{"id":890,"date":"2020-01-22T13:40:05","date_gmt":"2020-01-22T13:40:05","guid":{"rendered":"https:\/\/alminawi.com\/?p=890"},"modified":"2025-12-07T18:21:33","modified_gmt":"2025-12-07T18:21:33","slug":"tts-series-e-internal-audit-fieldwork-and-evidence-collection-episode-05-document-review","status":"publish","type":"post","link":"https:\/\/e.americanpro.org\/?p=890","title":{"rendered":"T&#038;Ts Series E, Internal Audit, Fieldwork and Evidence Collection, Episode 05: Document Review"},"content":{"rendered":"<p data-start=\"99\" data-end=\"677\"><strong data-start=\"99\" data-end=\"135\">1. Introduction to the Technique<\/strong><br data-start=\"135\" data-end=\"138\" \/><strong data-start=\"138\" data-end=\"157\">Document review<\/strong> is one of the foundational techniques in internal audit. It involves examining policies, procedures, reports, contracts, records, logs, and other formal documentation to validate that processes are designed and operating as intended. For internal auditor <strong data-start=\"413\" data-end=\"422\">Auren<\/strong> at <strong data-start=\"426\" data-end=\"439\">ACME Corp<\/strong>, reviewing documents helps build a fact-based understanding of control design, regulatory compliance, and operational consistency. This technique is often used alongside interviews, walkthroughs, and observations to triangulate evidence.<\/p>\n<p data-start=\"679\" data-end=\"824\"><strong data-start=\"679\" data-end=\"737\">2. Template for Applying the Document Review Technique<\/strong><br data-start=\"737\" data-end=\"740\" \/>Auditors can use the following structured approach when conducting document reviews:<\/p>\n<ul data-start=\"825\" data-end=\"1493\">\n<li data-start=\"825\" data-end=\"931\">\n<p data-start=\"827\" data-end=\"931\"><strong data-start=\"827\" data-end=\"851\">Identify Objectives:<\/strong> Define what process or control is being reviewed and what documents are needed.<\/p>\n<\/li>\n<li data-start=\"932\" data-end=\"1044\">\n<p data-start=\"934\" data-end=\"1044\"><strong data-start=\"934\" data-end=\"955\">Gather Documents:<\/strong> Request policies, logs, forms, approvals, contracts, reports, etc., from process owners.<\/p>\n<\/li>\n<li data-start=\"1045\" data-end=\"1159\">\n<p data-start=\"1047\" data-end=\"1159\"><strong data-start=\"1047\" data-end=\"1075\">Review for Completeness:<\/strong> Check if documents are recent, signed, and meet compliance or procedural standards.<\/p>\n<\/li>\n<li data-start=\"1160\" data-end=\"1282\">\n<p data-start=\"1162\" data-end=\"1282\"><strong data-start=\"1162\" data-end=\"1185\">Trace and Validate:<\/strong> Compare documented procedures with actual operations (e.g., through observation or system data).<\/p>\n<\/li>\n<li data-start=\"1283\" data-end=\"1391\">\n<p data-start=\"1285\" data-end=\"1391\"><strong data-start=\"1285\" data-end=\"1318\">Note Gaps or Inconsistencies:<\/strong> Look for outdated forms, missing approvals, or unclear responsibilities.<\/p>\n<\/li>\n<li data-start=\"1392\" data-end=\"1493\">\n<p data-start=\"1394\" data-end=\"1493\"><strong data-start=\"1394\" data-end=\"1421\">Summarize Key Findings:<\/strong> Organize and record the reviewed materials in the audit working papers.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"1495\" data-end=\"1834\"><strong data-start=\"1495\" data-end=\"1563\">3. Practical Example: Reviewing ACME\u2019s Vendor Onboarding Process<\/strong><br data-start=\"1563\" data-end=\"1566\" \/><strong data-start=\"1566\" data-end=\"1579\">CEO Liora<\/strong> receives a whistleblower complaint alleging favoritism in vendor selection. She assigns <strong data-start=\"1668\" data-end=\"1677\">Auren<\/strong> to perform a focused audit on the <strong data-start=\"1712\" data-end=\"1741\">vendor onboarding process<\/strong>. Auren starts with a <strong data-start=\"1763\" data-end=\"1782\">document review<\/strong> to understand how vendors are approved and tracked.<\/p>\n<ul data-start=\"1836\" data-end=\"2237\">\n<li data-start=\"1836\" data-end=\"1955\">\n<p data-start=\"1838\" data-end=\"1955\"><strong data-start=\"1838\" data-end=\"1852\">Objective:<\/strong> Assess whether ACME\u2019s vendor onboarding controls are documented, followed, and support fair selection.<\/p>\n<\/li>\n<li data-start=\"1956\" data-end=\"2237\">\n<p data-start=\"1958\" data-end=\"2052\"><strong data-start=\"1958\" data-end=\"1979\">Document Request:<\/strong> Auren asks <strong data-start=\"1991\" data-end=\"2015\">Project Manager Aven<\/strong> and the Procurement Lead to provide:<\/p>\n<ul data-start=\"2055\" data-end=\"2237\">\n<li data-start=\"2055\" data-end=\"2103\">\n<p data-start=\"2057\" data-end=\"2103\">Vendor onboarding policy and procedure manual.<\/p>\n<\/li>\n<li data-start=\"2106\" data-end=\"2135\">\n<p data-start=\"2108\" data-end=\"2135\">Sample vendor applications.<\/p>\n<\/li>\n<li data-start=\"2138\" data-end=\"2170\">\n<p data-start=\"2140\" data-end=\"2170\">Approval workflows and emails.<\/p>\n<\/li>\n<li data-start=\"2173\" data-end=\"2208\">\n<p data-start=\"2175\" data-end=\"2208\">Conflict of interest disclosures.<\/p>\n<\/li>\n<li data-start=\"2211\" data-end=\"2237\">\n<p data-start=\"2213\" data-end=\"2237\">Vendor evaluation forms.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p data-start=\"2239\" data-end=\"2287\">As Auren reviews the documents, he notices that:<\/p>\n<ul data-start=\"2288\" data-end=\"2544\">\n<li data-start=\"2288\" data-end=\"2372\">\n<p data-start=\"2290\" data-end=\"2372\">The vendor policy hasn\u2019t been updated since 2020, despite a system change in 2023.<\/p>\n<\/li>\n<li data-start=\"2373\" data-end=\"2447\">\n<p data-start=\"2375\" data-end=\"2447\">Out of 10 vendor files, 4 are missing signed conflict of interest forms.<\/p>\n<\/li>\n<li data-start=\"2448\" data-end=\"2544\">\n<p data-start=\"2450\" data-end=\"2544\">One vendor was onboarded through a \u201cfast-track\u201d route that is not mentioned in the procedures.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2546\" data-end=\"2782\">Auren flags these inconsistencies and follows up with interviews. It turns out the fast-track route was introduced informally to speed up emergency sourcing during a supply chain crunch, but no policy revision or documentation was done.<\/p>\n<p data-start=\"2784\" data-end=\"3064\">In his audit report, Auren includes annotated extracts of the outdated policy, missing forms, and a timeline comparing documented versus actual onboarding steps. He recommends a formal policy update, centralized storage of vendor documentation, and training for procurement staff.<\/p>\n<p data-start=\"3066\" data-end=\"3329\" data-is-last-node=\"\" data-is-only-node=\"\"><strong data-start=\"3066\" data-end=\"3085\">Document review<\/strong>, when done systematically, provides the paper trail needed to identify gaps between policy and practice. For auditors like Auren, it\u2019s a powerful way to uncover control weaknesses, verify consistency, and support well-grounded recommendations.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction to the TechniqueDocument review is one of the foundational techniques in internal audit. It involves examining policies, procedures, reports, contracts, records, logs, and other formal documentation to validate that processes are designed and operating as intended. For internal auditor Auren at ACME Corp, reviewing documents helps build a fact-based understanding of control design, [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":825,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22],"tags":[],"class_list":["post-890","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tt-internal-audit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/e.americanpro.org\/wp-content\/uploads\/2025\/06\/GIF-04.gif","_links":{"self":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=890"}],"version-history":[{"count":1,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/890\/revisions"}],"predecessor-version":[{"id":1304,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/890\/revisions\/1304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/media\/825"}],"wp:attachment":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}