Controls and risk workpapers

A Control Owner maintains a clear control description and decides when it should remain Active or become Inactive. The Auditor uses the control reference when recording a test or retest. This makes it possible to compare the work performed against the control the team actually intended to examine. Similar descriptions need distinct control codes so an imported sample does not land against the wrong record.

Risk workpapers provide another route into the assessment. A risk record has a title, raised date, source and resolution text, together with assessment and organization references. Supporting workpaper lines carry memo detail and a link to a control. Use that detail to explain the item under review and retain the context needed by the Audit Manager.

• Control register. The Control Owner maintains the description and lifecycle state. Account classifications help a finance audit team organize the controls it examines; agree their meaning before adding records.
• Risk record. The Auditor records a title and resolution narrative with the correct assessment and organization. Draft workpapers stay available for review through Workpapers Unposted.
• Supporting detail. Workpaper lines connect their parent risk to a control and preserve the memo and amount detail. Review those lines with the parent record whenever the explanation depends on them.

Agree a control naming convention and who can retire a control from new use. Explain how earlier tests should be read when the referenced control is now Inactive. The history of an audit exercise still needs a recognizable control description when the team comes back to discuss its findings.

For risk workpapers, agree how the team uses Draft, Posted and Reversed and which person reviews a proposed state change. Keep the resolution narrative precise about what was examined. Any connection to a finance system needs its own mapping and reconciliation procedure. Decide which workpaper amounts matter to the audit team before placing them in a management report, and keep the reporting interpretation consistent across organizations.

Choose a control covering supplier access changes. The Control Owner checks the description and confirms that the control is Active. The Auditor links a test to it, then records a risk workpaper explaining an access exception found during the assessment. A supporting line names the same control and explains the item in its memo.

Ask the Audit Manager to trace the risk to its assessment and inspect the supporting line. Next, choose an Inactive control with a similar description. The reviewer should be able to explain why the current test uses the Active record. Discuss what evidence is required before changing the workpaper’s state, and write that procedure into the team’s setup decisions.

• Active Controls — Select and maintain the controls available for current testing.
• Workpapers Unposted — Inspect Draft risk workpapers before the next review step.

Follow finding review and use evidence and exception review when an operation requires investigation.