Audit engagements
Internal Audit → Audit Engagements
Before your first engagement, check Audit settings — capacity, risk factors, regulatory regimes, quality criteria and remediation reminders all shape what an engagement can do.
An audit engagement runs through seven tabs, roughly in order.
| Tab | What you do there |
|---|---|
| Overview | Scope, dates, budget, and the team — who may do what on this engagement (see Roles and engagement teams). |
| Milestones | The ceremonial gates — announcement, RCM approval, closing meeting. |
| Fieldwork | The audit program and its testing: what will be tested, and what was found. |
| Requests | Information requested from the auditee, and what came back. |
| Findings | Observations, management responses, agreed actions. |
| Report | The structured report and audit opinion. |
| Quality | QAIP review against IIA criteria. |
Milestones and the two-person gate
Some milestones — planning memo approved, RCM approved by the Chief Auditor, final report issued — carry a shield icon. They require two different people: one to complete the work, another to approve it.
Open the milestone and you will find a segregation-of-duties panel with two actions, and nothing to choose from:
- Mark completed — records you as the person who did the work.
- Approve — records you as the person attesting to it. Approving is a review act, so it needs the Reviewer or Lead Auditor role on the engagement, and it is disabled for whoever completed the milestone.
Nobody picks the implementer or the approver from a list. The system records who clicked, with the time — which is what an attestation is. A milestone nobody has completed cannot be approved: there is nothing to attest to.
Fieldwork
The Fieldwork tab is the audit program and the work done against it, in one list. One row per test step, in program order. Opening a row opens that step's workpaper — the procedure, sampling, what was performed, the conclusion, evidence, review notes and sign-off.
There is no separate Workpapers tab, and no "generate workpaper" step. A step and the place its testing is recorded are one thing: add a step and its workpaper is there waiting.
Building the program
Four ways in, all in the tab header:
- Apply program pulls a saved program from the Work Program Library — the usual start.
- Import Excel loads a program from a spreadsheet. Template downloads the layout to fill in.
- Add step writes one by hand.
- Save as program puts this engagement's program back into the library for next time. Only the plan travels — risk, control, test, assertion and clause. Your testing, evidence and sign-offs stay with the engagement.
Applying a program normally adds to what is there. Replacing the whole program is refused once any step has been worked on, because it would throw that testing away.
A step's status is not something you set
The status on each row is read from the work, not typed:
| Shown | Means |
|---|---|
| Not started | Nothing recorded yet. |
| In progress | Testing has begun, or it is with the reviewer or the approver. |
| Signed off | The workpaper has been approved. |
| Not applicable | Deliberately taken out of scope, with a reason. |
Approval is what finishes a step, so the engagement's completion percentage always reflects approved work. A workpaper that has been submitted, or reviewed and not yet approved, counts as in progress.
The three signatures on a working paper
A working paper carries three signatures, in order, and each is its own act by its own person.
| Stage | Who signs | What it means |
|---|---|---|
| Submit for review | The preparer — any auditor on the team | "My testing is complete and the paper is ready to be looked at." |
| Sign review | A Reviewer or Lead Auditor on the engagement | "I have examined the work and the conclusion follows from it." |
| Approve | The Lead Auditor, or an audit manager | "This paper is fit to support the report." |
Approval is deliberately narrower than review. A reviewer signs the review; the final approval rests with whoever carries the engagement's opinion.
Open review notes block both signatures, not just the last one. A note raised after the reviewer has signed still stops the approval.
At each stage the paper can go back: the reviewer sends it to the preparer, and the approver sends it either to the reviewer or straight to the preparer. An approved paper can be reopened to either stage.
Every signature is photographed. The paper's full content at the moment of each signature — the step it tests, the results, the conclusion, the sample and its evidence — is stored and never changes. When a report is issued it records exactly which version of each paper it was built on, so reopening and amending a paper afterwards can never quietly rewrite what the report rested on.
When there are not three people
The preparer, reviewer and approver must be three different people, and the system will not let one person hold two of those signatures silently.
A small audit function is a real situation, though, and it is not a reason to stop work. If you are about to sign a paper you already signed at an earlier stage, you will be asked to record why — at least a sentence. That reason goes onto the signature itself and stays in the record.
It is not a setting anyone can switch off for the whole organisation. It is a decision taken once, on one paper, by the person taking it, and a quality assessor reviewing the engagement will see it and the reason for it.
The work program is a versioned methodology
A saved work program in the Program Library is not a loose document. It has a version number and a status, and only an approved version can be applied to an engagement.
| Status | What it means |
|---|---|
| Draft | Being written or revised. Cannot be applied to an engagement. |
| Approved | Signed off and in use. Immutable. |
| Retired | Withdrawn from new engagements. Audits that used it are untouched. |
An approved version cannot be edited, and that is the point: engagements ran under it, and a method that can be rewritten afterwards is not a method. To change an approved program, start the next version. It opens as a draft copy at version n+1, and the version your past audits followed stays exactly as it was.
When a program is applied, the engagement records which version it followed, and shows it on the Overview tab under Methodology — the programme name, its version, and the words approved programme. That is the answer to the question an external quality assessor asks: which methodology did this audit run under?
The name and version are copied onto the engagement, not looked up. If the programme is later superseded, retired or deleted outright, this engagement still says what it followed.
A program can also pre-link each step to a control in the control library, so applying it starts each control's test history instead of leaving a blank line for someone to retype.
Taking a step out of scope
Use the ⊘ button on the row. Scoping a step out narrows the audit, so it asks why, and the reason stays on the row for anyone reading the file later. The step leaves the completion denominator — an audit that deliberately excludes three of ten areas has completed seven of seven, not seven of ten. The ↺ button brings it back.
Deleting a step
Only a step nobody has worked on can be deleted. Once testing, evidence, a review note or a sign-off exists, the step stays in the record — scope it out instead. That keeps the trail and says why.
Steps added after the program was set
A step that was not in the program when fieldwork began is marked added during fieldwork. That is ordinary — audits find things — and recording it is simply part of the file.
Findings and remediation
Findings move through staged approval: draft observation → issued → management response → agreed → remediating → verified closed.
Actions under a finding are owned by the auditee, who updates their own progress. When the first action starts, the finding advances to remediating automatically. When every action is verified, the auditor is notified that it is ready to close.
Whoever owns a remediation action cannot be the one who verifies it, and the finding owner cannot verify-close their own finding. Independence is enforced, not assumed.