Managing audit evidence across hundreds of client documents

Managing audit evidence means handling the several hundred documents an engagement generates so that each one can be found, is known to be current, and is linked to the figures that depend on it. Four things have to work: requests specific enough that what arrives is usable, classification and naming applied on arrival rather than later, version control so that a superseded file cannot be relied on, and a live view of what remains outstanding. Where these fail, the audit work is unaffected in quality but the file becomes undefendable, because nobody can show which document supports which number.

The scale of the problem

A mid-market statutory audit typically involves a trial balance and ledgers, a dozen registers and schedules, twelve monthly GST statements per registration, bank statements and confirmations for every account, supplier and customer confirmations, contracts, board minutes, statutory registers, fixed asset records, stock records, and a sample of transaction-level documents that can run to several hundred invoices on its own.

Most firms manage this with a shared folder and an email thread. That works until a document is superseded, until two people are working on the same section, or until somebody asks in November which version of the stock sheet the valuation was tested against.

Requesting so that what arrives is usable

Most document problems are request problems. A vague request produces whatever the client's accountant happens to generate, and the cost of that lands three weeks later.

1. 01Name the document, the format and the periodNot “the purchase data” but “purchase register for 1 April to 31 March, in Excel, one row per invoice line, filtered on voucher date, with the columns listed below”. Include a sample file the first year. The specification pays for itself immediately.
2. 02Say what it is forA client who knows the register is being matched against their GST statements will produce it with the GSTIN column populated. A client who does not will send whatever the default report gives.
3. 03Separate what you need now from what you need laterA single list of ninety items sent in week one produces ninety items in week six. A first tranche of the eight things that unblock the population reconciliation produces those eight in days.
4. 04Name a person, not a companyRequests addressed to the finance department are addressed to nobody. Identify who maintains the accounting system, and route data requests to them directly rather than through the partner's contact.
5. 05Make the outstanding list visible to the clientThe single highest-return change available. A client who can see what is outstanding will close most of it without being chased, and the arguments about what was asked for disappear.

Classification and naming

A document that cannot be found is evidence that does not exist. Naming has to happen on arrival, by whoever receives it, and has to encode enough to be searched.

The last row matters more than it looks. A file named so that anyone can see whether it came from the client or was downloaded by the audit team preserves a distinction that goes directly to the reliability of the evidence, and that distinction is otherwise lost the moment the file lands in a folder.

Versions, and why the second file is dangerous

Clients re-run reports. A purchase register sent in May and re-sent in July will differ, because entries were passed in between. The risk is not that the second file is wrong; it is that half the testing was done on the first and half on the second, and the working paper says neither.

• Record, for every file, when it was received, from whom, and the control total and row count. Two registers with the same name and different row counts are then distinguishable in seconds.
• Never overwrite. A superseded file stays, marked superseded, because work already performed refers to it.
• When a file is replaced, identify the work already performed on the old one and decide explicitly whether it must be redone. That decision belongs in the file.
• State in the working paper which file the testing was performed on, by name and received date.

Linking documents to the figures that depend on them

Storage is not the hard part. The hard part is that a figure in a working paper should lead to the document and page it came from, and a document should lead to everything that relies on it.

The second direction is the one usually missing, and it is the one that matters when something changes. If a client re-issues a bank confirmation in week five, the question is which papers relied on the old one. Without a link from the document back to the work, answering that means opening every paper in the section.

Knowing what is outstanding

At any moment in an engagement, someone should be able to answer three questions without opening a folder: what has been requested, what has arrived, and what is blocking work that cannot start. Most firms cannot answer the third at all, which is why teams discover a blocking gap in week four rather than week one.

• Requested, with the date and the person it was requested from.
• Received, with the date and what was actually received, which is not always what was asked for.
• Rejected or returned, with the reason, because a file received in the wrong format is not received.
• Outstanding, sorted by what it blocks rather than by when it was requested.
• Not required after all, marked as such, so it stops appearing on the chase list.

What to fix if you only fix one thing

Give the client a single view of what is outstanding, and stop chasing by email. It costs nothing in audit skill, removes most of the friction from the relationship, and reclaims the largest single block of elapsed time in the engagement. Everything else on this page is a refinement by comparison.