditing, Section 420.5.b states:
The organization, design, and content of audit working papers will depend on the nature of the audit. Audit working papers should, however, document the following aspects of the audit process:
Similarly, the Codification of Statements on Auditing Standards, published by the AICPA (AU Section 319.26)
The auditor should document the understanding of the client's internal control structure elements obtained to plan the audit. The form and extent of this documentation is influenced by the size and complexity of the operation, as well as the nature of the internal control structure. For example, documentation of the understanding of the internal control structure of a large, complex operation may include flowcharts, questionnaires, or decision tables. For a smaller operation, however, documentation in the form of a memorandum may be sufficient. Generally, the more complex the internal control structure and the more extensive the procedures performed, the more extensive the auditor's documentation should be.
Finally, Section 4.35 of the Government Auditing Standards advises that:
Working papers should contain sufficient information to allow an experienced auditor having no previous connection with the audit to ascertain from them the evidence that supports the auditorsí significant conclusions and judgments.
Working Paper Guidelines
Working papers should provide:
General guidelines for the preparation of working papers are:
Completeness and Accuracy - Workpapers should be complete, accurate, and support observations, testing, conclusions, and recommendations. They should also show the nature and scope of the work performed.
Clarity and Understanding - Working papers should be clear and understandable without supplementary oral explanations. With the information the working papers reveal, a reviewer should be able to readily determine their purpose, the nature and scope of the work done and the preparer's conclusions.
Pertinence - Information contained in working papers should be limited to matters that are important and necessary to support the objectives and scope established for the assignment.
Logical Arrangement - Working papers should follow a logical order. See the Organization section, below:
Legibility and Neatness - Working papers should be legible and as neat as practical. Sloppy workpapers may lose their worth as evidence. Crowding and writing between lines should be avoided by anticipating space needs and arranging the workpapers before writing.
For routine audits and special projects, the structure of working papers should follow the standard format established for the department. Refer to Sample Forms for sample of standard forms. Organization of working papers for misuse investigations is addressed in Section 13.
The standard format groups audit work into seven major sections:
This structure presents the final product of an audit project - the report - first, followed by supporting details of findings, summary administrative information about a project, then work supporting the finding and recommendations presented in order it was performed.
General requirements for working paper are:
work should be presented on 8 1/2" x 11" paper.
Whenever possible, working papers and exhibits should be placed in a binder so the information on the page can be read without turning the binder.
Items with information presented in landscape format should usually be mounted on 8 1/2 x 11 with the excess width folded at the right.
Single-page exhibits with information presented in portrait format can be placed in a binder as an individual working paper. However, if more than minor analysis of the information on the exhibit is needed, the exhibit should be mounted on left hand side of 14-column ledger paper with the analysis summarized on the right of the 14-column. This 14-column presentation should also be used for multi-page exhibits in portrait format.
paper should have a descriptive, 4-line heading of:
UNC Internal Audit,
(as of date or review period)
(description of test/ item on the page)
|Initials/Date||Each working paper should be dated and initialed by the preparer; the reviewer should mark the working paper to show that it has been reviewed and approved.|
are used to simplify documenting work done and conditions found,
during fieldwork. A legend that defines each tickmark should be
and located near the tickmarks used. If the tickmark legend is not on
working paper where the tickmarks are used, the working paper should be
referenced to the tickmark legend.
Tickmarks should be concise and should adequately explain the results of the audit procedure performed. It should be evident as to whether or not an error or weakness was noted. Items tested should never be left blank,. either the results of the test should be documented, the attribute should be marked as not applicable, or an explanation should be provided as to why the test could not be performed. Explanations should be provided to show why items marked "N/A" are not applicable
in the working paper should be given a unique reference number that
its location. The number assigned should begin with a capital letter
matches the section of the working papers where the page will be filed
(e.g. planning working papers will start with the letter D), followed
a dash and a number that allows the page to be filed in a logical
If a w/p continues for multiple pages, or if there are exhibits
a working paper, subsequent pages and the exhibits should have the same
letter and first number identifier followed by a lower case letter or
a period and another number.
For example the first page of the Planning Memo is numbered D-1 with subsequent pages of the memo numbered D-1a, D-1b etc. or D-1.1, D-1.2, etc. Or, in the Internal Control section, the first control narrative would be numbered E-2 and subsequent pages of the narrative would be numbered E-2a, E-2b... Exhibits supporting information contained in the narrative would also be numbered E-2.1, E-2.2, etc. The second control narrative would be numbered with an E-3 sequence. This approach provides a way to logically link related w/pís and gives enough flexibility for pages to be added as needed.
Avoid numbering pages X-1, X-2, X-3... (where X is any letter identifier) when the pages contain related information.
audit program step, working papers should contain a summary of the
of work performed and a conclusion about these results.
For internal control and workflow evaluations, conclusions should address the adequacy of the system or process. That is, whether the design of the system contains the features needed to provide reasonable assurance that managementís objectives will be met. The conclusion should appear at the end of the control narrative.
Conclusions about testwork should address whether or not the expected controls or processes identified in the review of internal controls or work flows are in effect. If there is room, the summary and conclusion can be placed on the working paper that documents the testwork. Otherwise, a leadsheet that contains the summary and conclusion for the audit step should be prepared.
In both cases, the conclusion should identify the overall significance of any weaknesses or exceptions found.
Information that is protected by privacy laws should not be included in the working papers. Personnel records and student records are protected by privacy laws. When we review these type of records in an audit, names, social security numbers, and other identifying information should be expunged from the working papers.
Avoid including multiple copies of an item in the working papers or any item that is not needed to support the work performed and the findings and conclusions in the audit report.
|Memos to Future Auditors||Memos
to future auditors should be placed in the Administration section of
w/pís. A copy should also be place in the departmental file for the
audited or the area that is affected by the memo.
|Return to Home Page||Table of Contents|