Is Your Documentation "Enough"? Three Questions to Bulletproof Your Work Papers

Back to Topics

A well-prepared work paper should answer three questions before an auditor ever asks them.

1. What were you trying to accomplish?
2. What information did you rely on?
3. What conclusion did you reach?

If your documentation cannot answer those three questions, it isn't complete — it leaves room for assumptions.

Effective internal control and lasting audit readiness are built on documentation. Good documentation tells the reader why the work was performed, where the information came from, and what decision was ultimately reached. Miss any one of those elements, and you've handed an auditor a blank space to fill in with assumptions.

Auditors are trained to be skeptical. When documentation leaves room for interpretation, they rarely interpret it in your favor.

First: State the Purpose Before You Start

Every work paper should begin by answering a simple question:

What am I trying to accomplish, and how will I know when I'm finished?

Are you calculating monthly depreciation for a specific asset class? Reviewing stale undelivered orders? Performing a fluctuation analysis? Whatever the objective, write it down before you review a single number.

Then define the criteria that will determine your conclusion.

If you're applying a threshold before posting an adjustment, document it before beginning the analysis. If you're performing a fluctuation analysis, identify whether your threshold is based on a dollar amount, a percentage, or both. If you're testing an entire population, such as a depreciation calculation, state that explicitly. "I reviewed everything" and "I reviewed a sample" are fundamentally different assertions, and the numbers alone don't communicate the difference.

Setting criteria after you've seen the results isn't analysis. It's rationalization.

Second: Document Where the Data Came From — and Why You Trust It

You know where your information originated.

Nobody else does.

Document it.

Did the information come from a standard system report or a custom query? If it was a query, what parameters did you use? Which system produced the data? What fund, account range, date range, or exclusions were applied? What was the report's as-of date?

These details establish the pedigree of your information and demonstrate that you know exactly what you relied upon.

Just as important, explain why the information is appropriate for your objective.

The Government Accountability Office (GAO) Green Book reinforces this expectation by requiring management to rely on quality information — information that is complete, accurate, relevant, current, accessible, and verifiable. Your work paper is where you demonstrate that expectation has been met.

There is also a practical benefit that has nothing to do with the audit.

Eleven months from now, you probably won't remember the exact report parameters you used. Neither will the person who eventually inherits your responsibilities. Documenting the report, the query, the parameters, and your rationale today prevents you from reverse-engineering your own work under deadline pressure a year later.

Information Produced by the Entity (IPE) and Information Used in Controls (IUC) deserve their own discussion. Both frequently become focal points during federal financial statement audits because auditors must establish not only where information originated, but whether it can be relied upon.

Third: Document the Result — Even When the Result Is "No Entry Required"

This is the step people skip most often.

When a journal entry is posted, the entry itself becomes part of the evidence that the work was performed.

But many federal accounting activities aren't guaranteed to produce an adjustment.

Consider a stale undelivered order review. You perform the analysis, apply the established criteria, and determine that no balances require deobligation.

No journal entry is created.

No accounting transaction occurs.

Without documentation, there is no evidence that the review ever happened.

A simple conclusion is enough:

"We reviewed undelivered orders as of June 30 using the criteria established above. No items met the threshold for deobligation. No adjusting entry was required."

That brief statement transforms an invisible activity into a documented internal control.

Whether your agency uses a journal entry cover sheet, a review memorandum, or a standardized work paper template, record the conclusion — including when the correct conclusion is that no action was necessary.

The objective isn't additional paperwork.

The objective is documenting a decision.

A decision that was never documented can look remarkably similar to a decision that was never made.

How the Three Pieces Work Together

When combined, these three elements tell a complete story.

• Here was my objective.
• Here were the criteria I established before beginning.
• Here is the information I relied upon, where it came from, and why I considered it reliable.
• Here is what the analysis concluded and the action I took — or why no action was required.

That is a process an auditor can evaluate without repeatedly asking clarifying questions.

It's also a process that survives staff turnover.

As experienced professionals retire and institutional knowledge leaves with them, well-documented work papers become one of the few assets that preserve how critical financial processes are actually performed.

Checklist: What Every Analytical Work Paper Should Contain

• A clearly stated purpose written before the work begins.
• The criteria, threshold, or level of precision that will drive the conclusion.
• The scope of the review (100 percent population, sample, or targeted review).
• The specific data source, including the system, report or query, parameters used, and as-of date.
• A brief explanation of why the information is complete, accurate, relevant, and appropriate.
• The results of the analysis.
• The action taken — including "No entry required," when appropriate — and the rationale supporting that conclusion.
• Preparer and reviewer signatures with dates.

None of these practices require new software, additional funding, or a larger staff.

They simply require documenting the thinking you're already doing while the work is being performed instead of trying to reconstruct it months later under audit pressure.

Audit readiness isn't measured by the volume of documentation an organization produces. It's measured by whether that documentation enables another professional to understand, evaluate, and defend the work without relying on institutional memory.

The views expressed in this article are those of the author and do not necessarily reflect the views of any employer, client, agency, or organization. Examples referenced are intended to illustrate broader work paper and documentation practices.