The Missing Working Paper
During an internal quality review of a completed audit of a school district's procurement function, you find that a key working paper documenting the sample selection for 60 purchase orders is missing from the file. The engagement partner recalls that the sample was 'judgmental, based on risk,' but there is no documented rationale. The audit conclusion - that procurement controls were operating effectively - rests partly on this sample. The fieldwork was completed eight months ago, and the senior auditor who performed the work has since left the firm. The file otherwise contains signed review notes and a completed engagement quality review. The review is due to the regulator in two weeks.
1. Assess the significance of the missing documentation against the purpose of audit documentation standards.
Read the worked answer
Audit documentation must enable an experienced auditor with no prior connection to the engagement to understand the work performed, the evidence obtained, and the conclusions reached. The missing working paper fails this test on the most sensitive point: sample selection.
Why it matters here:
- The conclusion (controls effective) depends on whether the sample was representative. Without documented selection rationale, a reviewer cannot judge whether the sample was biased, whether it covered the risk areas, or whether 60 was adequate.
- 'Judgmental, based on risk' recalled from memory eight months later is not documentation - it is recollection, and the person who did the work has left.
- The existence of review notes and an EQR does not cure the gap; reviewers signed off on a file that was already incomplete, which is itself a quality-control finding.
Severity: high. This is not a clerical omission; it goes to the sufficiency of evidence supporting a stated conclusion.
2. What are your options for remediation before the regulator deadline, and which do you recommend?
Read the worked answer
Options, roughly in order of preference:
- Reconstruct with corroborating evidence - pull the underlying purchase order population, any electronic sampling tool logs, emails, or supervisor notes that show how the 60 were chosen. If reconstruction is possible and reliable, document it clearly as a post-hoc reconstruction, dated, with the source of each element. This is legitimate if honest about its nature.
- Re-perform the sample selection and testing - if the population is still available, re-draw and re-test. Expensive and time-bound, but produces genuine evidence.
- Disclose the gap to the regulator - if neither reconstruction nor re-performance is feasible in two weeks, disclose the documentation deficiency and its effect on the conclusion.
Recommendation: attempt option 1 immediately; if it cannot fully establish the selection rationale, downgrade the conclusion or disclose. Do not backdate reconstructed documents or present recollection as contemporaneous documentation - that is falsification. The regulator deadline is a reason to act fast, not a reason to paper over the gap.
3. What systemic quality-assurance lessons should be drawn, and how should they be implemented?
Read the worked answer
The gap is a symptom of a quality-control system failure, not just one missing file.
Lessons:
- Review timing: EQR and review notes were completed on an incomplete file. Reviewers must check for required documentation before sign-off, using a documentation checklist keyed to the engagement's risk areas.
- Contemporaneous documentation: the firm allowed a critical selection rationale to go unrecorded. Require sampling rationale to be documented at the time of selection, not reconstructed later.
- Knowledge retention: the departing senior took undocumented knowledge with them. Exit procedures should require file completeness sign-off before departure.
Implementation:
- Add a mandatory documentation-completeness gate to the EQR checklist.
- Institute a file-completion sign-off at engagement close and at staff departure.
- Run a retrospective file review across recent engagements to see whether the gap is isolated or systemic.
- Feed findings into the firm's monitoring and remediation cycle, with owners and dates.