Review of external auditor workpaper and report conclusions

Status: Live

If audits are outsourced, the organization will review if work papers disclose that specific program steps, calculations, or other evidence support the procedures and conclusions in the outsourced reports. [UCF ID 01200]

Supporting and supported controls

This control directly supports:

Review of external auditor outsourcing scope and work to be performed [UCF Control ID 01190]

There are no supporting controls.

Authority documents complied with:

FFIEC IT Examination Handbook – Audit, August 2003, Exam Tier I Obj 11.4; FFIEC IT Examination Handbook – Supervision of Technology Service Providers, March 2003, Pg 12; CobiT 4.1, ME2.6; Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004, Sched 1 ¶ 115

Banking and Finance Guidance

[Exam Tier I Obj 11.4, FFIEC IT Examination Handbook – Audit, August 2003]

The work papers should provide sufficient documentation for someone reviewing them to understand what was done, why it was done, and how the conclusions were reached from the examination. The work papers should contain only essential information that supports the conclusions, violations of laws or regulations, and any required corrective actions. [Pg 12, FFIEC IT Examination Handbook – Supervision of Technology Service Providers, March 2003]

General Guidance

The organization is called upon to assess the status of each external service provider’s internal controls. Confirm that external service providers comply with legal and regulatory requirements and contractual obligations. This can be provided by a third-party audit or obtained from a review by management’s internal audit function and the results of the audits. [ME2.6, CobiT 4.1]

Asia and Pacific Rim Guidance

During annual meetings, voting shareholders must be able to submit questions to the auditor or audit firm that are relevant to the content of the auditor's report or the conducting of the financial audit. The list of questions being asked to the auditor must be available to all annual meeting attendees. [Sched 1 ¶ 115, Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004]