Audit tick marks are short symbols written next to figures or items in a workpaper to show which procedure the auditor performed on them: footed, agreed to the general ledger, recalculated, traced to a source document, confirmed with a third party. They let a reviewer see at a glance what was done to every number without reading paragraphs of description. The rule that makes them useful is simple and widely broken: a tick mark records a procedure performed, never a conclusion, and every mark must be defined in a legend on the page or in the engagement file. A tick mark without a legend, or one that means “looks fine”, is decoration.
This guide gives a standard set of eighteen tick marks with what must exist before each one is used, explains the difference between vouching and tracing and between footing and cross-footing, shows two annotated schedules with the marks in use, sets out the consistency rules a department needs, covers tick marks in spreadsheets and electronic workpaper tools, lists the common misuses that reviewers write notes about, and ends with a legend template you can adopt. It extends the tick mark section of the site’s workpaper standards guide, whose core legend it keeps, and pairs with the annotated workpaper example, which shows a small set in use on a single test.
In this guide
- What tick marks are for
- The rule that matters: procedure, not result
- The standard legend: eighteen marks
- Vouching and tracing: the direction matters
- Footing, cross-footing and recalculation
- Two annotated schedules
- Which marks for which procedures
- Consistency rules for a department
- Tick marks in spreadsheets and electronic workpapers
- Common misuses reviewers write notes about
- The legend template
- Worked example: one legend for a 22-person function
- Questions about audit tick marks
- Related guides
What tick marks are for
A workpaper has to let someone who was not there understand what was done and reach the same conclusion. The Global Internal Audit Standards put this in Standard 14.6, which requires engagement documentation good enough that an informed, prudent internal auditor could repeat the work and derive the same results, and which lists among the basic contents of a workpaper the scope of work performed, the sources of data, and the population and sampling approach. Tick marks are how that requirement is met at the level of an individual number. A column of forty amounts with a mark beside each, and a legend saying what the mark means, tells a reviewer that each amount was agreed to its invoice without forty sentences saying so.
Tick marks do three jobs:
- Record the procedure. Which test was performed on this item: agreed, recalculated, footed, observed.
- Point to the evidence. Where the reviewer can find what the item was agreed to, through the column header or a cross-reference.
- Flag the exception. Which items did not pass, through a separate mark that leads to the exception log.
The PCAOB’s standard on audit documentation, which many internal audit functions use as a benchmark, sets the same expectation in its own terms: documentation should let an experienced auditor with no previous connection to the engagement understand the nature, timing, extent and results of the work, and who performed and reviewed it. Tick marks are the most compressed form of that record, which is why they fail so badly when they are compressed into meaninglessness.
The rule that matters: procedure, not result
The single most common tick mark problem is a mark that records a result instead of a procedure. A checkmark that means “OK”, “fine” or “no issues” tells a reviewer nothing about what was done. Was the amount agreed to an invoice, to a contract, to a report, or simply looked at? Was the approval checked for the right approver, the right date, or just for a signature? A result-mark lets a preparer mark items they never actually tested, and a reviewer cannot tell the difference.
The discipline that fixes this has three parts, and it is the same one the site’s workpaper standards guide sets for the function:
- Every mark names a procedure. “Agreed to the invoice named in the column header”, not “checked”.
- Every mark is defined. Either in a legend on the same page or in the engagement-level legend, which is a copy of the function’s standard legend with any additions listed at the top.
- An exception is never a bare mark. It is a numbered reference, such as E-3, that leads to an entry in the exception log with the description, cause and disposition.
A useful test for any tick mark: could a reviewer, reading only the legend and the column header, re-perform exactly what the mark claims was done on that item? If not, the mark is too vague.
The standard legend: eighteen marks
The legend below keeps the function standard set out in the workpaper standards guide and adds four marks that substantive and analytics work needs: V and T for the two directions of testing, TB for the trial balance, and AN for items flagged by an analytic. Every mark has a precondition, the evidence that must exist before it can be used.
| Mark | Meaning | What must exist before you use it | Typical use |
|---|---|---|---|
| ✓ | Agreed to the source document named in the column header | The document, attached or locatable by the reference given | Invoice amounts agreed to invoices |
| F | Footed: the column total was recomputed by the auditor | The recomputation and the total it agreed to | Totals on a lead schedule |
| CF | Cross-footed: row totals recomputed across the columns | The recomputation | Row totals of a multi-column schedule |
| R | Recalculated from the inputs shown | The inputs and the method | Depreciation, interest, variances, commissions |
| GL | Agreed to the general ledger at the date stated | A ledger extract or screenshot with date and account | Balances on a lead schedule |
| TB | Agreed to the trial balance at the date stated | The trial balance, dated | Opening a lead schedule |
| SR | Agreed to the system record at the referenced screenshot | A screenshot showing the system, date, time and user | Approval dates, user IDs, configuration values |
| IPE | Completeness and accuracy of this report tested at the referenced workpaper | The IPE workpaper with its reconciliation | Any system report used as a population or source |
| V | Vouched: traced from the recorded item back to its supporting document | The document | Existence and occurrence tests |
| T | Traced: followed from the source document forward to the record | The source document and the record it was found in | Completeness tests |
| C | Confirmed directly with an independent third party | The confirmation, sent and received under the auditor’s control | Bank balances, receivables, third-party holdings |
| O | Observed by the auditor on the date stated | Date, location, what was observed, by whom | Inventory counts, physical security, a control performed live |
| I | Corroborated inquiry: statement from the named person, corroborated by the referenced evidence | Name, title, date and the corroborating reference | Explanations of variances or exceptions |
| PY | Agreed to the prior engagement’s workpaper at the reference given | The prior workpaper, reviewed and still in the archive | Prior-year comparatives |
| AN | Selected or flagged by the analytic referenced | The analytic’s rule and output | Items chosen from a full-population analysis |
| Ø | Attribute tested, no exception | The per-item procedure actually performed | Cells of a control test grid |
| N/A | Attribute not applicable to this item; reason stated | The reason in the notes column | Attributes that do not apply to some items |
| E-n | Exception number n; see the exception log | A log entry with description, cause, quantification and disposition | Every exception, without exception |
The check mark heads the list because it is the most used and most abused. On its own it means nothing; with a column header that says “Agreed to invoice (document ref in column D)”, it means one specific procedure. That is why the legend defines it by reference to the header.
Vouching and tracing: the direction matters
Two marks in the legend, V and T, record the same physical act, comparing a record with a document, in opposite directions. The direction decides which assertion the test supports, and confusing them is one of the most common conceptual errors in audit work.
| Vouching (V) | Tracing (T) | |
|---|---|---|
| Direction | From the record back to the source document | From the source document forward to the record |
| Starting population | Items in the ledger, register or report | Source documents: shipping records, receiving reports, time sheets |
| What it tests | That recorded items really happened: existence and occurrence | That real events were recorded: completeness |
| What it cannot find | Items that happened but were never recorded | Items recorded that never happened |
| Example | Select 25 recorded sales and agree each to a delivery note | Select 25 delivery notes and find each in the sales ledger |
The practical consequence is in what you select from. A test of unrecorded liabilities that samples from the accounts payable ledger cannot find an unrecorded liability, however carefully it is performed, because the liability is not in the ledger. It has to start from the documents, such as receiving records or invoices received after the period end, and trace forward. The legend’s separate marks for the two directions make it obvious to a reviewer which way the test ran. The site’s guide to substantive testing covers the assertions behind them.
Footing, cross-footing and recalculation
Three of the marks are about arithmetic, and they matter more than their humble appearance suggests. Spreadsheets make arithmetic errors rarer and harder to see: a sum range that stops one row short, a pasted value where a formula should be, a hidden row. An auditor who marks a total F without recomputing it has certified a number they never checked.
- Footing (F) is recomputing a column total. In a spreadsheet, recompute it independently, for example with your own SUM in a separate cell or by checking the selected-range total in the status bar, not by looking at the formula already there.
- Cross-footing (CF) is recomputing row totals across columns, and then checking that the sum of the row totals equals the grand total. It catches errors that footing alone misses, such as a column included in the grand total but not in the rows.
- Recalculation (R) is recomputing an amount from its inputs: depreciation from cost, life and method; interest from principal, rate and days; a variance from two balances. The inputs and the method must be visible on the page, or the mark cannot be checked.
The simplest discipline is to foot and cross-foot every schedule before using any number from it, and to mark the grand total with both F and CF when both checks have been done.
Two annotated schedules
The first schedule is a lead schedule for accrued liabilities at a manufacturer’s June half-year. Each column has one kind of mark, and the legend at the bottom says what each means. The totals foot and cross-foot.
| Account | 30 June this year | Mark | 30 June last year | Mark | Change | Mark |
|---|---|---|---|---|---|---|
| Accrued freight | 412,300 | GL | 398,100 | PY | 14,200 | R |
| Accrued utilities | 188,950 | GL | 175,400 | PY | 13,550 | R |
| Goods received not invoiced | 1,284,600 | GL, IPE (C-12) | 1,190,250 | PY | 94,350 | R, E-1 |
| Accrued bonus | 640,000 | GL | 520,000 | PY | 120,000 | R, I (C-15) |
| Accrued audit fees | 96,000 | GL | 92,000 | PY | 4,000 | R |
| Total | 2,621,850 | F, TB | 2,375,750 | F, PY | 246,100 | F, CF |
Reading the marks: every current balance was agreed to the general ledger at 30 June; the goods-received-not-invoiced balance came from a system report whose completeness and accuracy were tested at workpaper C-12; prior-year figures were agreed to last year’s workpaper; every change was recalculated; the columns were footed and the change column cross-footed against the two totals; the current total was agreed to the trial balance. Two items carry more than a mark. The bonus change is explained by an inquiry corroborated at C-15. The goods-received change carries E-1, because the investigation of the increase found 38 receipts more than ninety days old with no invoice, which went to the exception log.
The second schedule is a control test grid: a sample of manual journal entries tested for approval. Each column is an attribute, and each cell carries a procedure mark or an exception reference.
| Sample item | Journal ID | Amount | A. Approver differs from preparer (SR) | B. Approved before posting (SR) | C. Support attached (✓) | D. Approver within limit (✓, authority matrix) |
|---|---|---|---|---|---|---|
| 1 | J-10442 | 48,200 | Ø | Ø | Ø | Ø |
| 2 | J-10518 | 312,900 | Ø | Ø | Ø | Ø |
| 3 | J-10776 | 9,450 | Ø | Ø | N/A (system-generated support) | Ø |
| 4 | J-10801 | 126,000 | E-2 | Ø | Ø | Ø |
| 5 | J-11023 | 74,310 | Ø | E-3 | Ø | Ø |
| 6 | J-11390 | 1,150,000 | Ø | Ø | Ø | Ø |
Here the column headers carry the procedure and the evidence type, so each cell needs only Ø or an exception reference. Item 3’s N/A gives its reason. Items 4 and 5 lead to exceptions E-2 (preparer and approver were the same user) and E-3 (approval recorded after posting), whose log entries hold the detail. A reviewer can see the whole test’s result, and exactly what was done to each cell, without reading a paragraph. The site’s guide to journal entry testing covers the test itself, and the guide to handling test exceptions covers what happens to E-2 and E-3.
Which marks for which procedures
Most audit tests use the same few combinations of marks. The table below shows the usual set for common procedures, with the column header that makes each mark specific. Borrowing these combinations is the fastest way to make a function’s workpapers consistent.
| Procedure | Marks | Column header that makes them specific |
|---|---|---|
| Bank reconciliation review | TB or GL for the book balance; C or ✓ for the bank balance; V for reconciling items; F on the reconciliation | “Bank balance agreed to bank statement dated 30 June (✓)”; “Outstanding items vouched to next month’s statement (V)” |
| Fixed asset additions | V to invoice; R for depreciation; SR for the asset record | “Addition vouched to supplier invoice and capital approval (V)” |
| Payroll changes | SR for the change in the payroll system; ✓ to the signed authorization; Ø or E-n per attribute | “Rate change agreed to HR authorization form (✓)” |
| Expense claims | ✓ to receipts; R for totals and mileage; Ø or E-n for policy attributes | “Receipt agreed for each line above the receipt threshold (✓)” |
| Inventory count | O for the count; T from count sheets to the final listing; V from the listing to the floor | “Counted by auditor on 30 June (O)”; “Traced from count sheet to final inventory listing (T)” |
| User access review | IPE for the user listing; SR for access in the system; ✓ to the approval ticket | “User list completeness tested at C-8 (IPE)” |
| Revenue cut-off | T from shipping records to invoices; V from invoices to shipping records | “Shipments in the last five days traced to invoices and period (T)” |
| Variance analysis | GL for balances; R for the variance; I for the explanation, with its corroboration | “Explanation obtained from the controller, corroborated to contract at C-21 (I)” |
| Analytics-driven test | AN for the flagged items; SR or ✓ for each item’s follow-up | “Flagged by duplicate-payment analytic at D-4 (AN)” |
The last column is the part auditors skip. A mark that is specific in the header needs nothing more in the cell; a mark with a vague header, such as “Checked”, needs a sentence in every cell, which nobody writes.
Consistency rules for a department
Tick marks work only if they mean the same thing on every page, in every engagement, for every auditor. That needs a small number of department rules, written down once.
| Rule | Why |
|---|---|
| One standard legend for the function, issued as part of the methodology | Reviewers and quality assessors read one dictionary, not one per auditor |
| The engagement legend is a copy of the standard, with additions listed at the top | New marks are visible and deliberate |
| No mark changes meaning between workpapers | The most confusing error in any file is ✓ meaning two different things |
| Column headers state the procedure and the evidence | The mark stays simple; the header carries the detail |
| Exceptions are always numbered references to the log | Exceptions cannot hide in cell comments |
| Marks are applied as the work is done, not afterwards | Marks added in bulk after testing record intentions, not procedures |
| The reviewer checks a sample of marks against the evidence | A mark that fails the check is a review note about the whole page |
| Electronic tools are loaded with the standard set only | Preparers cannot invent marks page by page |
The sixth rule deserves emphasis. A column of Ø entered in one keystroke, before the items were tested, is one of the most serious documentation failures an auditor can commit, because it records work that has not happened. Reviewers catch it by picking three marked cells at random and asking to see the evidence.
Tick marks in spreadsheets and electronic workpapers
Most tick marks today live in spreadsheets or audit software rather than on paper, and the medium introduces its own problems.
| Issue | What goes wrong | The fix |
|---|---|---|
| Symbol fonts | A check mark typed in a symbol font turns into a letter when the file is opened on another machine or exported to PDF | Use standard Unicode characters (✓, Ø, Σ) or plain letters (F, CF, GL), which display the same everywhere |
| Color as a tick mark | Green cells for “passed”, red for “failed”: invisible when printed in grey, and meaningless without a legend | Use color only as a highlight in addition to a defined mark |
| Marks in comments | Exceptions described in cell comments that nobody sees when the file is printed or exported | Put exceptions in the log, referenced by number in the cell |
| Marks on a copy of the data | Tick marks applied to a pasted copy that no longer matches the source report | Keep the source extract unchanged and mark a working copy that references it |
| Formula-driven marks | An IF formula that writes “✓” when two numbers match, then counted as testing | A formula comparison is a valid procedure, but the mark should say so: “R: agreed by formula to column H” |
| Marks in audit software | Tools with their own symbol sets, customized by each team | Load the function’s standard set and lock it |
| PDFs and scanned evidence | Marks drawn on a PDF that nobody can link back to the schedule | Use the same mark on the document and in the schedule, with the schedule reference on the document |
The formula-driven mark is the one that divides reviewers. A formula that compares two columns across 30,000 rows is a legitimate and powerful procedure, arguably better than eyeballing 25 items. What is not legitimate is presenting the formula’s output as if a human had agreed each item to a document. Name the procedure accurately and the question disappears. The site’s journal entry analytics catalog shows analytics documented test by test, with the rule, the population and the output for each.
Common misuses reviewers write notes about
| Misuse | What it looks like | The review note it earns |
|---|---|---|
| The undefined mark | A symbol on the page with no legend anywhere | “Define all tick marks used on this page” |
| The result mark | ✓ used to mean “fine” | “What procedure does ✓ represent here?” |
| The orphan exception | A red cell with no reference | “Log this exception and reference it” |
| The pre-filled column | Ø in every cell of an attribute that could not have been tested yet | “Show me the evidence for items 7, 12 and 19” |
| The misdirected mark | V used on a completeness test | “This test starts from the ledger, so it cannot address completeness” |
| The borrowed mark | PY placed against a prior-year paper that was never reviewed | “Was the prior paper reviewed? If not, re-perform” |
| The IPE badge | IPE placed on every report to signal it came from a system | “Where is the completeness and accuracy test?” |
| The unfooted total | F on a total nobody recomputed | “Recompute and show the check” |
Every one of these is a variation on the same failure: a mark that claims a procedure without the procedure behind it. The site’s guide to review notes covers how reviewers should write these notes so they get fixed rather than argued with.
The legend template
The template below is a starting point for a function’s standard legend. It goes on the engagement file’s index page, and every workpaper either uses only these marks or lists additions at the top.
Tick mark legend: [function name] standard, version [n], effective [date]
Procedure marks. ✓ agreed to the source document named in the column header. F footed. CF cross-footed. R recalculated from the inputs shown. GL agreed to the general ledger at the date stated. TB agreed to the trial balance. SR agreed to the system record at the referenced screenshot. IPE report’s completeness and accuracy tested at the referenced workpaper.
Direction marks. V vouched from the record to the supporting document. T traced from the source document to the record.
Evidence marks. C confirmed directly with a third party. O observed by the auditor on the date stated. I inquiry of the named person, corroborated at the reference given. PY agreed to the prior workpaper referenced. AN selected or flagged by the referenced analytic.
Result marks. Ø attribute tested, no exception. N/A not applicable, reason stated. E-n exception n, see the exception log.
Engagement additions. [Any additional marks, with meanings, listed here and nowhere else.]
Rules. Marks record procedures, not conclusions. Column headers state the procedure and evidence. Exceptions are always logged and referenced. Marks are applied as work is performed.
Worked example: one legend for a 22-person function
Lakeshore Bancorp, the 9-billion-dollar regional bank used across this site, has a 22-person internal audit function whose testing the external auditor relies on for part of its SOX work. An internal quality review of 60 workpapers from the previous year, done as part of the function’s quality program, found that auditors were using 23 different symbols across the files, and that the check mark alone carried four different meanings: agreed to a document, agreed to a system screen, attribute met, and reviewed. Nine workpapers had no legend at all. The external auditor’s reviewers had raised the same point twice, politely.
| Step | What the function did | Time |
|---|---|---|
| 1. Inventory | Listed every symbol found in the 60 workpapers with its apparent meanings | Two days for one senior auditor |
| 2. Standard | Adopted the site’s eighteen-mark legend, with one addition for regulatory examination evidence | One team meeting |
| 3. Tooling | Loaded the legend into the workpaper tool as the only available set, and added the template to the engagement index | One week |
| 4. Headers | Rewrote the column headers in the ten most-used test templates so that each named its procedure and evidence | Two weeks |
| 5. Training | A one-hour session using two real schedules, one marked well and one badly, with the team marking a third | One hour |
| 6. Review | Reviewers checked three marked cells per workpaper against the evidence for the next two quarters | Built into existing review |
The results after two quarters were modest and real. Review notes about undefined or unclear marks, which had been among the three most common kinds of note, fell to a handful. The external auditor’s reliance testing raised no documentation points on the quarterly SOX workpapers. And the time reviewers spent on each test workpaper fell, because they no longer had to ask what a mark meant. The one addition to the legend, a mark for evidence already provided to a bank examiner, was used in only two engagements, which suggested that the standard set was nearly complete on its own.
Questions about audit tick marks
Are tick marks required by the Standards?
No standard requires tick marks as such. The Global Internal Audit Standards require documentation that would let an informed auditor repeat the work and reach the same results, and tick marks are the most efficient way to meet that requirement for detailed testing. A function could document the same work in words; it would simply take much longer to write and to review.
What is the difference between a tick mark and a cross-reference?
A tick mark records what was done to an item. A cross-reference records where related evidence or work can be found, such as another workpaper number. Most good workpapers use both: a mark to say the item was agreed, and a reference to say where the document it was agreed to is filed.
Should internal audit use the same tick marks as the external auditor?
It helps when the external auditor relies on internal audit’s work, because their reviewers will read the file faster. Otherwise, consistency within your own function matters more than matching anyone else’s set.
Can a tick mark legend be too long?
Yes. A legend of thirty exotic symbols is as hard to use as none at all. Eighteen marks cover almost all internal audit work, and most workpapers use four or five of them.
How do tick marks work with full-population analytics?
The analytic replaces the per-item mark: a single statement records the rule applied to the whole population, and only the flagged items carry individual marks and exception references. The AN mark identifies items that came from an analytic rather than a sample.
What do “footed” and “cross-footed” mean on a workpaper?
Footed means the auditor re-added a column and agreed the result to the total shown. Cross-footed means the auditor re-added across the rows, then checked that the row totals add up to the same grand total as the columns. Together they prove that a schedule’s arithmetic holds in both directions, which matters because many spreadsheet errors show up in only one of them.
Should tick marks be in red?
The tradition of red tick marks comes from paper workpapers, where a red pencil made the auditor’s marks stand out from the client’s figures. In electronic workpapers color is still useful as a highlight, but it should never carry the meaning on its own, because it disappears when a file is printed in grey or read by someone who cannot distinguish the colors. The mark itself should say what was done.
Can I invent a tick mark for one engagement?
Yes, if the standard set genuinely does not cover the procedure. Add it to the top of the engagement legend with its meaning and precondition, use it consistently, and suggest it for the function’s standard if it keeps coming up.
Related guides
- Workpaper best practices — the function standard this legend extends.
- The annotated audit workpaper example — a small set of marks in use on one test.
- Audit evidence — what the marks are recording.
- Review notes done right — how reviewers challenge a mark that does not hold up.
- Handling test exceptions — what happens after E-n.
- IPE testing — the work behind the IPE mark.
- Substantive testing — the assertions behind vouching and tracing.
- Journal entry testing — the test behind the second schedule.
- The audit work program — where the procedures behind the marks are designed.
- The walkthrough documentation template — documentation at the process level.
- Audit workpapers for beginners — the wider workpaper file.
- Your first 90 days as a staff internal auditor — where tick marks are first learned.
- The sampling memo template — recording the selection the marks are applied to.
- Random sampling in Excel and Sheets — building the schedules the marks go on.
Leave a Reply