A firm's audit technology is a stack of tools in separate categories, each with its own job. Choosing well starts with naming the job, not the product. This article describes the categories, what each should do for an audit practice and a checklist to evaluate any tool.
The categories
Engagement and workpaper management
Holds the audit file: programs, workpapers, review notes, sign-offs, issue tracking and the engagement binder. Needs to support the firm's methodology, produce a dated review trail and lock the file at assembly. See audit file assembly and workpaper ownership.
Trial balance and financial statement preparation
Imports the client's trial balance, maps accounts, carries adjusting entries and produces statements and notes. Should roll forward balances, show adjusted and unadjusted columns and tie statements to the trial balance. See adjusted trial balance worksheet guide and tick and tie.
Confirmation platforms
Send and receive confirmation requests for banks, receivables, payables and debt, with an audit trail of who sent and who responded. See audit confirmations under AU-C 505.
Data analytics
Import general ledger and subledger data and run full-population tests, such as journal entry criteria, duplicates, gaps and sampling. See audit data analytics and journal entry testing.
Sampling
Selects and evaluates samples with documented parameters. Often part of an analytics or workpaper tool. See audit sampling methods.
Document collection and client portals
Request lists, upload tracking, version control and reminders. Should map to the PBC list. See PBC list.
Time, budget and billing
Records time, compares it to budget and produces invoices. See engagement economics.
Document management, secure transfer and storage
Stores records with access controls, retention rules and encryption. See audit record retention.
Quality management and compliance tracking
Tracks independence confirmations, CPE, peer review and the firm's quality management monitoring. See SQMS 1 monitoring and remediation and CPE planning.
Generative AI assistants
Draft, summarize and extract. Governed by the policy in using AI in workpaper preparation.
Collaboration and communication
Video, chat and file sharing. In remote models these carry client data, so vendor review applies. See remote and hybrid audit fieldwork.
Evaluation checklist
For any tool in any category, ask:
- Fit with methodology. Does it follow the firm's audit approach and the standards the firm applies, or does it force workarounds?
- Audit trail. Does it record who did what and when, and can that record be exported?
- Review support. Notes, sign-offs and rollover of open items.
- Integration. Does it exchange data with the accounting systems clients use, and with the firm's other tools?
- Security. Encryption in transit and at rest, multi-factor authentication, role-based access, logging and a clear data location. The FTC Safeguards Rule, as the FTC describes it, requires encryption of customer information, multi-factor authentication and oversight of service providers.
- Vendor oversight. Contract terms for safeguards, notice of incidents and handling of data at termination. See ET 1.150 third-party service providers.
- Data portability. Can the firm export its files in a usable form if it leaves? The firm owns the working papers and must retain them for the required period.
- Retention and lock. Can the file be locked after the assembly deadline and retained?
- Usability. Time to train a new staff member.
- Support and continuity. Vendor support and what happens if the vendor changes or fails.
- Cost model. Per user, per engagement or per client, and how it scales with the firm's growth.
- Peer review and inspection fit. Does it help produce what a reviewer asks for?
Selecting and rolling out
- Define the job and the pain. Write down the problem before looking at products.
- Run a pilot on a real engagement with a small team, and compare results with the current process.
- Check references from firms of similar size and practice.
- Review the contract for data ownership, security and termination.
- Plan training and migration, including how to handle open engagements.
- Record the decision with the evaluation and the reasons.
- Reassess annually as part of the firm's technology and quality reviews.
Avoiding gaps and overlaps
Draw the stack on one page before buying anything. For each audit phase, planning, risk assessment, fieldwork, completion and file assembly, list which tool holds the work, where the data comes from and where it goes next. Gaps show up as manual re-keying between tools, and overlaps show up as two tools holding competing versions of the same schedule. Fix the handoffs first. A firm with a few tools that exchange data cleanly will usually do better than one with many tools that need a person to move files between them.
Tools do not change responsibility
Software can speed work and improve consistency. The firm remains responsible for the audit, including the judgment about what the tool produced. A tool that automates a procedure does not replace the auditor's evaluation of the result. See workpaper automation: where it helps.
FAQ
Is an all-in-one platform better than separate tools?
It depends on the firm. One platform simplifies integration and training, and separate tools can fit specific needs better. Evaluate against the checklist.
Should staff be able to bring their own tools?
Only approved tools should hold client data.
Who decides?
A named partner with technology and quality input.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error