# Audit Support Workpaper Requirements

> Sub-skill of audit-support: Workpaper Requirements (+2).

- Skill: `vamseeachanta/audit-support-workpaper-requirements` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vamseeachanta/audit-support-workpaper-requirements`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vamseeachanta/audit-support-workpaper-requirements/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: vamseeachanta (https://skillmd.com/u/vamseeachanta)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/vamseeachanta/audit-support-workpaper-requirements

---


# Workpaper Requirements (+2)

## Workpaper Requirements


Every control test should be documented with:

1. **Control identification:**
   - Control number/ID
   - Control description (what is done, by whom, how often)
   - Control type (manual, automated, IT-dependent manual)
   - Control frequency
   - Risk and assertion addressed

2. **Test design:**
   - Test objective (what you are trying to determine)
   - Test procedures (step-by-step instructions)
   - Expected evidence (what you expect to see if the control is effective)
   - Sample selection methodology and rationale

3. **Test execution:**
   - Population description and size
   - Sample selection details (method, items selected)
   - Results for each sample item (pass/fail with specific evidence examined)
   - Exceptions noted with full description

4. **Conclusion:**
   - Overall assessment (effective / deficiency / significant deficiency / material weakness)
   - Basis for conclusion
   - Impact assessment for any exceptions
   - Compensating controls considered (if applicable)

5. **Sign-off:**
   - Tester name and date
   - Reviewer name and date


## Evidence Standards


**Sufficient evidence includes:**
- Screenshots showing system-enforced controls
- Signed/initialed approval documents
- Email approvals with identifiable approver and date
- System audit logs showing who performed the action and when
- Re-performed calculations with matching results
- Observation notes (with date, location, observer)

**Insufficient evidence:**
- Verbal confirmations alone (must be corroborated)
- Undated documents
- Evidence without identifiable performer/approver
- Generic system reports without date/time stamps
- "Per discussion with [name]" without corroborating documentation


## Working Paper Organization


Organize testing files by control area:

```
SOX Testing/
├── [Year]/
│   ├── Scoping and Risk Assessment/
│   ├── Revenue Cycle/
│   │   ├── Control Matrix
│   │   ├── Walkthrough Documentation
│   │   ├── Test Workpapers (one per control)
│   │   └── Supporting Evidence
│   ├── Procure to Pay/
│   ├── Payroll/
│   ├── Financial Close/
│   ├── Treasury/
│   ├── Fixed Assets/
│   ├── IT General Controls/
│   ├── Entity Level Controls/
│   └── Summary and Conclusions/
│       ├── Deficiency Evaluation
│       └── Management Assessment
```