cmc/cleberg.net

 1#+date:        [2023-06-20 Tue 00:00:00]
 2#+title:       Audit Testing Review Checklist
 3#+description: A practical checklist for reviewing audit testing on financial and SOC engagements.
 4#+slug:        audit-review-template
 5#+filetags:    :audit:
 6
 7* Overview
 8
 9This post is a /very/ brief overview on the basic process to review
10audit test results, focusing on work done as part of a financial
11statement audit (FSA) or service organization controls (SOC) report.
12
13While there are numerous different things to review and look for - all
14varying wildly depending on the report, client, and tester - this list
15serves as a solid base foundation for a reviewer.
16
17I have used this throughout my career as a starting point to my reviews,
18and it has worked wonders for creating a consistent and objective
19template to my reviews. The goal is to keep this base high-level enough
20to be used on a wide variety of engagements, while still ensuring that
21all key areas are covered.
22
23* Review Template
24
251. [ ] Check all documents for spelling and grammar.
262. [ ] Ensure all acronyms are fully explained upon first use.
273. [ ] For all people referenced, use their full names and job titles
28   upon first use.
294. [ ] All supporting documents must cross-reference to the lead sheet
30   and vice-versa.
315. [ ] Verify that the control has been adequately tested:
32   - [ ] *Test of Design*: Did the tester obtain information regarding
33     how the control should perform normally and abnormally (e.g.,
34     emergency scenarios)?
35   - [ ] *Test of Operating Effectiveness*: Did the tester inquire,
36     observe, inspect, or re-perform sufficient evidence to support
37     their conclusion over the control? Inquiry alone is not adequate!
386. [ ] For any information used in the control, whether by the control
39   operator or by the tester, did the tester appropriately document the
40   source (system or person), extraction method, parameters, and
41   completeness and accuracy (C&A)?
42   - [ ] For any reports, queries, etc. used in the extraction, did the
43     tester include a copy and notate C&A considerations?
447. [ ] Did the tester document the specific criteria that the control is
45   being tested against?
468. [ ] Did the tester notate in the supporting documents where each
47   criterion was satisfied?
489. [ ] If testing specific policies or procedures, are the documents
49   adequate?
50   - [ ] e.g., a test to validate that a review of policy XYZ occurs
51     periodically should also evaluate the sufficiency of the policy
52     itself, if meant to cover the risk that such a policy does not
53     exist and is not reviewed.
5410. [ ] Does the test cover the appropriate period under review?
55    - [ ] If the test is meant to cover only a portion of the audit
56      period, do other controls exist to mitigate the risks that exist
57      for the remainder of the period?
5811. [ ] For any computer-aided audit tools (CAATs) or other automation
59    techniques used in the test, is the use of such tools explained and
60    appropriately documented?
6112. [ ] If prior-period documentation exists, are there any missing
62    pieces of evidence that would further enhance the quality of the
63    test?
6413. [ ] Was any information discovered during the walkthrough or inquiry
65    phase that was not incorporated into the test?
6614. [ ] Are there new rules or expectations from your company's internal
67    guidance or your regulatory bodies that would affect the audit
68    approach for this control?
6915. [ ] Was an exception, finding, or deficiency identified as a result
70    of this test?
71    - [ ] Was the control deficient in design, operation, or both?
72    - [ ] What was the root cause of the finding?
73    - [ ] Does the finding indicate other findings or potential fraud?
74    - [ ] What's the severity and scope of the finding?
75    - [ ] Do other controls exist as a form of compensation against the
76      finding's severity, and do they mitigate the risk within the
77      control objective?
78    - [ ] Does the finding exist at the end of the period, or was it
79      resolved within the audit period?