Audit documentation

1 Introduction

Before the auditor can assess and test a client’s system of internal control, the accounting system must be documented and understood. These processes are usually carried out at the interim audit stage.

The accounting system documentation will be filed in the auditor’s permanent audit file for the client. Each year, before starting the audit process the documentation has to be reviewed and updated for any changes in the client’s system.

2 Control objectives, control activities and tests of control

2.1 Control objectives

The objective of controls is to prevent loss or damage to the client. For example, a company does not want:

• Purchase invoices to be paid twice
  

• Goods to be despatched to non-credit worthy customers
  

• Overtime to be paid if not worked
  

• Inventory or cash to be stolen
  

• Non-current asset to be bought without proper authorisation
  

2.2 Control activities

Control activities are the policies and procedures that help ensure that control objectives are met. For example, the above objectives could be met by:

2.3 Tests of control

Once control procedures have been identified then they can be tested to see if they are operating properly.

3 Methods of documenting the internal control system

3.1 Narrative

Short descriptive passages are written setting out the various stages in the accounting system. For example:

“When inventory falls below the reorder level, a pre-numbered purchase requisition is raised and signed by the stores supervisor. This is passed to the purchasing department where three suppliers are asked for prices. A three-part order is raised for the cheapest supplier and the order signed by the purchasing manager”.

Narrative is quick to produce but lacks rigour and uniformity. For example, in the above system no information has been given about where the purchase requisitions are stored or what happens to each of the three parts of the order.

Narrative notes tend to be used for smaller, simpler accounting systems.

3.2 Flowcharts

A flowchart is drawn showing documents, files, processes and controls. Standard symbols are used and the process is much more formal. For example, every document introduced to the flowchart should be accounted for eg by filing, sending to the next department, or sending outside the organisation. A special symbol is used to identify controls as these are important for the audit.

Flowcharts can be time-consuming to draw and amend, but they produce very structured and well-disciplined descriptions of the client’s system. Each symbol can be numbered and cross-referenced to the internal control procedures and test procedures that have to be carried out.

Flowcharts would normally be reserved for larger more complex accounting systems.

3.3 Questionnaires

An internal control evaluation questionnaire (ICEQ) asks about control objectives. For example:

In ICEQs if questions are answered ‘No’ then that is good news for the auditor.

An internal control questionnaire (ICQ) asks if specific controls are present. For example:

ICEQs require a greater degree of skill to complete as they leave it up to the auditor to decide if a control objective has been met in some way or other.

ICQs are simpler to answer, but can be inflexible as control objectives might be met by another control procedure.

3.4 Checklists

A checklist lists control features or objectives for the auditor to consider and record as present, absent or not applicable, with explanations and references to evidence. It promotes consistent coverage and highlights omissions, but it must be tailored: ticking boxes does not evaluate whether a different control achieves the objective or whether a control actually operates. Follow up weaknesses and support conclusions with walk-throughs and tests.

4 Walk-through tests

Whenever documentation of a system has been completed for the first time, a walk-through test is performed. This means that a particular transaction is followed through from start to finish to check that the documentation is accurate. So a sales system would be verified by tracing from sales order, despatch notes, invoice, receivables ledger, receipt of payment into the bank.

In subsequent years walk-through tests will be performed again to verify that the documentation still accurately describes the accounting system.

5 Audit files

5.1 Introduction

It is essential that auditors carefully document all parts of their audit, including:

• Planning
  

• Information about the client
  

• The accounting system/internal control system
  

• Tests of controls
  

• Substantive procedures.
  

Careful documentation is needed to:

• Provide evidence of planning and risk assessment
  

• Provide evidence of the audit work performed.
  

• To facilitate review of the work, by supervisors, then managers, then the partner.
  

• To ensure that the work is carried out completely and in an orderly manner.
  

It is normal to divide the documentation over two files, the permanent audit file and the current audit file.

5.2 Permanent audit file

As its name might suggest, the permanent audit file holds information which is relatively permanent and which can be carried forward from year to year.

Typical contents are:

• Nature of the business
  

• Addresses of offices, factories etc
  

• Names of directors and senior accounting personnel
  

• An organisation chart
  

• Documentation of the accounting system eg flowcharts
  

• Previous sets of financial statements
  

• A schedule setting out a history of important ratios (for analytical procedures)
  

• The letter of engagement
  

5.3 Current audit file

This file contains details of the audit work done for the current audit and will have two main parts:

• Work carried out to test the system of internal control
  

• Work carried out to verify the amounts in the financial statements – substantive procedures.
  

As they progress through their work the audit team creates ‘working papers’ (now usually on computer). Each working paper should show:

• The name of the client and the date of the financial statements being audited.
  

• The date of the test/procedure
  

• The aim of the test/procedure
  

• Cross referencing to ICQs or amounts in the financial statements
  

• The evidence obtained
  

• How exceptions, if any, were followed up
  

• The conclusions drawn
  

• The identity of the audit team member carrying out the test
  

• The identity of those who review the work and the dates of their reviews.
  

When the final audit is carried out, the draft financial statements will usually be placed at the beginning of the file, and each figure will be referenced to file sections where details of the audit work are set out.

For example

Therefore, as the working papers are created, the cross-referencing system allows reviewers to easily see the audit work carried out to test every relevant assertion.

5.4 Electronic audit documentation

Electronic working-paper systems use templates, import schedules and link each financial-statement figure to procedures, evidence and conclusions. Cross-references and electronic review sign-offs show who prepared and reviewed work and when; outstanding queries can be tracked. Restrict access, keep version histories, back up files and secure confidential data. A spreadsheet result must be checked and supported, not accepted because it was produced by a computer.

5.5 Delegation, supervision and review

The staff who go to a client to perform the audit consist of an auditor in charge (sometimes called an audit senior or supervisor) and usually one or more junior assistants.

The audit senior delegates work to the assistants and then reviews the work that they have done by examining the working papers. Sometimes it is decided to perform additional work if the initial results are unsatisfactory. The reviewer will sign off each page reviewed, together with the date of the review.

When work at the client is completed, back at the auditor’s office the audit manager in charge of the job will review the whole file again. More work or clarification might be requested at this stage also. The audit manager signs off each page of working paper.

Finally, when all outstanding points have been completed, the audit file is reviewed by the partner in charge. Usually it is the audit senior who takes the file to the partner because the partner will often want to ask questions that only someone directly involved in examining client’s records can answer. Sometimes, even at this late stage, the partner will request additional work to be performed.

The file has now been reviewed at least three times. If all is well with the file and the financial statements, the partner will be prepared to sign the auditor’s report.

5.6 Quality management and review

The engagement partner is responsible for managing and achieving quality on the audit. This includes ethics and independence, appropriate acceptance and continuance, competent resources, direction and supervision, review of significant judgments, consultation on difficult matters and resolution of disagreements before the report. Working papers identify the preparer, reviewer and review date.

Two different review processes must be distinguished:

• An engagement quality review is an objective evaluation of significant judgments and conclusions by an eligible reviewer outside the engagement team. It is required for specified engagements; where required, the report must not be dated until the review is complete. This is sometimes informally called a hot review.

• A review of a completed engagement, sometimes called a cold review, is part of the firm’s monitoring. It identifies deficiencies and remedial action for the quality management system and future work. It is not a substitute for supervision, working-paper review or a required pre-issuance engagement quality review.