Workpapers are the record of an audit: what was planned, what was done, what was found and what it means, written so that someone who was not there can follow the work and, if necessary, do it again. They are the evidence behind every sentence in the report, the material a reviewer supervises, the thing an external quality assessor opens first, and what a regulator or an external auditor asks for when deciding whether to rely on the function. Beginners meet them as a chore; experienced auditors know them as the product the report merely summarizes. The Global Internal Audit Standards make the requirement explicit in Standard 14.6: engagement documentation must be sufficient to support the conclusions and must allow a reviewer to understand the work performed.
This guide is for the auditor writing their first workpapers and the reviewer who has to explain what is wrong with them. It covers what workpapers are and the test they must pass, the types a file contains, the anatomy of a test workpaper element by element, indexing and cross-referencing, tick marks, evidence standards and the hierarchy of evidence, documenting populations, samples, analytics and system reports, writing exceptions and conclusions, the review trail, retention, what changes with electronic files, the mistakes reviewers see most, a checklist and a complete worked example. The annotated workpaper example shows a finished one, the workpaper best practices guide covers standards and review for experienced staff, and the tick marks and review notes guides go deep on two elements.
In this guide
- What workpapers are, and the test they must pass
- The types of workpaper in an engagement file
- The anatomy of a test workpaper
- Indexing and cross-referencing
- The lead sheet: where conclusions are collected
- Tick marks
- Evidence: sufficient, reliable, relevant
- Documenting populations, samples and analytics
- Writing exceptions and conclusions
- The review and sign-off trail
- Narrative workpapers: walkthroughs, interviews and advisory work
- Retention, confidentiality and electronic files
- The mistakes reviewers see most
- A workpaper quality checklist
- A worked example: the reconciliation test across twelve depots
- Questions beginners ask about workpapers
- Related guides
What workpapers are, and the test they must pass
A workpaper is any document the auditor prepares or obtains that records planning, evidence, analysis or conclusions: a planning memo, a process narrative, a spreadsheet of sampled items with results, an analytics output, a copy of a contract with the relevant clause marked, a finding sheet, a review note. Together they form the engagement file. The test every workpaper must pass is the reperformance test: could a competent auditor who did not do the work, reading only the file, understand what was tested, how the items were selected, what was done to each, what was found and why the conclusion follows? If the answer depends on asking the preparer, the workpaper is incomplete. Three readers apply the test in practice: the reviewer before the report issues, the external quality assessor every five years, and, in regulated firms, the examiner who decides whether to rely on internal audit’s work. The standard is the same for all three, and it is the standard the beginner should write to from the first day.
Workpapers serve four purposes beyond proving the work. They are the basis of the report: every fact in the report traces to a referenced workpaper. They are the supervision medium: the reviewer cannot watch the fieldwork, so the file is how quality is controlled. They are the function’s memory: next year’s team reads this year’s file to plan. And they are the defense: when a finding is challenged, a process fails later or a regulator asks what audit knew, the file is what the function has. A workpaper written for all four is not longer than one written for none; it is clearer.
The types of workpaper in an engagement file
| Type | What it records | Typical form | Guide |
|---|---|---|---|
| Planning documents | Objectives, scope, criteria, risk assessment, work program, budget, team | Planning memo; risk-control matrix; work program | Planning memo; RCM template |
| Administrative | Announcement, request lists, correspondence, status reports, meeting minutes | Letters, emails saved to the file, minutes | Notification templates |
| Process documentation | How the process works and where the controls are | Walkthrough narrative; flowchart; control listing | Walkthrough template |
| Lead sheets and summaries | For each control or objective, the conclusion and the references to the detail | One page per control or per section | This guide |
| Test workpapers | Population, sample, procedures, results, exceptions, conclusion for one control or assertion | Spreadsheet or system form with supporting documents attached | This guide; example |
| Analytics workpapers | Data sources, queries or scripts, parameters, outputs, exception triage | Query text, result extracts, triage log | SQL for auditors |
| Evidence obtained | Documents from the auditee: reports, contracts, screenshots, confirmations | Copies with source, date and relevance marked | This guide |
| Finding sheets | Condition, criteria, cause, consequence, corrective action, rating rationale, references | One per finding | Five Cs |
| Review evidence | Reviewer’s notes, preparer’s responses, clearance, sign-offs | Review notes log; sign-off fields | Review notes |
| Reporting | Draft and issued report, management responses, distribution | Report versions with dates | Writing the report |
The anatomy of a test workpaper
The test workpaper is the one beginners write most and get wrong most. It documents the testing of one control (or one assertion) and has a fixed set of elements; a reviewer can usually tell within thirty seconds which are missing. The table lists them in the order they appear, with what each must contain and the question a reviewer asks of it.
| Element | Content | Reviewer’s question |
|---|---|---|
| Header | Entity, engagement, workpaper reference, title, preparer and date, reviewer and date | Can I find and cite this? |
| Objective | The control or assertion being tested and the risk it addresses, in one or two sentences, with the work-program step reference | Why does this test exist? |
| Criteria | The policy, procedure or standard the control should meet, cited | What should have happened? |
| Source of the population | Where the population came from (system, report, extract), who provided it, when, how its completeness was confirmed (reconciled to a control total) | Is the population complete and is the report reliable? |
| Population | Count and value; the period | What is the denominator? |
| Sampling method | Method (random, systematic, monetary unit, judgmental, full population by analytics), size and the reason for the size, selection parameters (seed, interval), reference to the sampling memo | Could I select the same sample? |
| Procedures | Exactly what was done to each item, numbered, with the attribute tested | What does each tick mark mean? |
| Results | Item-by-item results with tick marks; exceptions identified and described | What was found, item by item? |
| Exceptions | Each exception: what, the auditee’s explanation, the auditor’s assessment, whether it is a control deviation, reference to the finding sheet if one results | Were exceptions investigated, not just counted? |
| Conclusion | Whether the control is operating effectively, stated against the tolerable rate or the objective; the basis | Does the conclusion follow from the results? |
| Tick-mark legend | Every symbol used, defined | Can I decode this? |
| Attachments and references | Supporting documents indexed; cross-references to the lead sheet, the finding sheet, the work program | Where is the evidence? |
Indexing and cross-referencing
Indexing is what lets a reader move through the file without a guide. Every workpaper has a unique reference, built from a section code and a sequence, and every number or fact that comes from another workpaper carries that workpaper’s reference beside it. The convention varies by function; what matters is that it is written in the methodology and used without exception. A common scheme is below. Cross-references run both ways: the lead sheet references the test workpapers that support each conclusion, and each test workpaper references the lead sheet and the finding sheet it feeds. In an audit management system the references are hyperlinks and the system enforces them; in a spreadsheet-based file they are typed, and the discipline is the same.
| Section | Code | Contents | Example reference |
|---|---|---|---|
| Administration | A | Announcement, correspondence, status reports, minutes | A-3: closing meeting minutes |
| Planning | B | Planning memo, risk assessment, RCM, work program, budget | B-2: risk-control matrix |
| Process understanding | C | Walkthroughs, narratives, flowcharts, control listing | C-1: route cash walkthrough, Depot 4 |
| Testing, by control area | D, E, F… | Lead sheet (D-0) then test workpapers (D-1, D-2…) | D-3: daily reconciliation independence test |
| Analytics | X | Queries, outputs, triage | X-1: override self-approval analytic |
| Findings | F | Finding sheets | F-1: reconciliations not independent |
| Reporting | R | Drafts, responses, issued report | R-2: issued report |
| Review | Q | Review notes log, sign-offs, retrospective | Q-1: review notes |
The lead sheet: where conclusions are collected
Between the test workpapers and the report sits the lead sheet, one per control area or engagement objective, and it is the page a reviewer reads first. It lists each control tested, the workpaper reference, the conclusion in one sentence and the finding reference where there is one, so that the section’s result can be read in a minute and traced in an hour. Beginners often skip it because it repeats what the test workpapers say; reviewers insist on it because it is where the repetition is checked. The lead sheet is also where the engagement objective is answered: the conclusions on the individual controls roll up into a conclusion on the objective, and that sentence is what the report’s executive summary will carry.
| Control (from the RCM) | Test workpaper | Conclusion | Finding |
|---|---|---|---|
| C-1 Daily reconciliation performed by someone independent of cash receipt and reviewed by the depot manager | D-3 | Not operating effectively at 9 of 12 depots; design cause | F-1 (High) |
| C-2 System overrides approved by a person other than the one raising them | X-1 (full-population analytic) | Not operating effectively: 1,412 of 37,400 overrides self-approved | F-2 (High) |
| C-3 Handheld synchronization failures monitored and resolved daily | D-4 | Partially effective: failures logged but 31 percent unresolved after five days | F-3 (Medium) |
| C-4 Deposit listings generated by the system, not re-keyed | D-5 | Not operating as designed at 7 depots (re-keyed) | F-4 (Medium) |
| C-5 Customer statements issued monthly to all cash customers | D-6 | Not operating for 1,130 of 4,200 customers | F-5 (Medium) |
| Objective: collections complete, deposited intact and independently reconciled | D-0 | Not met; overall rating Unsatisfactory | Report R-2 |
Tick marks
Tick marks are the shorthand of audit documentation, and like any shorthand they are only useful when everyone reads them the same way.
A tick mark is a symbol placed against an item to record that a specific procedure was performed on it, and a legend defines every symbol used in the workpaper. Tick marks exist because writing “agreed the deposit slip to the bank statement” sixty times is impractical; the symbol carries the sentence. The rules are few. Define every mark in the legend on the same workpaper (a function-wide standard legend helps, but the workpaper still shows it). One mark means one procedure; an item with four procedures carries four marks. Mark exceptions differently from clean items, with a reference to where the exception is explained. Never use a mark that means “looks fine”; marks record procedures, not impressions. The tick marks guide gives a standard legend and the history; the example below shows one in use.
Evidence: sufficient, reliable, relevant
Standard 14.1 requires the information gathered to be sufficient, reliable and relevant, and each word is a test the workpaper must show was applied. Sufficient means enough: enough items to support the conclusion at the intended level of assurance (the attribute sampling guide gives the arithmetic). Reliable means the evidence can be trusted: it comes from a source independent of the control’s operator where possible, from a system whose reports are controlled, or from the auditor’s own observation. Relevant means it bears on the assertion being tested: a signed approval form is relevant to whether approval occurred and irrelevant to whether the approver examined anything. The hierarchy below ranks evidence by reliability; a workpaper that relies on the weakest forms for a high-risk control should say why nothing stronger was available. The audit evidence guide treats the subject fully.
| Rank | Form of evidence | Example | Weakness |
|---|---|---|---|
| 1 | Auditor’s own observation or reperformance | Recalculating a reconciliation; watching a cash count; re-running a query | Covers only the moment or items examined |
| 2 | External documents from independent parties | Bank statements; customer confirmations; vendor invoices received directly | Obtaining them takes time; parties may not respond |
| 3 | System-generated reports from controlled systems | An ERP approval log; an access list | Only as reliable as the system’s controls and the report’s parameters (test them) |
| 4 | Internal documents prepared by someone other than the control operator | A regional manager’s review memo | May be prepared after the fact |
| 5 | Internal documents prepared by the control operator | A reconciliation prepared by the person being tested | Shows the control was documented, not that it was effective |
| 6 | Inquiry (what people say) | “We always check that” | Never sufficient alone; corroborate |
Documenting populations, samples and analytics
The denominator is the most neglected element in beginner workpapers. A test of forty invoices means nothing unless the reader knows the forty came from a complete population of 61,400, how completeness was established (the extract total agreed to the general ledger), and how the forty were chosen (random with a stated seed, or systematic with a stated interval, or monetary unit with a stated interval and starting point). Document the request, the person who provided the data, the date, the file name and its record count and total, and the reconciliation. Where the population is a system report, the report is itself evidence whose reliability must be shown: who ran it, with what parameters, whether the report logic has been tested; the information produced by the entity guide explains why external auditors and SOX testers insist on this and why internal auditors should too. For analytics, the workpaper holds the query or script text, the data sources with extract dates, the parameters, the row counts in and out, the output, and the triage of every exception; the SQL for auditors guide shows the documentation pattern and the sampling memo template records the method decisions.
Writing exceptions and conclusions
An exception is an item where the control did not operate as designed, and the workpaper must do three things with it: describe it precisely (which item, what was expected, what was found), record the investigation (what the auditee said, what the auditor checked, whether it is a deviation, an error in the test, or an explained anomaly), and state the effect on the conclusion. Counting exceptions without investigating them is the error reviewers see most, and the test exceptions guide gives the decision rule for when to investigate, extend the sample or conclude. The conclusion then states, in a sentence, whether the control is operating effectively and the basis: “Two deviations in 45 items against a tolerable rate of 10 percent; the upper deviation limit at 95 percent confidence is 11.4 percent, which exceeds the tolerable rate; the control is not operating effectively. See F-1.” A conclusion is a judgment supported by the results, not a restatement of them, and it should be the sentence a reader can lift straight into the lead sheet.
The review and sign-off trail
Standard 12.3 requires engagement work to be supervised, and the workpaper is where supervision is evidenced: a preparer’s sign-off with date, a reviewer’s sign-off with date, review notes raised and their clearance. The reviewer reads for the reperformance test, for the evidence standards, for whether the conclusion follows, and for consistency with other workpapers in the file; the review notes guide shows how notes are written and cleared. Two practices separate good files from poor ones. Review happens during fieldwork, workpaper by workpaper, not in a pile at the end, so that a flaw in the first test is fixed before it is repeated in the ninth. And clearance is documented: the note, the response, the change made and the reviewer’s acceptance, so an assessor can see that supervision operated rather than that a box was ticked. In small functions where the chief audit executive is the only reviewer, the same trail applies; where the CAE prepared the work, an independent review is bought in or documented as a self-review with the limitation disclosed.
Narrative workpapers: walkthroughs, interviews and advisory work
Not every workpaper is a test. Walkthrough narratives record how a process operates, step by step, with the person performing each step, the system used, the control at each point and the document produced; they are written in the present tense from the auditor’s observation and the auditee’s description, and they identify which statements were observed and which were only described, because the difference matters when a control turns out not to exist. The walkthrough template gives the structure. Interview notes record who was interviewed, when, by whom, what was asked and what was said, and they are evidence of inquiry, the weakest form, which is why a good interview note ends with the corroboration planned. Advisory engagements produce workpapers too: the client’s request, the agreed scope, the analysis, the advice given and the safeguards recorded so the function’s later independence over the area can be assessed; the assurance vs advisory guide explains why that record matters. Investigation files follow a protocol agreed with counsel and are kept separately, with chain-of-custody records for evidence; the when internal audit finds fraud guide covers the moment an audit file becomes one.
Retention, confidentiality and electronic files
Workpapers contain some of the most sensitive information in the organization: access lists, payroll data, fraud allegations, unreleased financial figures. The methodology sets who may see the file (the audit team, the reviewer, the external auditor and regulators under the access protocol, and otherwise no one without the chief audit executive’s approval), how it is stored (the audit management system or a restricted repository, never personal drives) and how long it is kept. Retention periods vary with law and regulation; five to seven years is common for general engagements, longer where litigation or regulatory matters attach, and the policy should name the period and the destruction process. Electronic workpapers change the mechanics, not the standard: the system assigns references, enforces sign-off order, time-stamps changes and locks the file at issue, which an assessor will test; what it cannot do is write the objective, confirm the population or investigate the exception. The software hub compares the systems and the small teams guide covers the spreadsheet-and-repository alternative that many small functions still use well.
The mistakes reviewers see most
No objective, so the reader cannot tell what the test was for. No population source or completeness check, so the sample proves nothing about the whole. A sample described as “selected” with no method, size rationale or parameters. Procedures described in the abstract (“tested for approval”) rather than as the specific attribute checked (“approver’s signature present and approver on the authorized list at the transaction date”). Tick marks without a legend, or one mark used for several procedures. Exceptions counted but not investigated, or investigated by inquiry alone. Conclusions that restate results (“two exceptions noted”) instead of concluding on the control. Facts in the report that cannot be found in any workpaper. Screenshots with no date, no system name and no indication of what they show. Review sign-offs dated after the report issued. And the beginner’s signature error: a workpaper that is perfectly clear to its author and to nobody else, because it was written as notes rather than as a record.
A workpaper quality checklist
| Check | Pass looks like |
|---|---|
| Reperformance | A competent stranger could redo the test from the file alone |
| Objective and criteria | Stated, with the work-program step and the policy cited |
| Population | Source, provider, date, count, value, completeness reconciliation |
| Sample | Method, size, rationale, parameters; sampling memo referenced |
| Procedures | Numbered; each attribute specific; each with a tick mark |
| Results | Item by item; exceptions flagged and cross-referenced |
| Exceptions | Investigated; auditee explanation and auditor assessment recorded; effect on conclusion stated |
| Conclusion | States whether the control is effective and the basis; matches the lead sheet and the report |
| Evidence | Attached or referenced; source and date on every document; reliability considered |
| References | Unique index; cross-references both ways; every report fact traceable |
| Review | Preparer and reviewer sign-offs dated before issue; notes cleared and documented |
| Housekeeping | No personal data beyond need; stored in the controlled repository; version final |
A worked example: the reconciliation test across twelve depots
Workpaper D-3 from MidState Beverage’s FY27 route cash audit tested whether the daily route cash reconciliation at each of the twelve depots was performed by someone independent of cash receipt and reviewed by the depot manager, as the Cash Handling Policy (section 4.2) requires. The header named the engagement, the reference, the staff auditor as preparer (dated in week five) and the senior as reviewer (dated two days later). The objective cited work-program step 7 and the risk from the risk-control matrix (B-2, risk R-3: diversion of collections concealed by the person reconciling). The population was the 3,012 daily reconciliations for the twelve depots over the 251 business days in the period, obtained as an extract from the route-accounting module by the depot operations analyst on a stated date, reconciled to the module’s deposit register total of $31.2 million (difference nil). The sample was stratified: five reconciliations per depot, selected by random number with the seed recorded, 60 in total, sized by reference to the sampling memo (X-0) for a 10 percent tolerable rate at 90 percent confidence, with the stratification justified by the risk that single-administrator depots would behave differently.
| Procedure | Attribute tested | Tick mark | Evidence |
|---|---|---|---|
| 1 | Reconciliation exists for the date and depot and agrees to the deposit register | a | Module record; deposit register |
| 2 | Preparer named on the reconciliation is not the person recorded as receiving cash from drivers that day | b | Reconciliation form; driver check-in log |
| 3 | Depot manager’s review evidenced (signature or system approval) within one business day | c | Form or module approval record |
| 4 | Any variance over $50 explained and resolved within five business days | d | Variance log |
| Exception | Attribute not met; see exception note | X | Exception log on D-3.1 |
The results sheet listed the 60 items by depot and date with four columns of tick marks. Fourteen items carried an X against procedure 2: at nine depots, the preparer was the depot administrator who had also signed the driver check-in log. Each of the fourteen had an exception note recording the administrator’s explanation (the depot has one administrative position), the auditor’s check (the staffing roster confirmed it) and the assessment (a control deviation, not a test error, with a design cause). Three items carried an X against procedure 3 for review more than one day late, explained by manager absence and assessed as isolated. The conclusion read: fourteen deviations in 60 against a 10 percent tolerable rate; the control is not operating effectively at nine of twelve depots and the deviation has a design cause (single-administrator staffing not addressed by the policy); see finding F-1, rated High. The lead sheet D-0 carried the same sentence, the report’s first finding quoted the 14 of 60 and the nine depots, and the external quality assessor who sampled the file the following year wrote one review note on it: the sampling memo should have stated why 90 percent rather than 95 percent confidence was chosen. The report anatomy guide shows what the finding became and the monetary unit sampling guide documents the companion workpaper for the customer balance confirmations.
Questions beginners ask about workpapers
What are internal audit workpapers?
The documents an auditor prepares or obtains that record the planning, evidence, analysis and conclusions of an engagement, written so that a reviewer or assessor can understand and reperform the work. Standard 14.6 requires them to be sufficient to support the conclusions.
What should a test workpaper contain?
A header with reference, preparer and reviewer; the objective and criteria; the population with its source and completeness check; the sampling method and size with rationale; numbered procedures; item-by-item results with tick marks; investigated exceptions; a conclusion on the control; a tick-mark legend; and cross-references to evidence, the lead sheet and any finding.
What are tick marks?
Symbols placed against sampled items to record that a specific procedure was performed, each defined in a legend on the workpaper. One mark records one procedure; exceptions carry a distinct mark with a reference to the explanation.
How detailed should workpapers be?
Detailed enough that a competent auditor who was not there could reperform the test from the file alone, and no more. Detail that does not serve that test (copies of entire manuals, every email) adds bulk without evidence.
Who reviews workpapers?
Someone other than the preparer, usually the engagement lead or audit manager, during fieldwork rather than at the end, with review notes raised and cleared before the report issues. External quality assessors sample files every five years, and regulators or external auditors may review them when deciding whether to rely on the function.
How long are audit workpapers kept?
Per the function’s retention policy, commonly five to seven years and longer where regulation or litigation requires, in a controlled repository with access limited to the audit team and those entitled under the access protocol.
Related guides
- An annotated audit workpaper example — a finished workpaper, element by element.
- Workpaper best practices — standards and review for experienced staff.
- Tick marks — a standard legend and the rules.
- Review notes — how reviews are written and cleared.
- Audit evidence — sufficient, reliable, relevant in depth.
- Handling test exceptions — investigate, extend or conclude.
- Attribute sampling — sample sizes and evaluation.
- Audit sampling memo template — recording the method.
- Testing information produced by the entity — making system reports reliable evidence.
- SQL for auditors — documenting analytics.
- Walkthrough documentation template — the process workpaper.
- Audit planning memo template — the planning workpaper.
- The five Cs of audit findings — the finding sheet.
- Audit fieldwork: the complete guide — the stage the workpapers record.
- The internal audit process step by step — where documentation sits.
- Anatomy of an internal audit report — what the workpapers become.
Leave a Reply