A reviewer opens your file two years after the engagement closed. You are gone, the auditee reorganized, and a regulator wants to know how you concluded controls were effective. The workpapers either answer that alone or they do not.
Workpapers are the documented record of the information obtained, the analyses performed, and the support for the conclusions and engagement results. They serve three audiences: the supervisory reviewer during the engagement, the reader who must retrace the work later, and any external party entitled to see it.
The operating test is the re-performance standard. An experienced auditor with no prior connection to the engagement should be able to read the file and reach the same conclusion without asking you a question. If a step requires your memory, the workpaper is incomplete.
KEY: Documentation supports the conclusion. It does not replace it. A file full of screenshots with no evaluation of what they mean fails, because nothing links evidence to a judgment.
Common mistakes
- Documenting evidence without documenting a conclusion. A paper that lists 60 tested items and stops fails, because nothing states whether the objective was met.
- Reporting an observation with no cross-reference. If the summary schedule does not point to a test paper, the finding is unsupported and must be worked or removed.
- Accepting auditee-prepared schedules as source data. A spreadsheet from the process owner is low-reliability evidence until tied out to the system of record; note the source and the tie-out.
Bottom line
- Re-performance test: an experienced auditor with no prior connection must reach your conclusion from the file alone, with no questions asked.
- Required elements: header and index, purpose, source and date, scope and sample, criteria, work performed, results, conclusion, tickmark legend, preparer and reviewer sign-off, cross-references.
- Evidence attributes: sufficient (quantity), reliable (source and quality), relevant (linked to the objective), useful (helps the organization).
- Reliability order: auditor observation and re-performance, external confirmation, original source documents, auditee-prepared summaries, uncorroborated verbal statements last.
Exam shortcut
Read the stem for the missing element. Questions about workpapers usually describe a file and ask what is wrong. Run the element checklist in order: purpose, source, criteria, work performed, results, conclusion, sign-off, cross-reference. The first one absent from the stem is the answer. Stem signals: "the auditor was told" or "management explained" means uncorroborated inquiry, and the answer involves documenting and corroborating, never accepting.
The full lesson (about 2,301 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 7
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.