Inside Assurance Toolkit #08 — Audit Finding Working Paper

Audit Finding Working Paper: from observation to supported action

An audit observation becomes useful when a reader can follow the reasoning from an expected requirement to the evidence, the business exposure and the action that addresses it. A finding written as “approval controls need improvement” gives the action owner little to test or fix. A working paper should make each link visible.

Start with the gap

Record the criteria: the policy, control objective, contract term or other basis against which the activity is assessed. Describe the condition observed during the engagement and the period and population it covers. Point to the evidence and test method. If the difference is based on a sample, state the sample and the limit of what it can show. A missing document is not automatically proof that an underlying activity never occurred; examine the relevant records before drawing that conclusion.

For example, consider a fictional purchasing process in which some orders appear to have been released before the approval recorded in the system. This is an illustration, not a claim about a real organization. The working paper would reference the applicable approval rule, the order and approval timestamps, the scope of the test and any exceptions investigated.

Explain cause, consequence and risk separately

A cause is an explanation supported by inquiry and evidence. “Staff forgot” is too easy to write if routing design, workload or exception handling have not been examined. Work with management to investigate the underlying cause when possible, and mark an unconfirmed cause as open rather than presenting it as fact.

Record an observed consequence only when it has been evidenced. Then describe the potential risk as an exposure to a business objective. In the purchasing example, an order released before authorized approval may create a risk of commitments being made without timely review. That does not prove that a loss occurred. Consider likelihood, impact, existing controls and the organization’s own risk methodology when explaining significance. The template deliberately does not generate a universal score.

Separate the response from the test of the response

The auditor may recommend a direction, ask management for an action plan or agree an action with management. State the management action in terms that can be evidenced, assign an accountable owner and record a due date. An action such as “remind the team” may leave the process weakness intact if the cause lies in approval routing.

Finally, track implementation evidence and validation result in different fields. A new procedure, a system change or a completed training record can show that an action was implemented. A later audit test asks whether the change addresses the exposure in operation. Record exceptions and remaining risk. Administrative closure alone should not be presented as proof of risk resolution.

Download the Inside Assurance working paper to document the finding, management response and follow-up. The example tab uses a fictional scenario; replace it with evidence from your own engagement and apply your organization’s methodology.

Beyond the numbers. Inside the business.