1. Introduction to the Technique
Document review is one of the foundational techniques in internal audit. It involves examining policies, procedures, reports, contracts, records, logs, and other formal documentation to validate that processes are designed and operating as intended. For internal auditor Auren at ACME Corp, reviewing documents helps build a fact-based understanding of control design, regulatory compliance, and operational consistency. This technique is often used alongside interviews, walkthroughs, and observations to triangulate evidence.
2. Template for Applying the Document Review Technique
Auditors can use the following structured approach when conducting document reviews:
Identify Objectives: Define what process or control is being reviewed and what documents are needed.
Gather Documents: Request policies, logs, forms, approvals, contracts, reports, etc., from process owners.
Review for Completeness: Check if documents are recent, signed, and meet compliance or procedural standards.
Trace and Validate: Compare documented procedures with actual operations (e.g., through observation or system data).
Note Gaps or Inconsistencies: Look for outdated forms, missing approvals, or unclear responsibilities.
Summarize Key Findings: Organize and record the reviewed materials in the audit working papers.
3. Practical Example: Reviewing ACME’s Vendor Onboarding Process
CEO Liora receives a whistleblower complaint alleging favoritism in vendor selection. She assigns Auren to perform a focused audit on the vendor onboarding process. Auren starts with a document review to understand how vendors are approved and tracked.
Objective: Assess whether ACME’s vendor onboarding controls are documented, followed, and support fair selection.
Document Request: Auren asks Project Manager Aven and the Procurement Lead to provide:
Vendor onboarding policy and procedure manual.
Sample vendor applications.
Approval workflows and emails.
Conflict of interest disclosures.
Vendor evaluation forms.
As Auren reviews the documents, he notices that:
The vendor policy hasn’t been updated since 2020, despite a system change in 2023.
Out of 10 vendor files, 4 are missing signed conflict of interest forms.
One vendor was onboarded through a “fast-track” route that is not mentioned in the procedures.
Auren flags these inconsistencies and follows up with interviews. It turns out the fast-track route was introduced informally to speed up emergency sourcing during a supply chain crunch, but no policy revision or documentation was done.
In his audit report, Auren includes annotated extracts of the outdated policy, missing forms, and a timeline comparing documented versus actual onboarding steps. He recommends a formal policy update, centralized storage of vendor documentation, and training for procurement staff.
Document review, when done systematically, provides the paper trail needed to identify gaps between policy and practice. For auditors like Auren, it’s a powerful way to uncover control weaknesses, verify consistency, and support well-grounded recommendations.