If you’re a new internal auditor, chances are you’ve Googled something along the lines of
- “How to prepare internal audit workpapers”,
- “What should internal audit workpapers include?”, or
- “Step-by-step guide to organizing internal audit documentation”.
These searches reflect a common challenge: producing clear, consistent, and comprehensive workpapers can feel overwhelming when you’re just starting out.
Workpapers are the backbone of any internal audit. They document what you tested, how you tested it, what you found, and why you reached your conclusions. High-quality workpapers not only support your audit results; they also make life easier for everyone—future auditors reviewing prior work, your seniors checking the quality of your testing, and even external parties (like regulators or external auditors) examining your approach. By learning how to prepare, organize, and manage workpapers efficiently right from the start, you’ll gain confidence, save time, and enhance the credibility of your work.
In this comprehensive, beginner-friendly guide, we’ll break down everything you need to know. We’ll clarify what workpapers are, explain how to set up a logical structure, show you what information to include, and provide tips for working in both large organizations with ready-made templates and smaller firms where you may have to build from scratch. We’ll also discuss real-world examples, highlight templates, and share best practices that will help you complete your workpapers quickly and without unnecessary hassle.
What Are Internal Audit Workpapers, and Why Do They Matter?
Workpapers (often called audit documentation) are the records you create and maintain while performing an internal audit. They are the evidence that supports every step of your audit process. Imagine them as the “receipts” proving you did what you said you did—tested controls, verified transactions, interviewed stakeholders, analyzed data—and that your conclusions are based on solid evidence.
For new internal auditors, the importance of well-organized workpapers cannot be overstated. Here’s why:
• Clarity and Efficiency: When workpapers are logically organized, you can quickly find supporting documents, reference your testing steps, and understand the audit’s scope. This saves time when your manager reviews your work or when you need to revisit previous audits.
• Accountability and Credibility: Workpapers show that you performed the audit diligently, followed a methodology, and relied on factual evidence rather than guesswork. This credibility matters to internal stakeholders (like senior management and the audit committee) and external entities (such as regulators).
• Knowledge Transfer: If you leave the audit team or take on new assignments, your successors should be able to step into your shoes and understand what you did without starting from scratch. Good documentation fosters organizational memory.
Common Challenges for New Internal Auditors
As a beginner, you might find yourself asking:
• “Where do I even start?” Without a clear starting point, you might struggle to figure out what needs documenting and where to put it.
• “How do I know what to include?” Deciding which details to capture can be confusing. Should you include entire emails, or just summaries? Screenshots of systems, or just transaction samples?
• “What if my department has no templates?” At smaller firms, you may have to build your own structure. Where do you get started if no standards are provided?
We’ll address these questions head-on. By the end of this guide, you’ll have a clear roadmap for creating and managing internal audit workpapers efficiently, even if you’re brand new to the process.
How to Get Started with Your Internal Audit Workpapers
Step 1: Understand the Audit Scope and Objectives
Before you create a single workpaper, you must know what you’re auditing and why. Review the audit plan or engagement letter. Identify key objectives, such as:
• Are you testing controls over financial reporting (e.g., verifying that invoices are approved properly)?
• Are you evaluating operational efficiency (e.g., assessing how effectively a process meets certain KPIs)?
• Are you checking compliance with regulations (e.g., ensuring data privacy rules are followed)?
By understanding these objectives, you’ll know what evidence to collect and what tests to perform. This clarity makes it easier to structure your workpapers because each piece of documentation should tie back to an audit objective.
Step 2: Familiarize Yourself with Your Internal Audit Departmental Templates and Tools
If You’re in a Large Organization (e.g., a Big Bank):
Chances are your internal audit department has standardized templates and tools. Look for:
• Audit Management Software: Platforms like AuditBoard, TeamMate, or Galvanize often provide built-in templates, indexing systems, and standardized forms.
• Department Templates: Ask your manager or senior auditor for standard templates used for planning, fieldwork, and reporting. These might include checklists for walkthroughs, sample selection spreadsheets, or memo templates.
• Previous Audits for Reference: Review prior completed audits. By examining well-prepared workpapers, you’ll learn what “good” looks like and how the department prefers to see documentation.
If You’re at a Small Firm or a Company Without Set Templates:
Don’t worry—you can create a basic but effective system:
• Start with a simple folder structure (e.g., Planning, Fieldwork, Findings, Reporting).
• Create a basic word-processing or spreadsheet template that includes fields for audit objective, test steps, evidence references, and conclusions.
• Develop a consistent naming convention for files (e.g., “[Year]-[AuditNo]-[Process]-[DocumentType]”).
• Save examples of good documentation as you go. Over time, these become your department’s unofficial templates.
Step 3: Set Up a Logical Folder and Indexing Structure
A logical structure prevents chaos. Consider an indexing approach like:
1. Planning Documents: Engagement letter, audit scope, preliminary risk assessments, audit program.
2. Process Understanding: Flowcharts, narratives, system descriptions, interviews with process owners.
3. Testing Workpapers: Detailed test steps, samples selected, evidence copies, test results.
4. Findings and Issues: Documentation of exceptions, root cause analysis, and management’s responses.
5. Summary Memos and Reports: Final internal audit report, executive summaries, and sign-offs.
Indexing example:
• Folder A: Planning
• Folder B: Process Documentation
• Folder C: Control Testing
• Folder D: Substantive Testing
• Folder E: Issues and Recommendations
• Folder F: Summary and Final Deliverables
Within each folder, use a consistent naming convention:
• C1_ControlTest_WorkpaperName for the first control test workpaper
• C2_SubstantiveTest_SampleAnalysis for the second test workpaper
This structure ensures that anyone reviewing can quickly understand how workpapers flow from planning to conclusion.
What to Include in Your Workpapers: The Essentials
As a new internal auditor, it’s easy to over- or under-document. The goal is sufficient, not excessive documentation. Focus on including:
Key Elements of an Internal Audit Workpaper
• Audit Objective or Purpose: Clearly state what the workpaper aims to test or verify. For example, “To verify that all invoices above $10,000 are approved by a manager and recorded accurately.”
• Procedure Performed: Document the test steps you took. For instance: “Selected a sample of 20 invoices exceeding $10,000 from the Q2 transaction log and traced approvals back to department managers’ signatures.”
• Evidence References: Link to supporting documents. This could be screenshots of system approvals, copies of invoices (redacted for confidentiality), or a summary table in a spreadsheet. Always note where the evidence can be found (e.g., “See Invoice_Approval_2023.xlsx, Tab ‘Sample List’”).
• Results and Conclusions: State whether the procedure’s result met the expected criteria. Did you find exceptions? If yes, how many and what type? Conclude with a clear statement like “No exceptions noted” or “3 of 20 invoices lacked a manager’s signature.”
• Sign-Offs: Typically, the preparer (you) sign off after completing the test, and a reviewer (your senior) signs off after ensuring the workpaper is complete and accurate.
Additional Considerations
• Avoid Unnecessary Information: While detail is good, don’t clutter your workpapers with irrelevant emails, lengthy policy documents, or excessive screenshots. If you reference a policy, include only the relevant excerpt.
• Be Objective and Clear: Use factual, neutral language. Don’t use vague terms like “seems correct.” Instead, say: “Verified that each invoice sample had an authorized manager’s signature per the company’s approval matrix.”
• Maintain Professional Tone and Formatting: Use consistent fonts, headings, and bulleted lists. A professional format makes it easier for others to read and follow.
Practical Tips for Completing Workpapers Efficiently
1. Start Early, Don’t Wait Until the End
As soon as you finish a test step, record what you did. Waiting until the end of the audit often leads to rushed documentation, missing details, and confusion about what was tested. By documenting as you go, you keep everything fresh in your mind, producing clearer and more accurate workpapers.
2. Use Checklists and Templates to Stay Organized
For new internal auditors, checklists are a lifesaver. A simple checklist can remind you to:
• Confirm the sample size and selection method.
• Ensure each test step is documented.
• Attach or reference the correct supporting evidence.
• Summarize findings before moving to the next test.
If your department or firm doesn’t provide a checklist, create your own. Over time, you’ll refine it as you discover which steps you frequently overlook.
3. Leverage Technology for Automation
If you have access to audit management software, take advantage of features like:
• Automated Indexing and Version Control: No need to manually track versions of your documents. The tool does it for you.
• Built-in Templates: Let the software’s structure guide what you include.
• Linking Features: Some tools allow you to link a conclusion directly to evidence, making review more efficient.
If no specialized software is available, even simple features in Excel or Google Sheets—like hyperlinks, filters, and pivot tables—can streamline how you reference and analyze data.
4. Learn from Examples
Ask your peers or seniors for examples of exemplary workpapers. Seeing how experienced auditors structure their documents will give you a model to emulate. Take note of how they lay out test steps, reference evidence, and highlight conclusions. Over time, you’ll develop your own style, but examples are a great starting point.
5. Communicate with Your Team
If you’re unsure about what to include, ask. A quick conversation with your senior or manager can clarify expectations. It’s better to ask and get it right the first time than to guess and redo your work later.
Dealing with Different Organizational Sizes and Complexity
In a Big Bank or Large Internal Audit Department
You might encounter:
• Extensive Templates: Larger departments typically have standard templates you must follow. These might include standardized headings for objectives, procedures, and conclusions. Embrace these templates; they save time and ensure consistency.
• Robust Guidance Materials: Big organizations often have internal audit manuals, training modules, and detailed SOPs. Review these resources to understand departmental best practices.
• Quality Assurance Reviews: Expect your workpapers to be reviewed by multiple layers (senior auditor, audit manager, quality assurance team). High-quality initial documentation reduces rework.
In a Small Firm or a New Internal Audit Team
With fewer resources and no pre-established templates, you’ll need to be resourceful:
• Start with a Simple Structure: Develop a basic template in Word or Excel. Include fields for objectives, tests performed, results, and references.
• Refine Over Time: Don’t aim for perfection immediately. After a few audits, review what worked and what didn’t, and adjust your template accordingly.
• Learn from External Resources: Browse professional association websites (like The Institute of Internal Auditors), watch webinars, or read articles to gather best practices that you can tailor to your environment.
Examples and Templates
Below are some simple examples you can reference or adapt. Note: These are illustrative and may not reflect the complexity of your specific audit environment.
Example Workpaper Template (Word or Google Docs)
Document Title: Accounts Payable Controls Testing – Invoice Approval
Reference: C1_AP_ControlTesting
Objective: Verify that all invoices above $10,000 are approved in accordance with the authorized approval matrix.
Procedure Performed:
1. Obtained the Q2 transaction log of all invoices over $10,000.
2. Selected a random sample of 20 invoices using a random number generator in Excel.
3. Reviewed invoice documentation for each sample and checked for manager’s approval signature.
4. Compared the manager’s name to the authorized approval matrix and ensured that the manager had appropriate authorization limits.
Evidence and References:
• Invoice samples saved in “InvoiceSamples_Q2_2023.xlsx” – Tab “SelectedInvoices”
• Approval matrix in “ApprovalMatrix_2023.pdf” – Stored in folder B: Process Documentation
Results:
• 17 of 20 invoices had proper manager approval.
• 3 of 20 invoices (Invoice #123, #456, #789) did not have a manager’s signature. Instead, they showed only a clerk’s initials.
Conclusion:
Exceptions noted. Manager-level approval was not consistently obtained for higher-value invoices. This indicates a potential control breakdown. Further inquiry is recommended to understand why these three invoices lacked appropriate authorization.
Preparer: Jane Doe (Signature/Initials) – 08/15/2023
Reviewer: John Smith (Signature/Initials) – 08/20/2023
Reviewing and Finalizing Your Workpapers
As a new internal auditor, your first drafts won’t be perfect. That’s okay—what matters is being open to feedback and improvement.
Internal Review Process
• Self-Review: Before submitting your workpapers, read through them once more. Check for typos, incomplete references, or unclear conclusions.
• Peer Review: If time and workload permit, have a colleague quickly glance through your work. A fresh pair of eyes can spot confusing sections you might have missed.
• Manager Review: Your manager or senior auditor will provide more formal feedback. Take note of their comments and use this as a learning opportunity to refine your documentation style.
Common Feedback Points and How to Address Them
• “Insufficient Detail”: If your reviewer says you didn’t provide enough information, try adding more specifics about sample selection criteria, the source of data, or the exact test steps performed.
• “Too Much Information”: If they say your workpaper is too cluttered, remove extraneous documents or overly long narratives. Focus on what’s essential to support the conclusion.
• “Unclear Conclusions”: Ensure that your conclusion explicitly states whether the objective was met and if any exceptions were found. Don’t assume readers know what you’re thinking; spell it out.
Maintaining Quality Over Time
As you gain experience, preparing workpapers will become second nature. You’ll know what to include, how to structure your testing, and how to reference evidence efficiently. To maintain quality:
• Update Your Templates Regularly: As standards evolve or your department’s methodology changes, update templates and naming conventions.
• Attend Training and Read Guidelines: Keep an eye on best practices from professional bodies like the IIA. New techniques or technologies might improve how you document work.
• Solicit Continuous Feedback: Ask your manager how you can improve. If you join a larger audit engagement, see how other teams do their documentation and integrate their best practices into your routine.
Final Thoughts
For new internal auditors, preparing and organizing internal audit workpapers can feel daunting at first. However, by following the principles outlined in this guide—understanding the audit scope, using templates where available, setting up a logical folder structure, focusing on essential details, and seeking feedback—you’ll quickly gain confidence and efficiency.
Remember, workpapers are not just administrative documents; they’re crucial records that underpin your audit conclusions. Well-prepared workpapers demonstrate your professionalism, support credibility with stakeholders, and make your job easier in the long run.
Over time, you’ll refine your approach, discover shortcuts, and develop a personal style that meets both professional standards and your department’s expectations. In the meantime, use the tips, examples, and templates provided here as your roadmap to producing top-notch, hassle-free audit workpapers—even if you’re just starting out.
Leave a Reply