Internal audit work papers a reviewer can sign
A work paper is the record of one test. A reviewer who was not in the room should be able to see the control, the sample, the evidence, and the conclusion without asking you to explain the file name.
Teams outgrow a shared folder when the reviewer cannot tell which version was signed, or when the evidence is an email that was never attached.
What each paper holds
- The control it tests, drawn from the register, not retyped.
- The objective, the population, the sample, and the period.
- The test performed, the exceptions, and the observation.
- The evidence files, attached to that paper.
- A preparer, and a reviewer who is a different person.
Review points stay on the paper
If the reviewer sends it back, the note stays with the paper. A cleared point is not deleted. That is the trail a quality review, or your external auditor, will ask for later.
Observations stay on the paper until you raise them. A raised observation becomes an internal audit finding only when it is agreed and given an owner and a date.
Where AI fits
AI can draft the test steps, read evidence against the control, and test a sample item by item. The output is a draft. The preparer edits it. The reviewer signs the paper, not the model. You can leave AI off.