Generate an Excel workbook for IT services and SaaS internal audit: subscription billing, project delivery, cloud spend, access, releases, export evidence, payroll, contractors, IP and support controls.
| Area | Risk | Control | Test | Evidence | Cadence |
|---|---|---|---|---|---|
| Subscription revenue billing | MRR/ARR, licence counts, upgrades, downgrades, credits or renewals are billed or recognised from incomplete contract and usage evidence. | Approved contract master, plan-change workflow, usage-to-billing reconciliation and credit note approval. | Trace customers from order form to subscription master, usage, invoice, credit note and collection proof. | Order form, MSA, subscription master, usage report, invoice, credit note, ticket and collection proof. | Monthly |
| Project milestones timesheets | Fixed-fee, T&M or milestone revenue is billed without delivery acceptance, time evidence or contract support. | Project code setup, milestone acceptance, timesheet approval and revenue cut-off review. | Match project invoice to SOW, milestone sign-off, delivery evidence, approved timesheets and rate cards. | MSA/SOW, project plan, acceptance, timesheet, rate card, invoice, WIP report and deferred revenue working. | Monthly |
| Customer onboarding collections | Customers are onboarded, provisioned or extended credit without approval, contract checks, tax setup or collection follow-up. | Customer master approval, contract/legal review, tax setup, credit terms approval and ageing review. | Review customer setup, contract approvals, tax fields, receivable ageing, write-offs and service suspension evidence. | Customer master, contract approval, tax setup, credit approval, ageing, collection proof and write-off note. | Monthly |
| Cloud tooling vendor spend | Cloud, SaaS tools, APIs, licences or contractors are procured and consumed without approval, allocation or renewal review. | Cloud budget, cost tags, vendor onboarding, renewal calendar and idle-resource review. | Reconcile cloud invoices to usage tags, review spend spikes, idle resources, unused licences and vendor renewals. | Cloud invoice, usage export, tag report, budget approval, vendor master, contract and renewal tracker. | Monthly |
| Change release incidents | Production changes, hotfixes, deployments or incidents bypass approval, testing, rollback and closure evidence. | Change ticket workflow, code review, CI/CD approval, release checklist and incident post-mortem. | Sample deployments to tickets, approvals, test results, release notes, emergency changes and incident closure. | Change ticket, pull request, CI/CD log, test result, release note, incident ticket and rollback log. | Weekly / Monthly |
| Logical access data security | Employees, contractors, vendors or bots retain excessive access to code, production, customer data, finance systems or cloud consoles. | Role-based access, joiner-mover-leaver control, privileged review, MFA and audit-log monitoring. | Match users to HR/vendor lists, review leavers, admin activity, shared IDs, service accounts and privileged roles. | User list, HR/vendor list, role matrix, leaver report, admin log, MFA report and access review sign-off. | Monthly / Quarterly |
| GST export LUT SEZ STPI | Export invoices, LUT, SEZ/STPI/Softex support, forex realisation or GST return mapping are incomplete or inconsistent. | Export invoice review, LUT tracker, SEZ/STPI/Softex file and FIRC/BRC reconciliation. | Match export invoices to contract, LUT, SEZ/STPI/Softex record where applicable, receipt realisation and GST returns. | Export invoice, contract, LUT, SEZ/STPI/Softex record, FIRC/BRC, bank advice and GST return working. | Monthly / Quarterly |
| Payroll contractors IP | Engineering payroll, contractors, bonuses, reimbursements or IP assignments are unsupported or not allocated to projects. | HR master, contractor onboarding, timesheet allocation, reimbursement policy and IP assignment evidence. | Match payroll and contractor payments to HR/vendor records, deliverables, timesheets, TDS and IP documents. | HR master, contract, timesheet, deliverable, bank proof, TDS support, IP assignment and confidentiality agreement. | Monthly |
| Support SLA data retention | Support, SLAs, service credits, refunds, uptime reports or data-retention commitments are not governed or evidenced. | SLA tracker, support escalation workflow, credit/refund approval and data retention/deletion control. | Review SLA exceptions, support closure, service credits, refunds and retention/deletion tickets. | Support ticket, SLA report, credit/refund approval, customer communication, deletion ticket and audit log. | Monthly |
Use this with the IT services internal audit checklist, the ITGC checklist and the monitoring rules repository.
SaaS internal audit is strongest when commercial, system and finance evidence are tested together. The workbook connects contracts, subscription masters, usage, invoices, cloud bills, access logs, deployment records, export evidence and support tickets to practical RCM rows.
The Excel export gives auditors separate sheets for engagement scope, RCM rows, subscription billing, project delivery revenue, cloud/vendor spend, access/release testing, export/GST evidence and monitoring exceptions. Tailor it to the entity business model and approved audit scope.
A CA firm is reviewing a software company with SaaS subscription revenue, implementation projects, cloud hosting costs and export customers.
