ave you ever been in the midst of reading a book, only to find one of the pages ripped out? After getting past the frustration, you probably tried to imagine what was on the missing page so you could fill in the gaps of the story. A critical detail that might change your understanding of the story? A plot twist? Are there more missing pages?
Audit documentation functions in the same manner. Audit working papers play the same role as pages in a book. When documentation is missing or minimal, readers (e.g. reviewers) may not understand the message you are trying to share, which may prevent them from properly assessing risks or analysing inconsistent or conflicting information. Missing information may also lead regulators to conclude that an auditor has not performed sufficient work. Also, when an audit procedure is not contemporaneously documented, doubts often arise as to whether the procedure was indeed performed during the audit.
Lack of adequate documentation was cited as a deficiency in almost 30 percent of the disciplinary orders issued by the Institute in 2021. This statistic points to the need for improvements to audit documentation to ensure it serves its intended purpose. Documentation is one of the most effective ways to link different but related parts of an audit engagement in a way that allows reviewers or regulators to identify gaps or inconsistencies in information. Failure to adequately document the nature, timing, extent, and conclusions of audit procedures may lead to deficient audit quality, which could result in lower job performance ratings, and in extreme circumstances, disciplinary action.
Below are tips from the Institute’s Compliance Department, based on actual documentation deficiencies encountered in the investigation process.
- Document sufficient details about the nature, timing, and extent of the audit work performed. This includes identifying information about the person who performed or reviewed the work and when. Good documentation also includes information about which items were subject to testing, the coverage of items tested, and what specific supporting documents were inspected by the audit team.
- New technologies, like data analytics, have often been incorporated into audit testing. Working papers should include sufficient documentation for reviewers to understand how related risks were assessed and objectives addressed when relying on new technologies.
- For tests involving samples, the following information should be documented in the working papers: What is the basis of selection (e.g. systemic, haphazard, judgemental)? How is the sample size determined? How is completeness of the population confirmed?
- When dealing with medium- to high-risk issues requiring significant judgement, auditors are advised to document the analysis and thought process that led to the conclusion. This step will help support their judgement, should questions arise during the review process or beyond. (Visit the Code of Ethics for Professional Accountants, section 120.12 to learn more about biases and how they may impact professional judgement).
- Clearly state conclusions and your basis for conclusions. A statement like “tests were performed and the account is not materially misstated” would not be considered adequate, as it fails to articulate any information about the tests that were performed.
- Clearly and concisely document inconsistencies that were identified and how they were resolved.
- Document discussions about significant matters or audit issues with management, experts e.g. valuer and engagement quality control reviewer, and note the outcomes of those discussions.
- Document your audit procedures, results, and conclusions in the audit files rather than personal files that are not part of the audit working papers.
- Document the source of evidence presented or referred to in the working papers.
- Document contemporaneously to minimize the risks that relevant information may not be captured properly.
- Before concluding on a significant or challenging matter, “stand back” and evaluate both corroborative and contradictory audit evidence. Document how the contradictory evidence was dealt with to address the threat of possible cognitive biases.
- Give thoughtful consideration as you perform audit procedures and prepare audit documentation to ensure you have met the audit objectives. For example, you may have considered that some areas warranted further enquiry and test work. If so, document sufficiently so that you can effectively respond to potential questions from reviewers and regulators.
- Adopt a holistic point of view in audit documentation. For example, audit programmes, audit schedules, completion memos, etc., all form a complete set of working papers. They should be prepared and updated with a consistent approach. One pitfall that auditors seem to experience is preparing these documents at the file assembly stage. Relevant details may have lapsed from an auditor’s memory by that time.
- Competent auditors typically adopt internal quality control standards that require documentation to contain sufficient details to allow re-performance by an informed third party such that the same test result would be generated. As set out in the examples stated in previous points, auditors should clearly document the purpose of a test, how the samples were selected, the steps and procedures that were carried out, conclusions, etc.
Remember, documentation tells the story of an auditor’s journey through a client’s financial records and internal control system. Your job is to ensure that the working papers properly convey that story. Missing information may turn a mystery into a tragedy. As they say, “the devil is in the details.”
