Table of ContentsIntroduction . 1Documentation is required . 1The basics . 2Documentation basics are taught early. 2Workpapers’ role in an engagement . 2Plan the engagement . 4Planning overview . 4Engagement objectives . 4Engagement scope & resource allocation . 6Engagement work program . 7Perform the engagement . 8Engagement performance overview . 8Key elements in a workpaper . 9Cross-referencing .10Using tick-marks .10Communicate engagement results .11Requirements to communicate results .11Communications in all phases .11Ensuring complete and accurate communications .12Closing thoughts .13

INTRODUCTIONDocumentation is requiredAudit FocusJust as good communication is at the core of a quality andsuccessful organization, good documentation can put goodIIA Standard 2330: DocumentingInformationcommunication in a manageable context and render itcentral to effective policies, procedures, regulations, legalmatters, disputes, and audits. Many have heard the phrase,“If it is not in writing, it didn’t happen.” This phrase is oftenInternal auditors must documentsufficient, reliable, relevant, and usefulinformation to support the engagementresults and conclusions.used as a method to strive for better, and more complete,documentation. Simply put, it just makes sense to documentStandard 2320: Analysis and Evaluationwhat is planned, what is done, and what is communicated.Internal auditors must base conclusionsand engagement results on appropriateanalyses and evaluations.Internal auditors approach their work in a systematic,disciplined manner, and workpapers provide a systematic, disciplined approach to documentation. Workpapersprovide evidence of the entire engagement process — from planning to performing to communicating.Engagement workpapers are used to document the information generated throughout the engagementprocess, including planning; testing, analyzing, and evaluating data; and formulating engagement results andconclusions. Workpapers may be maintained on paper, electronically, or both. Use of internal audit softwaremay enhance consistency and efficiency.Furthermore, advances in internal audit software utilized by many internal audit departments allow the reviewof workpapers to occur remotely, such that a member of the audit team and the reviewer need not be in thesame geography or time zone to ensure conformance with IIA Standard 2340: Engagement Supervision.Ensuring the sufficiency of documentation during all phases of an audit engagement is not an option; it isrequired by IIA Standard 2320: Analysis and Evaluation, and it is common sense. Effective workpapers allowthe internal audit staff to ensure that they are in conformance with the International Standards for theProfessional Practice of Internal Auditing regarding the documentation of information.As IIA Global Board of Directors Chairman Naohiro Mouri states in his chairman’s theme video Emphasizethe Basics, Elevate the Standards, “Wherever in the world you are, conformance with the Standards isessential.” He continues by stating, “The Standards are crucial to build; to construct a proud and successfulcareer in internal audit.”This knowledge brief discusses how effective workpapers are essential to the success of the internalaudit activity.1

THE BASICSDocumentation basics are taught earlyStudents, at a very young age, are taught to document their work in much the same way necessary forinternal auditors to produce effective workpapers. Teachers’ assignments typically include a set of tasks,similar to audit “work program steps,” to be completed. Students are expected to write their names on theassignment, complete each assigned task, and provide the date on which the assignment was completed.Students also may be required to show how they arrived at an answer and/or provide a conclusion. For mathproblems, they may be required to “show their work.”The student is essentially completing a “workpaper” that facilitates supervision of the work. In this case, thestudent is the auditor, the assignment is the workpaper, and the teacher is the supervisor of the audit. Bycompleting each of the assigned tasks and documenting his or her work, the student facilitates the teacher’sability to: Efficiently and effectively evaluate the student’s mastery of the material.Provide supervisory feedback (verbal or written).Ensure that the learning objectives have been met.Often, the teacher will expect the student to review that feedback and make necessary corrections.Without the “workpaper” basics completed, there would be no other way to ensure that each student completedeach task in the timeframe required. Further, the teacher’s feedback provides an opportunity for the studentto learn from mistakes so that competencies are developed and future work is benefited.Properly prepared and completed internal audit workpapers serve the same purpose as a student’s completedassignment.Workpapers’ role in an engagementAccording to the Standards, an engagement is “a specific internal audit assignment, task, or review activity,such as an internal audit control self-assessment review, fraud examination, or consultancy. An engagementmay include multiple tasks or activities designed to accomplish a specific set of objectives.”Audit workpapers facilitate accomplishing the engagement’s objectives. Workpapers should stand on theirown. In other words, the purpose, source of information, and conclusion must be clearly evident, and all2

information should be documented in a way that a reviewerwill not need to ask additional questions in order tounderstand what was tested or how an auditor arrived atthe conclusions.The IIA’s Implementation Guide 1200: Proficiency and DueAudit FocusIIA Standard 1200: Proficiency and DueProfessional CareEngagements must be performed withproficiency and due professional care.Professional Care states, “Internal auditors’ due professionalcare may be evidenced in engagement workpapers or other documentation of the procedures and processesused during the audit engagement. Documented supervisory reviews of engagements and post-engagementclient surveys or other forms of feedback could indicate the proficiency and due professional care exhibited byindividual internal auditors.”Developing quality workpapers requires skill, including the ability to gather sufficient, competent, reliable, anduseful audit evidence in accordance with the Standards set for the profession. Workpapers should clearlydemonstrate that the internal audit work was complete; provide a link between the agreed-upon scope of work,audit program, and audit report; and be available for review by senior management for developing a plan forfuture audits. When the workpapers are completed, auditors should ask themselves, “If a third-party entitywere to perform the tests conducted — based on the documentation provided — would they be able to reachthe same conclusions?”Engagement workpapers must include documentation that demonstrates the completion of all tasks necessaryto ensure that all engagement objectives have been met. Further, all conclusions drawn and communicationsmade must be fully supported in the workpapers.Because the Standards set high expectations for workpaper content, it is a common error, particularly byinexperienced internal auditors, to include extraneous information. Including information in the workpapersbeyond what is necessary to complete the engagement tasks and/or support conclusions and communicationscan be problematic. In such cases, a user of the workpapers may draw incorrect inferences as to the actualscope of the engagement, the conclusions drawn, or the purpose of such workpapers.Internal auditors complete workpapers for each of the stages of an audit engagement: Planning the engagement.Performing the engagement.Communicating the results.The next sections of this knowledge brief discuss the nature, content, and requirements of workpapers duringeach stage of the audit engagement.3

PLAN THE ENGAGEMENTPlanning overviewAudit FocusBefore understanding the key elements of goodIIA Standard 2200: Engagement Planningworkpapers, auditors need to, in conformance withStandard 2201, understand the mission, vision, objectives,Internal auditors must develop anddocument a plan for each engagement,including the engagement’s objectives,scope, timing, and resource allocations.The plan must consider theorganization’s strategies, objectives,and risks relevant to the engagement.risk, risk appetite, control environment, governancestructure, and risk management process of the area orprocess under review. Internal auditors can plan effectivelyfor an engagement if they start with that understanding,which will identify the main objectives of the workpapers.During the engagement’s planning stage, internal auditorsdetermine the level of formality and detail that is requiredto be documented. The organization’s internal audit policymanual should specify the formal process and include theIIA Standard 2201: PlanningConsiderationsIn planning the engagement, internalauditors must consider: The strategies and objectives of theactivity being reviewed and themeans by which the activity controlsits performance. The significant risks to the activity’sobjectives, resources, andoperations and the means by whichthe potential impact of risk is kept toan acceptable level. The adequacy and effectiveness ofthe activity’s governance, riskmanagement, and control processescompared to a relevant frameworkor model.pertinent templates.Engagement objectivesUnlike workpapers related to performance of theengagement, which are discussed later in this knowledgebrief, planning workpapers will not typically have testingprocedures or conclusions drawn. Rather, workpapersduring the planning phase of an engagement are focusedon documenting why the audit is being performed and whatthe internal audit department intends to accomplish inperforming the audit. At the conclusion of the engagement planning phase, it iscommon to complete a planning memo. The audit planningmemo documents the objectives for performing theThe opportunities for makingsignificant improvements to theactivity’s governance, riskmanagement, and control processes.engagement. The planning memo is also an importantdocument to communicate engagement objectives, scope, and other important background information toaudit team members assigned by internal audit management to perform the engagement.4

Although the planning memo is useful in summarizingconclusions reached during the planning phase, there areother common types of workpapers that are created duringthe engagement objective setting phase that support theengagement plan: Excerpts from the internal audit plan related to thearea or process under review.Minutes of meetings related to the area or processunder review.Notes from discussions with management heldduring the engagement planning.External research related to the area or processunder review.Applicable key performance indicators (KPIs).Data analytics performed as part of engagementplanning.Such documentation provides the internal auditor withinformation that supports the determination of what theengagement should entail (i.e., the engagement scope).Some planning workpapers include information that isproduced by the internal auditor, such as data analytics andmeeting notes, while other workpapers may includeinformation that has been provided by process owners ormanagement, such as KPIs and minutes of applicablemeetings. Workpapers should include notations that clearlyidentify the source of the information for users.Audit FocusIIA Standard:2210 – Engagement ObjectivesObjectiv