The audit lifecycle, end to end
Plan, scope, test, conclude, report, follow up. The same sequence you already run, with the evidence trail enforced by the database rather than promised by the interface.
The plan is drawn from the universe
The audit universe is the population of auditable entities. The annual plan is drawn from it rather than assembled in a document that sits beside it.
A plan that cannot be traced back to a population is a plan that has to be defended from memory.
Scope is set against the risk and control matrix
An engagement carries its scope and its timing. The risks and the controls that address them live in the matrix, and scope is set against that.
The matrix is the spine. Everything the fieldwork produces hangs off a control that is already in it.
Fieldwork produces work papers, and work papers carry their own history
Evidence is gathered against the controls in scope, in work papers.
Work paper events are hash chained. Each event covers the one before it, so the sequence of what happened to a work paper is part of the file rather than a log somebody could quietly tidy.
The assertion and the test stay separate
What a control owner says about a control and what an auditor found are recorded separately, in the same place, and are never merged into one number.
Most tools collapse those two into a single rating. Once collapsed, the question of who said what is unanswerable, and that is usually the question the audit committee asks.
The report comes out of the file
What goes to the audit committee is drawn from the file the work was done in.
A report retyped out of a system is a second copy of the truth, and second copies drift.
A finding does not end when the report goes out
Findings are recorded against the control and the engagement they came from.
A correction appends rather than overwrites, so the history of a finding stays readable after the engagement closes.
Against what you are doing now
Spreadsheets, a shared drive, or a tool bought for a different market. No competitor is named here, favourably or otherwise.
- ProvenanceNow
A cell changes in a spreadsheet and nothing records who changed it or what it said before.
HereAssessments append. Work paper events are hash chained and the chain can be verified on screen.
- Assertion and testNow
The owner said and the auditor found are commonly collapsed into one rating.
HereFour cells. An assertion and a test never overwrite each other.
- Regulatory contentNow
Assumed, or maintained by hand in a document nobody owns.
HereA jurisdiction pack selected at onboarding, named on screen, and marked provisional pending counsel review.