Structured audit checklists to help auditors cover important risks, controls, evidence and red flags.
20 resources
Check that an engagement is ready for fieldwork: purpose linked to business risk, prior issues reviewed, risks and scope explicit, out-of-scope areas justified, and resources and timing realistic.
PDF • 6 Pages • Free
Start an audit with clear expectations: prepare scope and information requests, confirm roles and escalation points in the meeting, and document agreed dates, owners and scope changes afterwards.
PDF • 6 Pages • Free
Confirm how a process actually works before testing: trace a real transaction, watch each system step and hand-off, capture workarounds and overrides, then compare practice with policy.
PDF • 6 Pages • Free
Verify both control design and operating effectiveness — clear risk and owner, complete populations, tests beyond inquiry, meaningful review evidence, validated exceptions and a conclusion another auditor could reperform.
PDF • 6 Pages • Free
Test whether your evidence is relevant, reliable and sufficient — right period and population, credible sources, corroborated high-risk evidence, resolved conflicts and conclusions that do not exceed the evidence.
PDF • 6 Pages • Free
Cover the key procurement controls: supplier due diligence and competitive sourcing, approved requisitions and POs, evidenced receipt, invoice matching, and monitoring for split spend, duplicates and bank changes.
PDF • 6 Pages • Free
Check supplier creation, changes and maintenance: sponsored and validated vendors, maker-checker approval, independently verified bank changes, complete change logs, blocked dormant vendors and employee/vendor overlaps.
PDF • 6 Pages • Free
Review travel and expense controls end to end — realistic policy limits, pre-trip approval, complete receipts, substantive approver review, and analytics for duplicates, personal extensions and repeated overrides.
PDF • 6 Pages • Free
Check payroll from employee master data to payment: approved hires and changes, timely leaver removal, validated overtime and adjustments, reconciliations, independently approved payment files and reviewed system access.
PDF • 6 Pages • Free
Verify invoice processing and payment controls — controlled receipt, PO/receipt matching, justified non-PO invoices, independently reviewed payment runs, and analytics for duplicates, threshold payments and recent bank changes.
PDF • 6 Pages • Free
Check that fraud risk is assessed properly: schemes identified by process and asset, override and collusion considered, controls mapped to each scenario, and red-flag analytics, whistleblowing and investigation protocols in place.
PDF • 6 Pages • Free
Review segregation of duties end to end — risk-based conflict definitions, privileged and emergency access, users matched to current roles, tested compensating controls and remediation prioritized by business impact.
PDF • 6 Pages • Free
Verify access and core IT general controls: approved least-privilege access, prompt leaver removal, controlled privileged and service accounts, evidence-based access reviews, approved changes and tested backups.
PDF • 6 Pages • Free
Check inventory controls from receipt to write-off: matched receipts, physical security, authorized transfers, independent cycle counts, approved adjustments and destruction, and analytics on unusual movements.
PDF • 6 Pages • Free
Review sales and revenue controls — approved price and discount authority, controlled overrides and promotions, order-to-invoice matching, period-end cut-off, and analytics on discounts, credit notes and revenue trends.
PDF • 6 Pages • Free
Check customer credit and collections: verified customers, documented credit limits, enforced credit holds, timely cash application, risk-based collections, supported bad-debt provisions and reported concentration risk.
PDF • 6 Pages • Free
Audit third-party arrangements: risk-based due diligence, contracts with data protection and audit rights, measurable and validated SLAs, applied penalties, continuity and exit plans, and dependency oversight.
PDF • 6 Pages • Free
Review a report before issue: an executive summary that answers the objective, consistent conclusions, well-built and evidenced findings, actions that fix root causes, and checked names, figures and sensitive information.
PDF • 6 Pages • Free
Validate that agreed actions really work before closure — defined closure evidence, controls operating in practice, residual risk reassessed, partial completion not closed, and overdue high-risk actions escalated.
PDF • 6 Pages • Free
Audit store operations on site: cash counts and deposits, POS access, refunds, voids and discounts, inventory and shrink controls, price accuracy, staffing records, security and incident handling.
PDF • 6 Pages • Free