F.11 Internal Audit Working Papers

1. All Practice Review and Internal Audit (PRIA) working papers must be included in the TeamMate internal audit file. Working papers will be developed in TeamMate and, once signed as prepared, are considered ready for review. Items above Protected B are only available in paper form and will be maintained separately.

2. Working papers serve as tools to aid the internal auditor in performing his or her work, as input to communication with client management during the audit, and as written evidence of the work done to support the internal auditor’s report. Section 2310 of the International Standards for the Professional Practice of Internal Auditing (Standards) indicates that information included in working papers should be sufficient, reliable, relevant, and useful to achieve the engagement’s objectives and to support the engagement results and conclusions:

   1. Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the internal auditor.

   2. Competent information is reliable and the best attainable through the use of appropriate audit techniques.

   3. Relevant information supports audit findings and recommendations and is consistent with the objectives for the audit.

   4. Useful information helps the Office of the Auditor General of Canada (Office) meet its goals.

3. A useful and effective quality control test of the conclusion on an internal audit working paper is to have a second internal auditor review the working paper without the conclusion showing to see if he or she comes up with a similar conclusion.

4. In addition to serving as a reference for the preparer when reporting findings or answering questions, other individuals may find it necessary to use the working papers:

   1. PRIA will use the working papers to review the quality of the audit project and also to evaluate the internal audit staff assigned to the work.

   2. The manager whose unit is being audited may use details included in the working papers to help implement improvement action or to communicate details to operating staff.

   3. Upper management or other individuals who may have requested the audit require timely interim reports. Well-organized working papers help to accomplish this goal.

   4. External auditors review the work performed by PRIA in order to establish their level of reliance on internal audit work and to evaluate the effect of internal audit activities on the Office’s overall system of internal control.

   5. Solid working paper documentation is essential for questions from potential outside reviewers.

5. Regardless of the methodology or level of mechanization used for documenting audit results, the quality, techniques, and types of working papers employed must adhere to the Standards.

6. Internal auditors must base their conclusions and engagement results on appropriate analysis and evaluations.

Qualities of Good Working Papers

7. Concise — Working papers must be confined to those that serve a useful purpose.

8. Complete — Working papers must be able to “stand alone.” This means that all questions must be answered, all points raised by the reviewer must be cleared, and a logical, well-thought-out conclusion must be reached for each audit segment.

9. Uniform — Electronic working papers should be created and saved in the common formats adopted by PRIA. They should be promptly filed and readily accessible within the standard filing structure, thereby also becoming subject to standard systems backup routines.

10. Neat — Working papers should not be crowded. Allow for enough space on each schedule so that all pertinent information can be included in a logical and orderly manner. At the same time, keep working papers economical. Copies, forms, and procedures should be included only when relevant to the audit or to an audit recommendation. Also, try to avoid unnecessary listing and scheduling. All schedules should have a purpose that relates to the audit procedures or recommendations.

Working Paper Techniques

11. Descriptive Headings — All working papers should include the title of the audit, audit project number, title of the working paper, preparer’s initials, date prepared, source of information, purpose of the working paper, and conclusion. In addition, the security level of the working paper must be included. By default, all working papers are at a minimum Protected A.

12. Tick Marks — The auditor makes frequent use of a variety of symbols to indicate work that has been done. These symbols are commonly referred to as tick marks and are built into TeamMate.

13. Cross referencing — Cross referencing within working papers should be complete and accurate, using electronic links to speed navigation where possible. Working papers should be cross referenced to the audit findings. Audit findings should be cross referenced to the exit conference memo and/or the audit report to indicate final disposition of the item. Cross referencing should be done in the margins of audit report drafts. These references readily provide direct access to the working papers.

14. Carry Forward — The auditor should make full use of the working papers developed in the prior audit. Flowcharts, system descriptions, and other data may still be valid. Those papers that remain useful should be made a part of the current working papers. They should be updated with current information, renumbered, referenced, and initialed and dated by the current auditor.

Types of Working Papers

15. For electronic working papers, a separate TeamMate file should be created for each audit, using the library for internal audit. Any manual work papers produced should be added into TeamMate and be fully cross-referenced.

16. Schedules and Analyses — These are useful for identifying statistical trends, verifying the accuracy of data, developing projections or estimations, and determining if tasks or records have been properly completed. Each record review, data schedule, or analyses should include

    1. an explanation of its objective and purpose (reference audit step);

    2. the methodology used to select the sample, make the calculation, etc.;

    3. the criteria used to evaluate the data;

    4. the source of data and timeframe considered;

    5. a summary of the results of the analyses; and

    6. the auditor’s conclusion.

17. Documents — Copies (preferable) or scans, or actual samples of various documents can be used as examples, for clarification, and as physical evidence to support a conclusion or prove the existence of a problem. (Original documents will never be kept by PRIA in an audit file.) These documents can be memos, reports, electronic files, computer printouts, procedures, forms, invoices, flowcharts, contracts, or any of numerous other items. Any scanned or copied document should serve a useful audit purpose. The preferred format is electronic unless it does not exist in that format. Links to INTRAnet pages, policies, etc. should be archived in the event that the page changes.

18. Documents received from the audited area are to be housed in TeamMate in a separate folder from working papers to ensure reviewers understand what was prepared by PRIA and what was received from them. Naming conventions will be used to assist in this understanding (PBC – Provided by client, PBI – Provided by Intranet, PUB – Public, etc.).

19. The following suggestions are offered for preparing working papers using documents rather than the auditor’s notes:

    1. Indicate both the person and the file that the document came from.

    2. Scan/copy and insert only that portion of the report, memo, procedure, etc., which is needed for purposes of explanation or as documentation of a potential finding. Do not include the entire document in the working papers unless absolutely necessary.

    3. Fully explain the terms and notations found on the document, as well as its use. This is especially true when including maps, engineering drawings, or flowcharts in the papers. These explanations may be made on an attached preceding page or on the face of the document itself. Use of this client-oriented terminology will prove useful in later communications, including reporting.

    4. Each document should be cross referenced either to the page or separate analysis where it was discussed.

    5. No document or working paper should be included in the internal audit file without an explanation of why it was included.

    6. Electronic links to other files/documents should be identified.

20. Process Write ups and Flowcharts — In many audits, it is necessary to describe systems or processes followed by the audited area. Describe such procedures or processes through the use of write ups or flowcharts or some combination of the two. The choice of which method to use will depend on the relative efficiency of the method in relation to the complexities of the system being described.

21. Write ups in point form are often easier to use, and should be used, if the system or process can be described clearly and concisely. However, when write ups would be lengthy, and description of related control points is difficult to integrate into the narrative, flowcharting (or a combination of write ups and flowcharting) is an appropriate alternative. Flowcharts conveniently describe complex relationships because they reduce narrative explanations to a picture of the system. They are concise and may be easier to analyze than written descriptions (refer to D 8).

22. Interviews — Most verbal information is obtained through informal or formal interviews conducted either in person or by telephone. Formal interviews are most desirable because the interviewers know they are providing input to the audit; however, impromptu interviews, or even casual discussions, can often provide important information. Any verbal information which is likely to support a conclusion in the audit working papers should be documented. Interviews are useful in identifying problem areas, obtaining general knowledge of the audit subject, collecting data not in a documented form, and documenting the audit customer’s opinions, assessments, or rationale for actions. Interview notes should contain only the facts presented by the person interviewed, and not include any of the internal auditor’s opinions.

23. Information obtained in interviews (especially informal) is the weakest type of audit evidence. If it is the sole source of evidence, the minutes must be signed or approved by email by the individual providing the information. Other corroborating evidence is essential to ensure a non-biased audit finding.

24. In preparing interviews for working papers, consider the following suggestions:

    1. Be sure to include the name, department, and position title of all persons from whom information was obtained. This includes data gathered during casual conversations.

    2. Indicate when and where the meeting occurred.

    3. Organize notes by topic wherever possible.

    4. Identify sources of information quoted by interviewee.

25. Observations — What the auditor observes can serve the same purposes as interviews. If observations can be used to support any conclusions, then they should be documented. They are especially useful for physical verifications.

26. Observations used as supporting documentation should generally include

    1. time and date of the observation;

    2. where the observation was made;

    3. who accompanied the auditor during the observation; and

    4. what was observed. When testing is involved, the working papers should include the sample selections and the basis of the sample.

27. Findings — All audit findings should be documented in the working papers (see D-12). All findings should be documented immediately by the auditor discovering the situation.

28. Use of the exceptions function in TeamMate will assist the auditor in keeping all findings organized. This summary should include the working paper reference, the finding and recommendation, the auditor who discovered the finding, audit customer response to the finding, and finding disposition with reasons (reported, discussed, waived, etc.).

Last modified:

2018-04-11