Audit Prep Assistant

Audit Prep Assistant

Overview

Prepare comprehensive, organized documentation packages for audits across the CPG enterprise — including internal financial audits, external audits (Big 4), FDA/regulatory inspections, retailer compliance audits, and sustainability/ESG audits. This skill systematizes evidence gathering, gap identification, pre-audit self-assessment, and response preparation to minimize findings and demonstrate governance maturity.

When to Use

• Preparing for scheduled internal audit engagements
• External financial audit (SOX, Big 4) support
• FDA facility inspection preparation (FSMA, cGMP)
• Retailer quality/compliance audits (SQF, BRC, GFSI)
• ESG/sustainability audit preparation (GRI, SASB reporting)
• Regulatory agency investigation response
• Post-audit corrective action plan development
• Annual audit readiness assessment

Required Inputs

Methodology

Step 1: Audit Scope and Risk Assessment

Map the audit scope to your organization's risk and control landscape:

Audit Type Classification:

Pre-Audit Risk Heat Map: Identify areas of highest audit risk based on:

Score each factor 1-5 and compute weighted risk score. Areas scoring >3.5 require priority preparation.

Step 2: Documentation Inventory and Gap Analysis

Create a comprehensive inventory of required evidence:

Evidence Collection Framework:

For each auditable area:

Area: [e.g., Trade Spend Compliance]
Key Control: [What control should be operating?]
Evidence Required:
  1. Policy/Procedure: [Document name, version, date]
     Status: Current / Outdated / Missing
  2. Control Evidence: [What proves the control is operating?]
     Status: Available / Partial / Missing
  3. Transaction Testing: [Sample of transactions for testing]
     Status: Accessible / Needs preparation
  4. Monitoring Reports: [Ongoing monitoring evidence]
     Status: Up to date / Outdated / Not performed

Gap: [Description of any documentation gaps]
Remediation: [Action to close gap before audit fieldwork]
Owner: [Person responsible]
Due Date: [Must complete before fieldwork]

Common Documentation Requirements by Audit Type:

Step 3: Prior Findings Remediation Status

Review and update status of all prior audit findings:

Prior Finding Tracker:

| # | Finding | Original Date | Severity | Corrective Action | Status | Evidence of Closure |
|---|---------|--------------|----------|-------------------|--------|-------------------|
| 1 | [Finding text] | [Date] | High | [Action taken] | Closed/Open/In Progress | [Evidence ref] |
| 2 | ... | ... | ... | ... | ... | ... |

Summary:
  Total Prior Findings: XX
  Closed: XX (XX%)
  In Progress: XX (XX%)
  Open/Past Due: XX (XX%) ← HIGH RISK — auditors will focus here

For each Open/Past Due finding:
  - Root cause for delay
  - Revised completion date
  - Interim mitigating controls
  - Escalation status

Step 4: Control Self-Assessment

Conduct a pre-audit self-assessment to identify issues before the auditor does:

Self-Assessment Protocol:

1. Walk-through testing: Walk through each key process with the process owner to verify the control narrative matches actual practice.

2. Sample testing: Select a small sample (5-10 transactions) from each auditable area and test:

   • Is the control operating as designed?
   • Is there evidence of the control operating?
   • Are exceptions identified and resolved?

3. Segregation of duties review: Verify no single individual can:

   • Initiate AND approve transactions
   • Record AND reconcile entries
   • Authorize AND execute payments

4. System access review: Verify:

   • Access rights match current roles (no terminated employees)
   • Admin/superuser access is appropriately limited
   • Access changes are documented and approved

Self-Assessment Results Template:

Control: [Control name/description]
Design Assessment: Effective / Needs Improvement / Ineffective
Operating Assessment: Effective / Needs Improvement / Ineffective
Sample Tested: X of Y transactions
Exceptions Found: X
Exception Rate: X%
Overall Status: Pass / Fail / Conditional Pass
Remediation (if needed): [Action, owner, date]

Step 5: Audit Day Preparation

Prepare the team for audit execution:

Logistics Preparation:

Audit Logistics Checklist:
  □ Conference room / workspace reserved for auditors
  □ System access provisioned (read-only for relevant systems)
  □ Wi-Fi credentials and building access arranged
  □ Key contact list provided to lead auditor
  □ Document request list (PBC list) responses organized
  □ Interview schedule coordinated with process owners
  □ Catering/hospitality arranged (if applicable)

Team Preparation:

Interview Preparation Guidelines:

DO:
  ✓ Answer questions directly and truthfully
  ✓ Provide evidence when available
  ✓ Say "I don't know, but I'll find out" if uncertain
  ✓ Take notes on questions asked
  ✓ Follow up promptly on open items

DON'T:
  ✗ Volunteer information beyond the question asked
  ✗ Speculate about areas outside your responsibility
  ✗ Argue with the auditor's interpretation
  ✗ Provide draft or unapproved documents
  ✗ Make commitments without consulting the audit coordinator

Step 6: PBC (Prepared by Client) List Management

Organize the document request list systematically:

PBC Tracking Matrix:

| # | Document Requested | Audit Area | Owner | Status | Due Date | Notes |
|---|-------------------|-----------|-------|--------|----------|-------|
| 1 | Q1-Q4 Trade Spend Approvals | Trade Compliance | [Name] | Complete | [Date] | Uploaded to portal |
| 2 | Vendor Master Change Log | Procurement | [Name] | In Progress | [Date] | Extracting from ERP |
| 3 | HACCP Plan (current) | Food Safety | [Name] | Complete | [Date] | v4.2, dated MM/DD |

Summary:
  Total Items Requested: XX
  Provided: XX (XX%)
  In Progress: XX (XX%)
  Not Yet Started: XX (XX%)
  Cannot Provide: XX (XX%) — document reason for each

Step 7: Post-Audit Response Strategy

Prepare for responding to draft findings:

Finding Response Framework:

For each draft finding:

Finding: [Auditor's finding text]
Factual Accuracy: Agree / Partially Agree / Disagree

If Disagree:
  Counter-evidence: [Specific evidence that contradicts the finding]
  Proposed revision: [Suggested rewording if partially disagree]

If Agree:
  Root Cause: [Why the gap exists]
  Corrective Action Plan:
    Immediate: [Action within 30 days]
    Systemic: [Process/system change within 90 days]
  Owner: [Name and title]
  Target Date: [Realistic completion date]
  
Severity Negotiation:
  Auditor's rating: [Critical / High / Medium / Low]
  Your assessment: [Your proposed rating with rationale]
  Compensating controls: [Controls that mitigate the risk even without the primary control]

Output Specification

# Audit Preparation Package — [Audit Type] [Period]

## Audit Overview
- **Type**: [Internal / External / Regulatory / Retailer]
- **Auditor**: [Firm or team name]
- **Scope**: [Areas covered]
- **Period**: [Time period under audit]
- **Fieldwork Dates**: [Start - End]

## Pre-Audit Risk Assessment
[Heat map of auditable areas by risk score]

## Prior Findings Status
| Status | Count | % |
|--------|-------|---|
| Closed | XX | XX% |
| In Progress | XX | XX% |
| Open/Past Due | XX | XX% |

[Detail on open/past due items with remediation plans]

## Documentation Readiness

| Area | Policy Current? | Evidence Available? | Self-Assessment | Gaps |
|------|----------------|-------------------|----------------|------|
| [Area 1] | ✅ | ✅ | Pass | None |
| [Area 2] | ✅ | ⚠️ Partial | Conditional | [Gap description] |

## PBC List Status
[Tracking matrix with completion percentages]

## Self-Assessment Results
[Control-level results with exception rates and remediation actions]

## Team Assignments
[RACI matrix for audit support]

## Key Messages for Auditors
[Top 3-5 themes to emphasize during opening meeting and interviews]

## Risk Mitigation Actions (Before Fieldwork)
1. [Action with owner and deadline]
2. [Action with owner and deadline]

## Post-Audit Response Plan
[Strategy for managing draft findings and severity negotiations]

Analysis Framework

Audit Readiness Maturity Scale:

Example

Input: "Internal audit is scheduled in 3 weeks to review trade spend compliance for Q1-Q3. Last audit had 4 findings: 2 closed, 1 in progress, 1 open. We recently changed our trade spend approval system."

Analysis excerpt:

"Risk Assessment: ELEVATED due to (1) open prior finding, (2) system change during audit period, and (3) compressed preparation timeline. Priority actions for the next 3 weeks: Week 1: (1) Resolve the open prior finding or document interim compensating controls and revised target date. Auditors will focus heavily on repeat findings — an unresolved finding from the prior audit is the highest-risk item. (2) Document the system change: prepare a change management memo covering business justification, testing performed, parallel run results, and control continuity between old and new system. Week 2: (3) Conduct self-assessment on 20 trade spend transactions (10 pre-system change, 10 post) verifying approval authority, ROI documentation, and budget compliance. (4) Pre-stage the PBC list: pull all trade commitment approvals, promotional post-event analyses, and budget vs actual reports for Q1-Q3. Week 3: (5) Brief process owners — especially anyone who joined after the last audit. (6) Prepare opening meeting deck: lead with improvements made (2 prior findings closed, new system implemented) and proactively disclose the open finding with remediation plan. Key risk to manage: The system transition creates a natural control gap. Prepare a bridge document showing that no transactions fell through during the transition period by reconciling the old system's final approvals with the new system's initial transactions."

Guidelines

• Start preparation immediately upon audit notification — time is the most constrained resource
• Prioritize open prior findings — repeat findings indicate control environment degradation
• Self-assessment should be more rigorous than the audit itself — finding your own issues is far better than having them found
• Organize all evidence in a logical structure matching the audit scope — disorganized evidence suggests disorganized controls
• Never withhold known issues — proactive disclosure with a remediation plan is viewed favorably
• Train interviewees: answer the question asked, provide evidence, don't speculate
• The audit coordinator role is critical — assign someone with organizational knowledge and auditor relationship skills

Validation Checklist

• Audit scope mapped to risk and control landscape
• Pre-audit risk heat map completed with priority areas identified
• All prior findings reviewed with current remediation status
• Open/past due findings have documented escalation and interim controls
• Documentation inventory completed with gap analysis
• PBC list items tracked with completion status and owners
• Self-assessment conducted on high-risk areas with sample testing
• Segregation of duties and system access reviewed
• Team assignments and interview preparation completed
• Logistics arranged (workspace, access, schedule)
• Post-audit response strategy prepared
• Key messages for auditors defined and rehearsed