Audit Evidence Management
From Audit Testing to Findings: Managing Evidence and Documentation
In Risk-Based Internal Auditing, the credibility of audit findings depends on the quality and organisation of the supporting evidence. Auditors must collect, document, and evaluate information that demonstrates whether internal controls are operating effectively and whether risks are being properly managed.
Audit working papers provide the structured environment where this evidence is recorded. They document testing procedures, observations, supporting documentation, and conclusions, ensuring that audit findings are traceable, transparent, and defensible.
By maintaining clear and well-structured documentation, internal audit teams create a reliable audit trail that supports management reporting, regulatory reviews, and governance oversight.
Audit Documentation
The Role of Audit Working Papers in Internal Auditing
Audit working papers (also known as audit documentation) serve as the central repository for documentation gathered during an audit engagement. Governed by standards like ISA 230, they provide a transparent audit trail that details the planning, execution, and evidence-gathering phases of an audit.
Typically, audit working papers include:
• testing procedures performed during the audit
• supporting evidence such as reports, system data, or documentation
• observations and control evaluations
• conclusions that support audit findings
This documentation ensures that audit work can be reviewed, validated, and relied upon by senior management, regulators, or audit committees.
Evidence Collection
Documenting Audit Evidence
- Substantive Data: Transaction samples, financial statements, and general ledger extracts.
- Technical Artefacts: System-generated logs, SOC reports, and automated configuration settings.
- Governance Documentation: Formal policies, standard operating procedures (SOPs), and organisational charts.
- Inquiry & Observation: Documented interviews with process owners and walkthrough observations of live workflows.
- Testing Working Papers: Re-performance results and attribute testing sheets that validate control execution.
The Audit Reporting Process
Transforming Audit Testing into Actionable Findings
- Condition (The Issue): A factual description of the current state identified during testing.
- Criteria (The Standard): The policy, regulation, or KPI that the process should have met.
- Cause (Root Cause Analysis): The underlying reason why the control failed or the process gap exists.
- Consequence (Risk & Impact): The potential financial, operational, or reputational impact on the organisation.
- Corrective Action (Remediation): Specific, measurable recommendations to mitigate the risk and prevent recurrence.
Governance & Audit Oversight
Ensuring Transparency and Audit Traceability
- External Regulators: Such as the Financial Reporting Council (FRC) in the UK or the PCAOB in the US.
- Statutory Auditors: Ensuring that year-end financial statement audits can rely on internal work.
- Governance Bodies: Providing the Audit Committee and Board of Directors with confidence in the organisation’s Internal Control Environment.
Standardised documentation strengthens the reliability of internal audit conclusions and reinforces the overall corporate governance framework, ensuring accountability and institutional trust.
Audit Lifecycle
From Audit Findings to Remediation: Strengthening the Audit Lifecycle
Effective internal auditing does not end with identifying issues. Organisations must ensure that audit findings are translated into clearly defined actions that are tracked, monitored, and resolved to strengthen governance and reduce risk.
While audit working papers provide the structured repository for audit evidence and findings, the next stage in the audit lifecycle is ensuring that identified issues are addressed. Organisations must translate audit observations into clearly defined remediation actions that are monitored until completion.
Symbiant’s Audit Action Tracker supports this process by connecting audit findings with structured action management workflows. This ensures that remediation activities remain visible, accountable, and traceable throughout the organisation.
The Audit Action Tracker enables organisations to manage remediation activities in a structured and transparent way.
• Direct assignment of actions
Audit findings can be converted into remediation tasks and assigned to responsible action owners across the organisation.
• Role-based access
Users view only the actions relevant to their responsibilities, helping maintain a focused and manageable workflow.
• Evidence attachment
Action owners can upload documentation, such as updated procedures, system screenshots, or policy revisions, providing a complete audit trail of the remediation process.
Tracking remediation progress manually can be time-consuming and difficult to manage, particularly when actions are distributed across multiple departments.
Structured action tracking helps organisations:
• send automated reminders for upcoming or overdue actions
• highlight outstanding issues requiring attention
• maintain consistent oversight of remediation progress
These capabilities help internal audit teams reduce the administrative burden associated with manual follow-up.
Effective remediation tracking also supports stronger governance oversight by providing management and audit committees with clear visibility of outstanding issues.
• Live dashboards provide a real-time overview of open and completed actions
• Structured reports help demonstrate progress toward risk mitigation and control improvement
• Integrated insights can help identify recurring issues or systemic control weaknesses
Symbiant’s embedded AI Assistant can also support auditors by helping analyse findings, explore root causes, and surface connections between related risks, incidents, and controls. Importantly, all AI-generated insights remain subject to user review and approval.
