Audit evidence: received does not mean reviewed

A finance director should not have to act as the audit team’s memory. When a request list is poorly controlled, it can leave the finance team explaining where documents are, who received them and which question was answered last week.

The problem is not that auditors ask questions. Challenge and follow-up are necessary. The problem is asking for information again because the team has lost track of what it already holds.

Received is not the same as reviewed

I would expect one live request list, a named owner on each side and a status that distinguishes information received from information reviewed and queries cleared. An upload confirmation tells the client that a document arrived. It does not tell them whether the audit team has found it sufficient.

For important items, the list should also show the next step, its owner and how long the item has remained at that stage. That makes a stalled review visible before the deadline is close.

That distinction matters when the finance director is reporting progress to the board. A long list of documents marked “received” can conceal important questions that nobody has yet considered.

Make follow-up questions worth the interruption

Before contacting the client, the audit team should check the evidence already supplied and coordinate internally. A useful follow-up identifies the relevant schedule, explains the gap and makes clear what additional evidence is needed.

There will be legitimate reasons to revisit an answer: inconsistent evidence, a significant judgement or new information. Good request control supports that work. It does not replace professional scepticism or limit necessary audit procedures.

Before the next audit: ask who owns the request list and how reviewed items will be distinguished from uploads. That gives both teams a more credible view of progress than the number of documents submitted.

Further reading: What a well-run audit should do differently.