PRACTICAL ASSURANCE GUIDES
How to link audit evidence to control testing
A useful working paper lets a reviewer follow the path from the control being tested to the evidence, the procedure performed and the conclusion. Here is a practical way to keep that path clear.
Start with the question the test needs to answer
Uploading a document is only the start. First describe the risk, the control intended to address it, the period under review and the test objective. A supplier approval policy may explain how a control is designed, but it does not by itself show whether the control operated for a particular purchase.
For example, if the control requires approval before an order is raised, the test should compare an identifiable approval with an identifiable order and their dates. Decide which attributes you need before requesting files: transaction reference, approver, approval date, order date and the applicable authority limit.
Give each item a stable reference
Use a reference that stays meaningful when a file is renamed or moved. Record the source, date received, period covered and version alongside it. For a workbook, identify the worksheet and row or cell range. For a PDF, identify the page and relevant section. Retain the source file so a reviewer can check the reference in context.
Keep the population and the selected items distinguishable. Document how you checked the population's coverage and how the selection was made. A clear reference supports traceability; it does not establish that the source is complete or reliable.
Connect the evidence to the procedure
Write down what you actually inspected or compared. Avoid a result such as “invoice checked” when the objective concerns prior approval. State which records you matched, which attributes you compared, what you found and any limitations. If one source supports several tests, keep a distinct reference and conclusion for each procedure.
A worked example: purchase approval
Assume a fictional organisation requires budget-holder approval before an order is raised. The following is a single-item illustration, not a sampling method or an overall assurance conclusion.
| Test objective | Was the order approved by an authorised budget holder before creation? |
|---|---|
| Evidence | EV-12: order export, row 18. EV-19: approval record, page 2. EV-03: authority schedule applicable on the approval date. |
| Procedure | Match order reference and value; compare approval and creation timestamps; check approver against the authority schedule. |
| Result | Approval on 8 September; order created on 9 September; value within the approver's recorded limit. |
| Conclusion | The selected item met the attributes tested, subject to the reliability of the supporting records. |
If the approval record were missing, record the evidence gap and follow it up. Do not convert missing support into a pass or assume that it proves approval never occurred.
Separate exceptions, gaps and conclusions
An exception is a difference from the criterion being tested. An evidence gap means the available information does not support a conclusion yet. A file received after fieldwork may resolve a gap, or it may require additional procedures. Record what changed and why the conclusion changed.
When findings emerge, explain the condition, the relevant criterion and the supporting evidence. Assess cause and risk within the engagement's scope before making a management recommendation. Avoid extending a conclusion from one selected item to an entire population without an appropriate basis.
Make review and later changes traceable
A reviewer should be able to locate the source, understand the procedure and see how the result supports the conclusion. Keep review questions beside the work they concern, record their resolution and identify the version reviewed. Preserve the link between any report finding and its underlying working papers.
Before sign-off, check that references still open, evidence versions are clear and unresolved limitations are visible. Your firm's methodology determines the required documentation and review. The IIA's Global Internal Audit Standards discuss evidence quality and engagement documentation in Standards 14.1 and 14.6.
Keep the test and its evidence together.
Explore how AccordWise connects fieldwork, supporting evidence and review in an internal audit workflow.
Explore internal audit workflows