Audit Documentation and Quality Assurance
Why documentation matters
Documentation is the evidence that the audit was planned, performed, and reported properly. It must be sufficient to allow an experienced auditor with no connection to the engagement to understand what was done, why, and what was concluded. Candidates should know the standard contents: objectives, scope, risk assessment, procedures performed, evidence obtained, findings, conclusions, and review sign-off.
Quality assurance
Quality assurance has two layers: engagement-level review (supervision and review before the report is issued) and periodic internal quality review (a sample of completed engagements reviewed after the fact by someone independent of them). Know that review is not a re-performance of the audit; it checks whether the work supports the conclusion. External quality assessment provides independent assurance over the audit function itself.
Traps to watch
- Documenting conclusions without the supporting evidence or rationale.
- Back-dating or altering records after the report is issued without a documented reason.
- Treating a review as a formality rather than a challenge to the evidence.
- Assuming documentation done after the fact is equivalent to contemporaneous records.
Rule of thumb
The stranger test: could an experienced auditor who has never met the team pick up the file and reach the same conclusion? If not, the documentation is insufficient.
Worked example
A file shows a sample of 25 items tested and a conclusion of "no exceptions". It lacks the population, the selection method, and the criteria tested. Under the stranger test the file fails: the reviewer cannot tell whether the sample was representative or the test relevant.