Numbering system for workpapers 1372

  • I am establishing standards for our SOX 2006 plan. One of my topics with the Internal Audit department has been the best methodology for numbering workpapers. Are there any suggestions for numbering methods that have worked well? I have seen a few methods and many are cumbersome.
    Thank you for your suggestions in advance.
    Laura O.

  • Standards require that workpaper numbering be logical and easy to follow. It does not necessarily require uniformity throughout a department. In my internal audit dept, we use different styles for numbering depending on personal preference and what makes the most sense for the actual workpapers.
    What I personally have found that works the best is to divide your audit program into sections (i.e. A, B, C, D). Number the workpapers for each section by preceding the page number with the corresponding section’s letter. A-1, B-28, etc. If you have to add in pages to a section after you have already numbered your workpapers you can easily call the new page C-22.1 or something to that effect. As long as you are consistent you will be meeting guidelines.
    Hope this helps…

  • I’ve seen IA use the following conventions:
    Audit reports YYYY-NN.AA.B
    YYYY = Year (2006)
    NN = Number of the audit – hopefully they don’t do more than 100 per year 😉 🙂
    AA = Audit point (usually a number)
    B = Subpoint (usually a letter)
    The key is to establish these types of conventions as a standard and to thoroughly communicate it to everyone

  • You can follow the numbering based on transaction cycle i.e. begin with Bill to Collect, Purchase to Pay to Financial Statement Close Process.
    Once that is decided we can base our numbering based on the process affecting the most liquid account.
    For e.g. Cash Receipts would be A, Cash Disbursement would be B
    Billing would be C, Purchases would be D, Payroll would be E to end with Z for Equity Transactions.
    For example control # 1 tested would be C1.X.
    This is the approach being followed by Big 4 when they do their SOX efforts.

  • I have seen some of the ones mentioned and am using one similar. I found that the first two years of SOX little things like consistency were left on the back burner. I will be using all of your suggestions to determine one standard for our whole internal audit department to use. Thank you again

  • Related to workpaper numbering standards…the following are review procedures that might be helpful when developing documentation standards:

    1. All workpapers are properly indexed in the bottom right-hand corner.
    2. There are no unexplained gaps in the numerical sequence of the page numbers.
    3. A file index has been prepared.
    4. All pages are initialed in the upper right-hand corner by the auditor(s) who prepared them. All pages containing a conclusion include auditor initials and date.
    5. All pages have proper headings.
    6. When cross-referencing to something other than an amount, the auditor has written an appropriate explanation as to why the reader should see that page and what particular item the reader is to see on that page.
    7. Only identical amounts are cross-referenced, except for items referenced in accordance with 6 above.
    8. All tickmark explanations contain:
      a. a description of precisely what was done;
      b. a comment as to whether or not an exception was found.
    9. If the same tickmark was used on more than one page, a reference is made on each page as to where the explanation can be found.
    10. When N/A is used as a tickmark, the auditor explained why N/A was appropriate.
    11. All exception tickmarks are adequately resolved or referenced to an audit point.
    12. All workpapers include the purpose or are cross-referenced to where such can be found.
    13. Source and conclusion are included on all workpapers where appropriate.
    14. All program steps are signed and dated by the auditor.
    15. All program steps reflect the procedures that were actually performed.
    16. All schedules prepared by the client are identified with the following notation in the upper right-hand corner: PBC.
    17. The sequence of the workpapers follows the sequence of the audit program.
    18. The Sample Plan has been reviewed for completeness.
    19. Noted errors in grammar, spelling, and punctuation have been corrected.
    20. The cover has been signed before submitting to the next level for review.
    21. An audit risk assessment, or impact analysis for federal program audits, was completed by the auditor.
    22. The auditor’s understanding of the internal controls related to the program is documented.
    23. An evaluation of internal controls was performed by the auditor to determine the nature, timing, and extent of the procedures performed.
    24. Sufficient competent evidential matter was obtained by the auditor to support each conclusion.
    25. Amounts are properly footed and cross-footed.
      You might also consider including a review procedure to assess if the language is written in Plain English…
      A good document that includes a Plain English Dictionary at the end may be found below:
      Hope this helps,

  • Thank you Milan for an extensive answer. I agree with most of the items. There are a couple that do not apply to some of the testing documents (like signing each page, I have had testing support over 100 pages in some instances). Where the difficulty lies is when there are multiple controls and sometimes different periods required within the same control. For example, we have some processes that include both daily conrtrols and quarterly controls. We also have multiple entities. I am trying to decide on a numbering system that is not too difficult to follow but consistent and will also consider the need for different sets of workpapers within the same process.
    For my next question I am going to use a common process to make the question easier to understand, bank reconciliations. For some of the controls the reference would be to several pages for each bank tested. Is is necessary to have every page numbered with the same methodology or can on successive pages use an abreviated form of the numbering system?

  • If I understand your question, I think it would be fine to use an abbreviated numbering system. As long as there is no confusion about the identification of the workpapers, cross-referencing issues, or redundancy in workpaper numbers, you should be ok.
    For large documents that contain related pages, I sometimes simply workpaper reference the first page, staple/clip the pages together, and document each page… 1/5, 2/5, 3/5, 4/5, 5/5. You can use the page numbers from this section for cross-referencing purposes. If a cross-reference points to a document outside of the section, you will need to use the longer w/p ref.

  • We numbered our SOX workpapers based on the control activity number. For example, in the AP process we have control activities numbered 1-10. So, for our testing, we labeled our workpapers AP-1, 2, 3, etc, depending on what control activity we are testing. For controls where multiples months are tested (like a rec), we just said AP-1a, AP-1b where a and b represented the months we tested. Any other documentation behind there was AP-1a.1, .2., .3. By using AP-1 or Debt-1 we always knew which process and control activity the workpaper was referencing, the pages behind that became just a prefence. Also, we did it this way for initial testing and at year-end, except at year end, our workpaper reference was AP-1 (YE).
    For workpapers where support (like a report) was multiple pages, we just numbered the first one and then had 1/5, 2/5, 3/5 on subsequent pages. We just signed the first one with our initials, date, (all).

Log in to reply