Building a Better Auditor: The Documentation Goldilocks Zone

Establishing the right balance of documentation is an important skill auditors develop over time. Documentation is needed throughout the audit lifecycle, from planning through the follow-up phase. If we do too much, it can take us away from where we should be spending our time (giving advice, foresight, and insight), but it is also how to get to the conclusion. It can be tough to figure out how much is too much and when we haven’t done enough.

I like to take it back to the Global Internal Audit Standards: relevant, reliable, and sufficient (see Standard 14.1 Gathering Information for Analyses and Evaluation). You can almost make yourself a checklist. In fact, I did and considered putting it on a memo pad mostly just to be funny, but also as a mental checklist to help the staff.

Relevance. If you tend to be an over-documenter — writing out the desk manual or going down a rabbit hole — I would point you to the practice of relevance. Does the documentation meet the engagement objectives, is the subject within the scope of the engagement, and does it contribute to the development of engagement results? Another question you may ask is, does the documentation focus on the risk or control I am reviewing, or am I describing a process? If it is a process, you may be doing too much.

Reliable. Whether you are new or experienced, it is always good to remember to focus on reliability. You likely have a methodology within your department that describes how evidence should be collected. But generally, it should be obtained directly by the internal auditor or from an independent source and gathered from a system with effective governance, risk management, and internal controls. Lastly, consider whether the evidence is factual and current. This is the easiest of the three principles to understand and master.

Sufficient. And the big one, is it sufficient? This one is a little harder because everyone has a different threshold for feeling satisfied. The advice here is to review enough to perform analyses and complete an evaluation. That is easy enough, especially with the ease with which we can get data. Most of the time we can see the entire population, but if you must select a sample, how many do you need to review? Hopefully, your department has a methodology to help you here, too. But the trouble can be in documenting what, how, why, and so what. Here is one last idea to consider to help us answer those questions, or for those of us who sometimes think everyone has our same experience: Can a prudent, informed, and competent person reach the same conclusion? Basically, can someone follow my logic and get to the same conclusion?

I have seen a lot of people come through the ranks of auditing in the last 20 years, and I can tell you that some people can figure out pretty quickly how and what to document, while others will struggle with it throughout their time as an auditor. Focusing on relevant, reliable, and sufficient will help to hone your skills, but now there are also innovative technologies that can help us too. If your company allows the use of artificial intelligence (AI) in your workplace, you may be able to use it to help you learn to document at the right level. Using an AI agent, where you can pre-load methodologies, examples, the Standards, etc. can give you feedback on your documentation or test plans. Another way to get feedback on how well you meet the criteria is to have your quality assurance team or a supervisor focus on these practices in a review — or even just asking a teammate to give you feedback every once in a while.

In conclusion, finding the right balance in documentation is crucial for auditors, as it ensures that work is both thorough and efficient. By focusing on the principles of relevance, reliability, and sufficiency, auditors can enhance the quality of their documentation. Additionally, the integration of innovative technologies, such as AI, offers promising advancements to auditing practices. These technologies can help auditors keep high standards of documentation by providing real-time feedback and ensuring adherence to established methodologies.