Blogs Richard F. Chambers, CIA, CRMA, CFE, CGAP Sep 06, 2020
I believed that well-organized, comprehensive workpapers were critical to demonstrating the quality of my efforts, and were the basis for the audit report I would write at the conclusion of the audit.
I understood that the workpapers needed to include documentation of evidence I examined, and that the evidence needed to be relevant, reliable, sufficient, and useful. I adapted to the culture of the profession of the time. And I came to believe that internal audit workpapers were good, and more workpapers were better.
When I rose to the level of chief audit executive (CAE), my perspective on workpapers changed dramatically. As a new CAE, I was determined to achieve greater efficiency in the department, enhance our capacity to audit more risks, and add value for the organization. I undertook a complete review of our internal audit processes, and identified countless opportunities for improvement. One area in which we were woefully inefficient was in the conduct of our audits — particularly documentation of our audit results in the workpapers.
As I reviewed more and more of our audits, I came to refer to much of what was included as "happy workpapers." You see, the workpapers were packed with evidence that everything was fine; documents that merely confirmed that controls were adequately designed and implemented. When everything an internal auditor encounters during the course of an audit is simply captured and included in the workpapers, they soon can be measured in linear feet.
I used to joke that my staff included everything in the workpapers but the phone book. Then, I literally found the organization's phone book in the middle of a set of workpapers. The internal auditor's defense: The phone book corroborated evidence of the number of staff members assigned to the organization.
Happy workpapers made me anything but happy. That's because workpapers are the means by which the audit results are documented – not the end. Every workpaper needs to be sourced (to include information such as purpose, source, scope, and conclusion). All of that takes precious staff time, thus slowing the audit. Once the draft audit report is prepared, the workpapers must be reviewed as part of the engagement quality assurance process. All of these steps usurp internal audit's capacity and diminish the amount of time available to undertake new engagements.
So, what distinguishes "happy workpapers" from those that are essential to documenting the results of the audit? For me, the answer has always turned on the criteria of sufficiency and usefulness. Happy workpapers are typically relevant and reliable, but they go beyond what is needed to be sufficient and useful. I didn't need to see the phone book as yet another form of evidence that the organization's staff is documented. Other evidence was sufficient and, frankly, the phone book just wasn't useful.
The IIA's International Standards for the Professional Practice of Internal Auditing are appropriately broad when prescribing documentation requirements. The two most relevant passages:
The IIA offers some additional insight when considering sufficiency: "Sufficient information is factual, adequate, and convincing so that a prudent informed person would reach the same conclusion as the auditor."
Much of what constitutes the volume of workpapers are files or documents that affirm conformance with criteria such as policies or controls. I have long argued that such files or documents do not have to be included in their entirety in the workpapers — particularly if they affirm conformance with criteria. I am particularly partial to guidance provided in U.S. Government Auditing Standards (the Yellow Book), which offers the following guidance to government auditors on what should be included when documenting evidence in workpapers:
8.135.b. "the work performed and evidence obtained to support significant judgments and conclusions, as well as expectations in analytical procedures, including descriptions of transactions and records examined (for example, by listing file numbers, case numbers, or other means of identifying specific documents examined, though copies of documents examined or detailed listings of information from those documents are not required)" (emphasis added).
Every internal audit department should have a system of quality controls that ensure the quality of audit results. Such policies often provide extensive department policy on preparing workpapers. For those departments that struggle with the timeliness of audit results exacerbated by inefficiencies such as an abundance of happy workpapers, I urge a review of these policies with an agile mindset.
I'd like to hear from any readers who struggle with too many "happy workpapers."