A file is not ready because every checklist row says done. It is ready when the scope, evidence, RCM, sampling, observations, report and ATR can be reviewed as one traceable internal audit file under the approved methodology.
Download the Excel/PDF pack before report issue. The workbook includes review gates, workpaper checks, observation-quality tests, AI-assisted workpaper checks and product-reuse fields for the future Internal Audit module.
Review question: Is the engagement linked to an approved audit universe, SOW, reporting line, exclusions and deliverables?
Authority / basis: Section 138, Rule 13, charter, SIA 220 and SIA 310
Common failure: Fieldwork starts from a generic checklist, with no documented scope lock or governance approval.
Review question: Are source reports, owners, due dates, extraction filters, row counts and alternate procedures documented?
Authority / basis: SIA 320 and SIA 330
Common failure: The file relies on screenshots, emails or verbal explanations without population completeness.
Review question: Does the walkthrough trace documents through the process before the RCM and samples are finalised?
Authority / basis: SIA 310, SIA 320 and SIA 330
Common failure: The RCM assumes controls exist but does not show how the process actually runs.
Review question: Do risks, controls, control objectives, tests, evidence and sample basis connect in one reviewable trail?
Authority / basis: SIA 120, SIA 310 and SIA 350
Common failure: Checklist rows are marked done but cannot be traced to a control, risk or evidence source.
Review question: Is the population, selection basis, replacement rule, deviation handling and reviewer conclusion documented?
Authority / basis: SIA 320, SIA 330 and SIA 350
Common failure: Testing says "sample checked" without explaining the population, selection logic or exception treatment.
Review question: Does each observation separate condition, criteria, cause, effect, recommendation, rating and response?
Authority / basis: SIA 360 and SIA 370
Common failure: The report lists operational complaints without root cause, risk impact, owner or target date.
Review question: Do the report, management response, audit committee summary and ATR carry the same observation IDs?
Authority / basis: SIA 370 and SIA 390
Common failure: Findings are issued, but follow-up cannot prove whether management action was implemented.
Review question: Are prompts, source data, human edits, reviewer overrides and final conclusions retained where AI was used?
Authority / basis: SIA 330, SIA 350 and firm methodology
Common failure: AI output is pasted into the file as if it were evidence or professional judgement.
Applicability note, charter reference, audit universe, annual plan, SOW and engagement timetable are present.
PBC tracker names report owner, source system, extraction date, filters, row count, due date and status.
Interviewees, systems, documents traced, control points and design gaps are recorded before testing.
Each risk has a control, objective, test, evidence expectation, frequency, owner and reviewer prompt.
Population, sample size, selection basis, replacement rule, deviations and conclusion are documented.
Every exception links to sample ID, evidence, owner explanation, auditor conclusion and issue handoff.
Rule logic, source fields, thresholds, exception count and false-positive clearing are retained.
Observations use condition, criteria, cause, effect, recommendation, rating, owner and target date.
ATR includes original action, revised dates, closure evidence, retest result and repeat-finding flag.
Prompt/output, source boundary, human review and final auditor judgement are retained when AI assisted drafting or analysis.
This website resource should stay independent from the product build. The reusable part is the structure: gates, review states, evidence requirements, blocker logic and reviewer conclusions that can later become workflow fields in the Internal Audit module.
Product shape: Engagement quality gate
Likely fields: Gate, owner, required evidence, blocker status, reviewer conclusion, override reason.
Product shape: File review queue
Likely fields: Workpaper area, prepared-by status, review note, return-to-preparer flag, clearance date.
Product shape: Issue validation workflow
Likely fields: Condition, criteria, cause, effect, recommendation, rating, response completeness, ATR link.
Product shape: AI evidence governance
Likely fields: Source document, prompt, model/tool used, human edit, reviewer override, final conclusion.
Lifecycle reference for where each review gate fits.
RCM source library that quality review should trace against.
Observation, report, response, ATR and follow-up formats.
Use when review identifies missing or weak evidence.
Use when review identifies uncleared exceptions or incomplete tests.
Use when observation severity is inconsistent or unsupported.
An internal audit quality review checklist is a manager or reviewer tool used before report issue to confirm that scope, evidence, RCM testing, sampling, observations, management responses and follow-up links are complete and traceable.
ICAI lists SIA 350 as the Standard on Internal Audit for Review and Supervision of Audit Assignments in its 2026 Standards on Internal Audit framework, alongside SIA 320 for evidence, SIA 330 for documentation, SIA 370 for reporting and SIA 390 for prior issue follow-up.
Yes. AI can help draft, summarise or compare, but the file should retain source data, prompts or tool output where relevant, human edits, reviewer overrides and the final auditor conclusion. AI output should not be treated as audit evidence by itself.
A review note should block issue when the scope is not approved, evidence is incomplete, sample conclusions are unsupported, ratings are inconsistent, management responses lack owner or due date, or observations cannot be traced back to tested exceptions.
