--- name: audit_checklist description: Run risk-based internal audit fieldwork end to end: engagement scoping, process walkthroughs, control design and operating-effectiveness testing, attribute sampling with the AICPA tables, finding write-ups in the 5-Cs format with severity grading, management letters, and remediation tracking. Use when someone asks to audit a process or control, test internal controls, write audit findings, size an audit sample, or run a follow-up on open audit issues. --- # Audit Checklist ## Purpose Take an internal audit engagement from scoping to follow-up without missing a step: define what is being assessed and against what benchmark, walk the process, test whether controls are designed well and whether they actually work, grade what is broken, write it up, and track fixes to closure. The workflow follows the IIA Global Internal Audit Standards (2024) structure: risk-based planning (Standard 9.4), engagement objectives/scope/criteria (Domain V), recommendations with management action plans (Principle 14), and follow-up confirming implementation (Principle 15). ## Workflow 1. **Scope the engagement.** Write an engagement memo before touching fieldwork: engagement objectives, scope (period, processes, locations, systems), evaluation criteria (policy, regulation, COSO principle, or benchmark), risk basis for why this was selected, resource plan, and the approved work program. Risk basis is not optional. Under the IIA Standards the plan and each engagement are risk based; an engagement without stated objectives, scope, and criteria has no foundation. 2. **Walk the process.** For each in-scope process, trace one transaction end to end with the people who do the work: initiation, authorization, processing, recording, reporting. Document what actually happens, not what the flowchart says. Note where reality diverges from the documented process; every divergence is a candidate control gap. Inquiry alone never settles anything: confirm by observing the control being applied and inspecting the documents or reports it produces. 3. **Test design, then operating effectiveness.** These are two separate questions and the second depends on the first. - **Test of design:** if this control operated as designed, would it actually address the risk? A control can be performed perfectly and still miss the risk (for example, a monthly review when the risk needs a daily check). A design gap ends testing for that control: record a design deficiency and move on; do not test operation of a control whose design cannot work. - **Test of operating effectiveness:** does the control operate as designed across the whole period? This needs a sample, not a glance. See step 4. 4. **Size and evaluate the sample.** Attribute sampling for tests of controls: set tolerable deviation rate (TDR), risk of overreliance (usually 5% or 10%), and expected population deviation rate (start at 0 unless prior audits give a reason to expect otherwise). Look up the sample size with `bin/audit_sample.py size` (embeds the AICPA Audit Sampling Guide Table A-1 values at 5% risk; consult the full Guide for Table A-2 or off-table cases). Sample-size behavior per AAG-SAM: higher TDR means smaller sample, higher risk of overreliance means smaller sample, higher expected deviation means larger sample, population size barely matters. - Select items with `bin/audit_sample.py select` (seeded systematic selection so another auditor can reproduce the sample). - Evaluate with `bin/audit_sample.py evaluate`: the upper precision limit of the deviation rate. If it exceeds the tolerable rate, the planned control-risk assessment is not justified. Re-perform or independently inspect, do not just ask. 5. **Write findings in the 5-Cs format.** One write-up per finding: **Condition** (what is, with evidence), **Criteria** (what should be: the policy, standard, or principle), **Cause** (root cause: why the condition was not prevented or detected), **Consequence** (actual or probable impact, quantified where possible), **Corrective Action** (recommendation that fixes the cause, not just the symptom). If the cause is a guess, say so and keep digging. 6. **Grade every finding.** Use a consistent scale owned by your function: High/Critical goes to senior management and the audit committee (significant financial exposure, intentional misstatement, legal or reputational risk, a pattern of violations); Medium goes to the process owner (real weakness, containable at the process level); Low is administrative or best practice. Grade by residual risk, not by how hard the finding was to write. The thresholds are your organization's policy; publish them once and apply them every time. 7. **Issue the management letter (report).** Structure: background and scope/objectives, methodology, findings in descending severity order (each with rating, the 5 Cs, recommendation, management action plan with named owner and target date), an overall engagement opinion, and a distribution list. Circulate a draft, hold an exit discussion, then issue the final on the agreed communication plan. Report promptly; a finding that sits in draft does not get fixed. 8. **Track remediation to closure.** Log every recommendation: finding, rating, owner, target date, and status. Follow up per IIA Principle 15: confirm the action was actually implemented, do not accept "done" at face value. Re-test where the risk warrants it. Escalate overdue items by rating: High/Critical past due goes to the audit committee. Keep following up until each item is verified closed or formally risk-accepted in writing by someone with the authority to accept it. ## Output Contract - Engagement memo: objectives, scope, criteria, risk basis, resource plan, approved work program. No fieldwork starts without this on file. - Risk/control matrix: risk to control to assertion mapping, with design-effectiveness conclusion per control. - Walkthrough workpapers: end-to-end trace per process, divergences from documented process noted. - Test-of-effectiveness workpapers: sampling plan (TDR, risk, expected rate, size, selection method), per-item results (pass / exception / not able to test), evaluation conclusion with upper precision limit vs tolerable rate. - Findings: one 5-Cs write-up each, severity graded, cross-referenced to workpapers. - Management letter: full report per step 7, with management action plans carrying named owners and dates. - Remediation log: living tracker; every recommendation carried to verified closure or written risk acceptance. - Evidence standard throughout: sufficient, reliable, relevant, and useful (the IIA formulation). Every conclusion must be traceable to the evidence that supports it; supervisors review workpapers before conclusions are reported. ## Operating Rules 1. Scope first, test later. An engagement without documented objectives, scope, and criteria stops at step 1 until those exist. 2. Design before effectiveness. Never test the operating effectiveness of a control whose design you have not evaluated; a design gap is the finding. 3. Sample on evidence, not on vibes. Sample size comes from TDR, risk of overreliance, and expected deviation rate via the published tables, not from "this feels like enough." Document the inputs so the size is reproducible. 4. One transaction through the walkthrough is the minimum for design understanding, not the evidence for operating effectiveness. Do not confuse the two. 5. Write the cause, not the symptom, into every finding. A recommendation that does not address the cause is incomplete. 6. Every management action plan needs a named owner and a target date. "The team will look into it" is not an action plan. 7. Closure means verified implemented or formally risk-accepted in writing. A management assertion of completion is not verification. 8. Never invent numbers, dates, quotes, or events in a workpaper or report. Unverifiable detail gets cut or is explicitly labeled as opinion.