UTMB Audit Services

Audit Manual

Workpaper Guidelines

Workpapers are the record of the auditor's work and the link between fieldwork and the auditor's report. They are the documentation of the results of the engagement and the basis for the auditor's conclusions.

Workpaper General Guidelines

Internal auditors should identify sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives. General guidelines for the preparation of workpapers are:

Completeness and Accuracy - Workpapers should be complete, accurate, and support observations, testing, conclusions, findings, and recommendations.
Clarity and Understanding - Workpapers should be clear and understandable without supplementary oral explanations. A reviewer should be able to readily determine their purpose, the nature and scope of the work done and the preparer's conclusions.
Relevant - Information contained in workpapers should be limited to matters that are important and necessary to support the objectives and scope established for the engagement.

Each engagement’s electronic workpaper file steps include the following information:

Procedure Step Title – describes purpose of step using an action phrase
Procedure Step – describes instructions to achieve the purpose
Source – lists resources used to perform procedure step (documents, personnel, systems, etc.)
Criteria – describes criteria used in procedure step, if applicable (policies and procedures, rules and regulations, etc.)
Results – describes outcome of the instructions performed in the procedure step
Conclusion – summarizes results and identifies any findings
Refs – workpaper, procedure step, and finding references, if applicable

Planning, Wrap-up and QAR Workpaper Guidelines:

While the purpose and results must be documented in all Planning, Wrap-up, and QAR steps, the source, criteria, and conclusion tabs are not required to be completed but rather, should be completed as applicable.

Fieldwork Workpaper Guidelines:

While it is not necessary to document a purpose and results/conclusion on every fieldwork workpaper, each workpaper must, at minimum, have an appropriate reference to a procedure step or another workpaper that includes a purpose and results/conclusion. If a workpaper has considerable analysis, uses sampling, or includes complicated information, the specific procedures performed should be documented. Sources of data should be clearly identified.

Workpaper Documentation:

Avoid long narratives. Instead, use bullet points, flowcharts, etc. to convey information.
Avoid repeating information that is already documented elsewhere in the workpapers. Instead use reference and cross-reference links when possible.
Differences or testing exceptions in the workpapers should be cross-referenced to the Findings & Recommendations section, which should also include related recommendations.
Documentation in the workpapers should satisfy the re-performance standard. Workpapers must be documented so that an auditor not familiar with the engagement can re-perform the procedures exactly as they were done. While copies of all work do not need to be included in the workpapers, enough descriptive information should be included to let reviewer(s) know what was done (e.g., voucher or document ID #).

Checkout Procedures for Completed Hard Copy Engagement Workpapers

Completed engagement workpapers prior to fiscal year 2000 are hard copies bound and filed in RSH 1.131, which can be checked out by any System Audit Office employee. To checkout workpaper binder(s), the employee should contact the Audit Services Coordinator and fill in the appropriate information on the orange workpaper checkout sheet. The workpaper binder file cabinet key is kept by the Audit Services Coordinator. Once the workpaper binder(s) is located, an “OUT” tab should be replaced in the file’s place. To check-in workpaper binder(s), the date of return should be filled in on the workpaper checkout sheet and the workpaper binder(s) should be returned to the Audit Services Coordinator to be re-filed.

Procedures for Engagement Temporary Desk Files

All engagement team members are responsible for proper disposal of their temporary supporting documents and drafts (working files, both hard copies and electronic) that were maintained during the engagement review process but did not become part of the final and/or required workpaper documents. Generally, these files and documents should be disposed of by 30 days after report issuance.

Electronic documents should be deleted from the office network S Drive work folders. Hard copy items should be disposed of with special attention paid to documents with any confidential and/or sensitive data (e.g. bank account, social security, and credit card numbers, personal health information, etc.), which should be shredded.

Glossary of Workpaper Terms

Conclusion:	Provides an answer to the question/goal/objective identified in the procedure step (purpose) and reflects the auditor’s assessment of the results of the procedures performed. The conclusion drawn should be referenced to the Findings & Recommendations section if deemed to include a finding. [NOTE: The results statement and the conclusion statement may be combined.]

Cross-reference:	A hyperlink or reference number indicating that an item included on one workpaper agrees with or was obtained from another workpaper or that the workpaper itself supports or ties to another workpaper or procedure step.

Finding:	A difference and/or exception identified during performance of the engagement that has a condition, effect, cause, and criteria, which should also have a related recommendation.

PBC:	Document that is provided or prepared by the client for use in the planning, fieldwork, or reporting phase of the engagement.

PBIA:	Document that is provided or prepared by an institution’s internal audit for use in the planning, fieldwork, or reporting phase of the engagement.

Procedure Step Title (purpose):	Briefly describes purpose of step(s) that will be performed to achieve one or more engagement objectives, and should be written as an action phrase.

Procedure Step:	An outline of specific instructions to perform, such as interview, verify, determine, trace, vouch, agree, etc. whatever/whomever in addition to sample size and method for choosing the sample (as applicable).

Recommendation:	Addresses the condition and/or cause of a finding.

Reference:	A hyperlink or reference number on one workpaper indicating another workpaper or procedure step, which has information supporting or relating to the first workpaper.

Results:	A summary of what was identified during the procedures performed (testing, interviewing, observing, etc.).

Scope:	The period of time and/or specific process covered in the engagement or included in the information contained in a workpaper.

Source:	he personnel (name, title and department), document, IT system, or website (as appropriate) from which information was obtained.

Findings & Recommendations:	A summary of findings and recommendations derived during the engagement with the final dispositions. The summary should be cross-referenced to the related fieldwork and report workpapers.

Tickmark (TM):	A clearly identifiable symbol, letter, or number used to simplify documentation of work by providing comments or further explanation of differences or exceptions in the associated tickmark legend.

TM Legend (TML):	A list of tickmarks and a respective description, which adequately explains the difference or exception found during performance of a procedure. It should be evident as to whether or not an error or weakness was noted. Explanations should be provided to show why items marked "N/A" are not applicable.

Workpaper (WP):	A document prepared or obtained by an auditor which provides relevant evidence in support of a procedure step. Additionally, the document can serve as the basis for conclusions and recommendations contained in the report. Each workpaper becomes an integral part of the set of workpapers (administrative, fieldwork, report) that support the entire engagement.