audit-support-workpaper-requirements: Скилл проверки требований к документам

--- name: audit-support-workpaper-requirements description: 'Sub-skill of audit-support: Workpaper Requirements (+2).' version: 1.0.0 category: business type: reference scripts_exempt: true --- # Workpaper Requirements (+2) ## Workpaper Requirements Every control test should be documented with: 1. **Control identification:** - Control number/ID - Control description (what is done, by whom, how often) - Control type (manual, automated, IT-dependent manual) - Control frequency - Risk and assertion addressed 2. **Test design:** - Test objective (what you are trying to determine) - Test procedures (step-by-step instructions) - Expected evidence (what you expect to see if the control is effective) - Sample selection methodology and rationale 3. **Test execution:** - Population description and size - Sample selection details (method, items selected) - Results for each sample item (pass/fail with specific evidence examined) - Exceptions noted with full description 4. **Conclusion:** - Overall assessment (effective / deficiency / significant deficiency / material weakness) - Basis for conclusion - Impact assessment for any exceptions - Compensating controls considered (if applicable) 5. **Sign-off:** - Tester name and date - Reviewer name and date ## Evidence Standards **Sufficient evidence includes:** - Screenshots showing system-enforced controls - Signed/initialed approval documents - Email approvals with identifiable approver and date - System audit logs showing who performed the action and when - Re-performed calculations with matching results - Observation notes (with date, location, observer) **Insufficient evidence:** - Verbal confirmations alone (must be corroborated) - Undated documents - Evidence without identifiable performer/approver - Generic system reports without date/time stamps - "Per discussion with [name]" without corroborating documentation ## Working Paper Organization Organize testing files by control area: ``` SOX Testing/ ├── [Year]/ │ ├── Scoping and Risk Assessment/ │ ├── Revenue Cycle/ │ │ ├── Control Matrix │ │ ├── Walkthrough Documentation │ │ ├── Test Workpapers (one per control) │ │ └── Supporting Evidence │ ├── Procure to Pay/ │ ├── Payroll/ │ ├── Financial Close/ │ ├── Treasury/ │ ├── Fixed Assets/ │ ├── IT General Controls/ │ ├── Entity Level Controls/ │ └── Summary and Conclusions/ │ ├── Deficiency Evaluation │ └── Management Assessment ```