Preparing for an audit, and what takes the time
Having a control and evidencing it are different jobs.
An audit is a test of evidence. Most businesses do have controls; what they cannot do is show that a control ran on a given day. Reconciliations with nothing attached, approvals given verbally, a close with no cut-off. Fix the evidence and the fieldwork stops being an excavation.
Work it out in a minute
Eighteen questions across six areas. Names the one weakness holding the others in place, and the first ninety days in order.
The plan
Do these six, in order
A time against each one and a way to tell it is finished.
Ask for last year's findings first
If there was a prior audit, the same points come back until they are fixed.
30 minutes · Done when every prior point has a status against it
Give every reconciliation a date and a reviewer
Preparer, reviewer, date, and the supporting document attached to it.
1 week · Done when a sample pulled at random has all four
Fix the close on a named day
The same business day every month, with a cut-off rule everybody applies.
2 months · Done when two consecutive closes landed on the day
Turn verbal approvals into a trace
Anything approved in a corridor. It does not need a system, it needs a record.
1 week · Done when an approval from last month can be produced without asking anybody
Write the judgments down
Revenue recognition, capitalization, provisions, anything with a choice in it.
half a day · Done when one page, dated before the period closes
Put one person on the request list
Track every request from arrival to answer, so nothing is sent twice or not at all.
ongoing · Done when the list shows what is outstanding and who has it
What fieldwork tests
Evidence, not intentions
A reconciliation that was performed and a reconciliation that can be shown are two different things. The second one has a date, a preparer, a reviewer and the supporting document attached to it.
A close that lands on a day
A named business day, the same one every month, with a cut-off nobody argues about. A close that drifts makes every period question harder to answer than it should be.
Approvals that left a trace
Verbal sign-off is a control that happened and cannot be tested. A trail in the system, even a simple one, converts it into something an auditor can sample.
One place the samples come from
Fieldwork is a list of requests. If each one means finding the person who knows, the audit runs on availability rather than on work.
The judgments written down
Revenue recognition, capitalization, provisions, anything with a choice in it. Written before the period rather than explained after it.
Somebody who owns the request list
One person tracking what was asked, what was sent and what is outstanding. Without it, the same document gets sent twice and a different one never gets sent at all.
What to do, and in what order
An audit is not an inspection of how you run the business. It is a test of whether the things you asserted can be evidenced. Almost every small company has controls. Rather fewer can show that a given control ran on a given day.
Then the approvals. Anything approved in a corridor is a control that happened and cannot be tested. It does not need a system; it needs a trace, consistently, so a sample can be pulled from it.
Questions we get
When should we start?
A quarter before fieldwork. The reconciliation history and the approval trail are the slow items and neither can be created retrospectively.
If the close is already landing on a set day, the work is much shorter.
Is this the same as an internal audit?
No. An internal audit tests your controls for you, before anybody external does.
This is preparation for somebody external, and the two fit together well.
Do you give an audit opinion?
No. Your auditor forms the opinion and that independence is the point of the exercise.
This is the operational side: having the evidence assembled and consistent before they start.
What holds up fieldwork most often?
Reconciliations with nothing attached, approvals that happened verbally, and a close with no agreed cut-off.
All three are about evidence rather than about whether the control exists.
More in the guides and every answer in one place.
Read next
Testing your own controls first, the standard somebody may ask for instead, and the close the whole thing rests on.
Shaheer leads the work, with engineers, writers, filers and analysts behind him. C-suite operations for a San Francisco AI company, Six Sigma on the process side, Anthropic certified on the Model Context Protocol, ten years across eight industries. See what we have built