Audit Tips

The approach to substantiation should be consistent within each audit team

Team members should agree among themselves how substantiation will be done so as to ensure a consistent approach. Variance in how substantiation files are prepared may be confusing for reviewers and make for an inefficient review process. The use of standard templates for substantiation files is a good practice that promotes consistency in approach.

Substantiation should begin early in the audit process, as observations are made

As audit steps are completed and/or project reports prepared, footnotes and hyperlinks should be used to document the sources of evidence that support audit observations and conclusions. These notes can later be used to substantiate the audit report, thus accelerating the process. Notes should be as precise as possible (e.g. include the document name/number, page number, paragraph number, etc.).

Substantiation efforts should be proportional to risk levels

Once a first draft of an audit report is completed, initial judgements on which paragraphs or sections represent higher risks should be made and substantiation efforts directed at these on a priority basis. The level of effort and the degree of substantiation should vary in proportion with the risk inherent to each audit observation or conclusion. The more contentious, sensitive and highly visible an issue is, the stronger the evidence has to be.

Sufficient time should be allocated to complete adequate substantiation files

Preparing adequate substantiation files is a rigorous process that sometimes requires several weeks of work (because substantiation files need to reflect all changes made to the audit report as it is finalized, substantiation is an iterative process). As the substantiation files are crucial to support audit conclusions, sufficient time should be allocated for audit teams to complete them.

Sources of evidence used should be clearly identified

For each document used as evidence, auditors should ensure that there is a clear indication of the document’s name, date, and source, as well as the day on which it was received; this information should be entered in the audit management software used by the auditors. When provided with hard copies, writing this information on the documents before scanning them is a good practice, but modification of original documents should be limited to this information (comments and judgements should be recorded on a copy or in a separate document so as not to alter original documents).

Explanations and logic arguments should also be included in the substantiation files

In addition to the evidence needed to support factual statements, substantiation files should include the explanations and logic arguments that support the judgements, assumptions, observations and audit conclusions made by the audit team in its report.

Evidence should be presented in such a way that it is complete in itself and self-explanatory

When preparing substantiation files, auditors should ask themselves whether the information they put in the file is sufficient, easily understandable and readily available. Should an internal or external question arise (from Parliament, a legislative assembly, a municipal council, or an audit committee), would the information on file be adequate to enable the audit team to provide a prompt, complete response?

Auditors should present the strongest or best evidence first and then add supplementary sources where necessary. The information should be concise, succinct and clear.

Preparation and review of the substantiation files should be documented

Whether substantiation files are electronic or paper files, it should always be possible to rapidly identify who prepared substantiation for a paragraph or a section of an audit report and who reviewed it.

While audit management software may include fields for this information, it can also be useful to maintain a tracking list of all the paragraphs in a report, with columns to record the name of the preparer(s) and reviewer(s) and the date of approval. Such a list will provide assurance to the person in charge of the audit that all substantiation files have been prepared and reviewed.

Finally, the substantiation files should also contain evidence to the effect that the Quality Reviewer for the audit has reviewed the high-risk sections of the substantiation files.