A Risk & Control Matrix (RCM) which leads each work paper section and ensures a risked based audit approach, identification of relevant risks and controls and describes comprehensive audit steps. The RCM represents the risk-based program directing the audit work for each control assessment conducted.

An Audit Lead Sheet denoting the audit scope and objectives for the work paper section, along with an assessment conclusion summary. Within this summary, the assessment will include identified findings which map to the audit’s Finding and Root Cause Log. Root cause analysis will be used to develop recommendations which remediate the findings, provide for improved control sustainability and mitigate identified risk.

An Audit Narrative, representing a detailed walkthrough of each process and a resulting assessment of the applicable control designs. The narrative will map to each control as recorded to the RCM, ensuring a complete audit and risk mitigation assessment. The Audit Narrative is the tool for full assessment of internal control and compliance design being applied within the component of scope being assessed. Narratives will be developed through detailed interviews and discussions with responsible personnel combined with comprehensive review of related documentation including the associated policies and procedures. 

Standard Test Work which applies consistent standards and clearly described attributes. Testing must also consistently adhere to approved sampling methodology. Each audit test requires a well described test objective section, additional section of detailed rationale and basis of sample selections and a formal conclusion, highlighting any findings and exceptions.

Supporting Documentation which is fully referenced and supports and/or evidences Group Audit’s conclusion and findings. Support documentation also serves to exhibit various documents as described within other parts of the audit work papers, such as within the Lead Sheet or Audit Narrative.

Finding and Root Cause Log representing an organized accumulation of each finding and exception as identified within an audit’s control design assessments and operational effectiveness/compliance testing. The tool additionally provides analysis of finding/exception root cause, allowing the development of audit recommendations which remediate the underlying cause (root) of control weaknesses, eliminating any potential for superficial recommendations solely addressing the “symptoms” of control issues.