Audit Support

This skill organizes evidence and testing; it does not issue an audit opinion.

PBC and evidence management

For each request record request ID, description, period, population, owner, due date, status, evidence file, source system, extraction parameters, reviewer, and auditor follow-up. Preserve original files and use versioned working copies.

Evidence must be relevant, reliable, complete, period-correct, and traceable to the request. Do not create missing evidence or alter timestamps. Redact or restrict personal and confidential data according to policy.

Walkthrough and control testing

Document process objective, initiation, systems, roles, key risks, control owner, frequency, evidence, exceptions, and handoffs. For each control distinguish:

• design: whether the control could prevent or detect the stated risk;
• implementation: whether it exists and is in use;
• operating effectiveness: whether it operated consistently during the test period.

Define the population and verify completeness before selecting samples. Record sampling method and rationale; do not claim statistical assurance for judgmental samples.

Workpaper format

Include objective, scope, risk, control, population, sample, procedure, evidence, result, exception, impact, management response, remediation owner/date, preparer, reviewer, and conclusion. Cross-reference every conclusion to evidence.

Escalate missing evidence, contradictory support, repeat exceptions, management override, access conflicts, suspected fraud, or scope limitations. Use neutral language and separate observed fact from interpretation.