Working papers: how an auditor keeps records

The auditor finishes the work and hands over the report. Six months later the director asks: "Why did you test exactly these items? Where did last September's shortage figure come from?" If the answer lives only in the auditor's memory, there are no working papers. Working papers are everything gathered and written down during the audit: the plan, calculation sheets, copies of evidence, findings. Their job is simple: another auditor should be able to read them and reach the same conclusion.

What each sheet contains

Each working paper answers one question and includes:

• Objective: what is being tested (one sentence).
• Source: where the data came from (the 1C report, the date it was run and the user who ran it).
• Method: how it was tested and what sample was taken.
• Result: what was found, in figures.
• Conclusion: the answer to the objective.
• Who prepared it, who reviewed it, and when.

A good entry and a bad one

A bad entry: "Receiving checked, no issues." It tells you nothing: which period, how many documents, compared with what?

A good entry, say for a food wholesale base: "Objective: confirm that the quantity of cooking oil received was recorded correctly. Period: 1–30 September. Source: 1C report 'Receipt documents', run on 02.10. Sample: 25 documents, list in appendix D-4. Method: boxes on the delivery note ↔ receiving report ↔ 1C receipt date. Result: 23 agree; for 2, the 1C receipt was posted 3 and 5 days late. Conclusion: receiving is correct on quantity, but the control over timely posting does not work." Another specialist can repeat such an entry even if its author has left.

Folder structure

Files are kept in a logical order, and every sheet gets an index:

1. Plan and scope (A).
2. Process descriptions and maps (B).
3. Testing sheets for each control (C).
4. Evidence: copies, photographs, external confirmations (D).
5. Register of findings (E).
6. Draft reports (F).

Sheets refer to one another: finding E-3 is recorded as "based on test C-2 and evidence D-12". That way every statement can be traced back to its source.

Tick marks

Calculation sheets use short marks. What matters is that they are explained at the top of each file. For example:

• M: agrees to the delivery note;
• S: sum recalculated;
• X: does not agree, entered in the register of findings;
• T: external confirmation exists.

A mark with no legend will be a mystery to everyone a few months later.

Review

Every sheet is read by a second person, who leaves written questions. No comments means it has not been reviewed: the word "seen" is not enough; a signature and a date are needed. A major finding is separately approved by the lead auditor before it enters the report.

A source for every sentence in the report

When the report is written, each important statement carries a reference to a working paper: "shortage 9.4 million so'm (C-5, D-8)". If no reference can be given, the statement stays out of the report or is marked as an "assumption". The rule helps both sides: the auditor rechecks the conclusion before handing it over, and when the client asks "where does this figure come from?" there is a short answer, and the source document can be seen if wanted. This check is done once, on its own, before the draft goes to the client.

Storage and confidentiality

Working papers hold the client's prices, balances and sometimes details about staff. Under the contract and the NDA they must be protected. In practice that means:

• files sit not on a personal phone or in a shared Telegram chat but in a folder with restricted access;
• the file name carries a date and old versions are not deleted;
• a backup is kept separately;
• the retention period is agreed in the contract, and copies are destroyed when it ends.

Common mistakes

• "Checked" is written, but not what was checked or how.
• Only tests where an error was found are recorded; a test with no errors is dropped, and the fact of checking cannot be shown.
• Opinion and fact get mixed: "perhaps stolen" is recorded as a fact.
• When a figure is corrected, the old value is erased and nobody can see what changed.
• Sheets are filled with abbreviations that only their author understands.

Conclusion

Work that is not written down is work that is not proven. OmborAudit records every step in its working papers so that, when needed, the client or another specialist can follow the route to a conclusion from start to finish.