Audit workpaper review that reads every workpaper against the Standards before the manager opens it
Every workpaper reviewed against the Standards before the manager opens it, with sources.
See one case, screen by screen ↓Audit Workpaper Review gives internal audit a first-pass review of every workpaper and draft report before the audit manager opens them. Seven agents pin cited review notes to the paragraph, check each other, re-check every preparer answer against the evidence, write findings as condition, criteria, cause and effect, and tie the draft report to the file. The audit manager decides and signs; the QAIP lead and the CAE get their quality picture from the same notes.
How to choose AI solutions for back-office and enterprise work →
Updated
The Global Internal Audit Standards, in force since 9 January 2025, ask the supervisor to confirm that the workpapers adequately support findings, conclusions and recommendations (Standard 12.3), and the chief audit executive to review and approve the engagement documentation (Standard 14.6). In practice that is an audit manager reading every workpaper end to end, opening the evidence, typing review notes into a side panel, waiting for the preparer — and reading it all again.
The same gaps come back every quarter: a population pulled from a system report and never tied to an independent source, a conclusion stronger than the testing, an exception written up as “isolated” with no root cause, a sample size with no method behind it, an action in the report with no owner or date. A preparer marks a note “addressed” and nobody checks the answer but the manager. The QAIP sample finds the rest a quarter later, and the external assessor every five years.
Estimated split of the 2.1-hour baseline in the sample data and the 0.8-hour target, by hand and with the solution.
Seven agents review, check each other, re-check answers and draft findings; the audit manager signs off.
Kestrel & Vane Group’s internal audit team is closing engagement IA-26-14, Treasury payments and cash management; the draft report is due 30 October. Workpaper TR-04 concludes that controls over payment release “operate effectively”. Here is what happens next, screen by screen, in the working solution.
Last night Nadia told the agents: “Put Treasury first tomorrow, the draft report is due 30 Oct. Tell me what blocks it.” This morning they answer in the same thread: 14 workpapers wait for her, 41 notes are open, 6 preparer answers were re-checked overnight — 5 cleared, 1 reopened. What blocks the Treasury report is TR-04’s untied population, an exception with no root cause, and a draft report that says “4,800 payments”. Each point is cited and has one button: Open TR-04, Review F-03, Check the report.
“Two notes on TR-04 were withdrawn by the standards checker before they reached you; you can see why on the workpaper.”
Nadia types “Remind Jonas about his open notes”. The agents say exactly what they will do: send Jonas Whitfield one message, by email and chat, listing his open notes on TR-04 and on TR-10, each with the paragraph and the Standard it cites. Nothing is sent until she presses “Send the reminder”; “Not now” changes nothing, and the approval is recorded on the audit trail.
“Nothing is sent until you approve.”
TR-04 opens as a document with a reviewer’s margin. Two minutes after Jonas submitted it, the first-pass reviewer read it like a manager — objective, population, sample, testing, exceptions, conclusion — and wrote 9 notes in 7 minutes. The standards checker withdrew 2 it could not support, leaving 7, each classed and cited. The meter reads 4 of 7 cleared; 3 High notes are open. N1 is the key one: 20 payments were sampled from a register of 4,812 that was never tied to the bank statements.
“If the register is incomplete, payments outside it could never be selected, and the sample cannot support the conclusion in §7.”
“How the agent got here” shows every step: it read TR-04, opened the payment register export (4,812 rows, $1,941,306,220.14, six accounts), looked for a completeness tie-out and found none — the walkthrough TR-02 names the report but does not reconcile it. It checked Methodology 5.3 and Standard 14.1, the standards checker agreed, and it wrote the note at 94% confidence. Each citation opens its passage. The two withdrawn notes are listed with why: the risk-based sample size was right, and a “missing” tickmark was in Appendix A.
Below 70% confidence the reviewer asks the manager instead of writing a note.
On the same screen, viewing as the preparer, Jonas attaches “TMS-to-bank reconciliation Jan–Jun 2026.xlsx” and sends. The re-checker opens it and works in view: 4,812 payments, $1,941,306,220.14, agree to the bank statements; the 3 bank debits not in the register are bank fees, $1,650.00, each with fee code CHG; period and source checked. N1 clears and the meter moves to 5 of 7.
The re-checker never clears a note when the numbers do not tie or the answer is opinion — a statement without the reconciliation is reopened with RO-02 “Evidence incomplete”.
Item 9 — PAY-2026-021455, $186,400.00, approved and released by the same user — was written up as isolated. The finding writer searched the IT change log and found CHG-44817: on 9 March 2026 the releaser role was added to a payments analyst’s profile to cover a colleague’s leave, and not removed until 20 March. It checked the whole population: 3 payments, $412,950.00, in that window only. It drafted finding F-03 as condition, criteria, cause and effect, with the management action, owner and date, and asked Lucas Ferrand, Group Treasurer, to confirm the cause.
“The rating stays the auditor’s: High, per Methodology 8.2. The writer never changes a rating or a fact.”
Nadia approves F-03 with reason code FA-01, signed, and note N4 clears: 6 of 7. N2 — the conclusion is stronger than the testing — depended on N1 and N4, so the reviewer re-tests it now and proposes a revised conclusion, cited to the population check, the reconciliation and Standard 14.5. She can accept it, edit it or reject it with a reason.
Proposed: “Controls over payment release operate effectively, except for a segregation-of-duties gap from 9 to 20 March 2026 that allowed 3 payments ($412,950.00) to be approved and released by one user (finding F-03).”
With 7 of 7 notes cleared, “Mark reviewed” unlocks — until then it says which notes are still open, and a preparer cannot use it at all. Nadia signs with RV-01 “All notes cleared”. The workpaper is signed by its supervisor under Standard 12.3 and the preparer can no longer change it.
“Signed as Nadia Okafor · Audit manager, Finance & Treasury · recorded on the audit trail.”
The report checker reads the draft report IA-26-14 against the workpapers and Standard 15.1. It finds the scope says “4,800 payments” where TR-04 says 4,812, finding F-02 has no owner or due date, and the overall rating “Satisfactory” sits beside a High finding — the rating matrix in Methodology 8.2 says “Needs improvement”. F-03, written as one paragraph, is already rewritten in four parts. Each change is proposed with its source; Nadia applies, edits or rejects it.
The report checker never edits the report; it proposes each change.
The QAIP sampler reads the 31 engagements closed in Q3 — 744 workpapers — and proposes 8, each with the reason it was picked: a high-risk area, an external auditor relying on the work, a preparer in a first year averaging 5.1 notes per workpaper, a Topical Requirement in scope, and one pick at random. For each it pre-fills the checklist on seven Standards from the notes and sign-offs. Marta approves the sample and rates every engagement herself.
The QAIP sampler never rates conformance; the QAIP lead rates.
The same workpaper, seen by the five people who carry it — what their quarter looked like, and what it looks like now.
Seven agents review, check each other, re-check answers and draft findings; the audit manager signs off.
Reads each submitted workpaper like a manager and pins notes to paragraphs, each classed — unsupported conclusion, missing tickmark, sample not traced to population, finding without root cause, IIA standard nonconformance — cited and given a confidence.
Tests every note and workpaper against the Global Internal Audit Standards, the Topical Requirements and your audit methodology, and withdraws the notes it cannot support, with why.
Verifies each preparer answer against what was attached: ties the numbers, checks the period and the source, then clears the note or reopens it with a reason.
Rewrites findings as condition, criteria, cause and effect, looks for the cause in change logs and tickets, and sizes the effect on the whole population.
Ties every figure, date and rating in a draft report to its workpaper, and checks the Standard 15.1 elements — an owner and a date for every action — structure and tone.
Proposes a risk-based quarterly sample of closed engagements, weighing risk, preparer experience, notes history and external reliance, and pre-fills the conformance checklist from the notes and sign-offs.
Turns notes and reason codes into quality trends by note class and team, and drafts the CAE’s annual conformance statement from the record.
Sign off, with reason codes. The agents propose; a named person decides.
There is a conversation beside every item — Today, the workpaper, the finding, the draft report, the QAIP sample and the trends. Answers cite their sources; when you ask for something to be done, the agents say what they will do and wait for your approval.
What is blocking TR-04 from sign-off?
TR-04 has three notes open of seven. N1: the 4,812-payment register ($1,941,306,220.14) is not tied to the bank statements, so the sample of 20 cannot support the conclusion. N4: item 9 is called “isolated” with no root cause; the finding writer found change ticket CHG-44817 and drafted F-03. N2: the conclusion re-tests itself once N1 and N4 clear.
Were other payments affected?
The finding writer queried all 4,812 payments for the same user approving and releasing. Only 3 match, $412,950.00, all between 9 and 20 March 2026, the window of change ticket CHG-44817. None outside it. All 3 went to known vendors with matching invoices, so no loss is identified.
Which workpapers are past the review SLA?
Two, both in Vendor onboarding EMEA: VO-03 sanctions screening has waited 7 working days, and VO-02 new vendor due diligence reaches the 5-day SLA today.
Why was IA-26-05 picked?
IA-26-05 Capital projects, Linz was picked because its preparer is in a first year and its workpapers averaged 5.1 notes at first review, against 3.1 for the quarter. The sampler weighs risk, preparer experience, notes history and external reliance, and always keeps one pick at random. Marta Kowalczyk approves the sample and rates each engagement.
13 screens from the working solution, on its sample data. Pick one to see it large.
Note classes, thresholds, sample sizes, reason codes and roles are settings. Every change is a draft version the CAE approves before the agents use it.
| Setting | Default | Choose from |
|---|---|---|
| Note classes and the rules that raise them | R-1 population tied to an independent source · R-2 conclusion no stronger than the testing · R-3 tickmarks and legend · R-5 root cause and effect · R-6 sampling method, seed and size · R-7 preparer name, date and Topical Requirement applicability | Each rule on or off, severity High · Medium · Low |
| Write a note only above this confidence; below it, ask the manager | 70% | Any confidence, changed as a draft version |
| Send notes to the preparer without the manager first, at or above | 90% confidence | Any confidence, changed as a draft version |
| Tie-out tolerance for payment reconciliations | $0.00 · explained items allowed | Any amount, changed as a draft version |
| Re-run the first pass when a workpaper changes by more than | 10% of its text | Any share of the text |
| Sample sizes for tests of controls | Methodology table 5.4 — by how often the control runs and its risk | Low · Moderate · High risk, from annually to many times a day |
| Review SLA and escalation | 5 working days from submission · escalate to the CAE 2 working days past it | Working days, and a preparer reminder 3 days after a note is sent |
| Reason codes | Mark reviewed RV-01–03 · reject NR-01–04 · waive WV-01–02 · finding FA-01–03 · CAE approval CA-01–02 | Add a code for waiving or rejecting a note |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample engagement data · “target” = the design goal, measured in the live solution (the 2.1-hour baseline of manager review per workpaper is from the sample data) · “estimated” = our estimate · “typical” = published figures (Gartner survey of 161 chief audit executives, 10 Sep 2026 — 93% of audit functions use some AI, 15% have defined use cases; IIA Global Internal Audit Standards 2024, effective 9 Jan 2025 — Standards 12.3, 14.6 and 8.4, an external quality assessment at least once every five years). Kestrel & Vane Group and the people, engagements, workpapers, payments and vendors named on this page are fictional — characters and sample data in the working solution.
Audit Workpaper Review gives internal audit a first-pass review of every workpaper and draft report before the audit manager opens them. Seven agents pin cited review notes to the paragraph, check each other, re-check every preparer answer against the evidence, write findings as condition, criteria, cause and effect, and tie the draft report to the file. The audit manager decides and signs; the QAIP lead and the CAE get their quality picture from the same notes.
The first-pass reviewer reads the workpaper the way a manager would — objective, population, sample, testing, exceptions, conclusion — and opens every attachment. Each note is classed, pinned to its paragraph and cited to the Standard and your methodology paragraph, with a confidence. The standards checker then tests every note and withdraws those it cannot support before anyone sees them.
No. The re-checker opens what the preparer attached and verifies it — in the demo it tied 4,812 payments to the bank statements and explained the 3 differences as bank fees — before the note clears. An answer without the evidence is reopened with a reason. A manager can also waive a note, with a reason code.
No. The finding writer looks for the cause in the evidence, such as change tickets and logs, sizes the effect on the population and asks management to confirm the cause. It never invents a cause and never changes a rating or a fact; the significance rating stays the auditor’s.
Yes. The report checker ties every figure, date and rating in the draft report to its workpaper, checks that every action has an owner and a date under Standard 15.1, and flags a rating the rating matrix does not support. It proposes each change with its source; the manager applies, edits or rejects it. It never edits the report itself.
Every note, answer, decision and reason code becomes ongoing monitoring. The QAIP sampler proposes a risk-based quarterly sample with the reason for each pick and pre-fills the conformance checklist from the notes and sign-offs; the QAIP lead rates. The trend reporter drafts the CAE’s conformance statement from the record, and the chained audit trail exports as an evidence pack for the assessor.
Yes. Agents never edit a workpaper or report, never mark anything reviewed and never send anything to the board. Only the audit manager marks a workpaper reviewed and only the CAE approves engagement documentation, both with a reason code and a signature. Instructions to the agents are proposals that wait for a person’s approval.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your methodology, sample-size table, rating matrix and reason codes — and it goes live once every quality gate has passed. Setup connects your audit management system, loads and maps your methodology, and calibrates the agents blind on 20 workpapers your managers already reviewed before a pilot engagement; in the demo, agreement was 91%.
Every sample cited, re-performed and signed before your auditor asks.
1-min demoAudit Evidence CollectionEvidence checked before the auditor sees it, and the request list closed before fieldwork.
1-min demoContinuous Controls MonitoringControl failures found in a day, not at year-end, and every fix proved by a re-test.
1-min demoWe’ll run Audit Workpaper Review on workpapers your managers have already reviewed, and show you where the agents agree.