Internal audit checklist
Describe the process and its controls. Get a risk and control matrix or test workpaper.
Nothing sends until you start, and you can change anything afterwards.
What you get
- Text in the chat Copy it wherever you need it. Keep chatting to adjust the tone, length, or wording.
Templates
Internal audit checklist for purchasing
- A table of audit checks by area, with the evidence to inspect and a result column
- It treats only the facts you gave as existing controls
- A sample size range, with a note to follow your own audit method
Expense audit checklist
- A tick list with the evidence and test for each check
- Your receipt, approval and $60 meal rules stated as requirements, and other controls marked to confirm
- A note that the audit lead decides how serious any failure is
IT access review
- A fillable Excel checklist with 15 audit procedures
- Covers Okta sign-in, manager sign-off, leaver removal within 24 hours and admin approvals
- A findings log, and suggested tests marked as proposed, not as controls you already have
How it works
- Describe the process, the systems it runs on, and any controls you already have, or the control and the exceptions you found.
- askROI's Finance audit support tool derives the risks from your process against the financial statement assertions and builds the matrix, workpaper, deficiency evaluation, or PBC list, marking any control it proposes rather than one you described.
- Copy the tables into your workpapers or ask for a spreadsheet, or keep chatting to add a process, adjust a control, or move on to testing.
What people use it for
- SOX 404 scoping a risk and control matrix for a process, with key controls flagged and gaps where a risk has no control.
- Test planning a workpaper with one attribute per control step, a sample size by control frequency, and space for results and the conclusion.
- Exception follow-up weigh an exception by magnitude, likelihood, and compensating controls before you classify it.
- Audit preparation a PBC list that asks for specific evidence by process, owner, and due date.
Questions
How do I audit a document assistant's answer?
Test it like any other control: take a sample of answers, trace every claim, figure, and date back to the document it came from, and log each one the document does not support as an exception. askROI can draft that test as a workpaper: describe how the assistant's answers are produced and reviewed, and it returns the objective, one yes or no attribute per review step, a sample size based on how often answers are produced, and space for results, exceptions, and the conclusion.
What is in the risk and control matrix?
One row per risk with the process, the risk, the assertions it affects, the control and who performs it, whether it is preventive or detective and manual or automated, how often it runs, whether it is a key control, and how to test it. The risks come from the process you describe, not a fixed list, and IT general controls are included when systems are in scope.
Does it make up controls?
No. Controls you described are listed as they are. Where a risk has none, it proposes one and marks it as proposed, and a risk without any control is flagged as a gap.
Can it calculate an audit sample from a population file?
Not on this page. The workpaper uses common minimum sample sizes by control frequency. For a statistical sample size and a reproducible selection from your own CSV or Excel file, use the Data reports tool.
What does it not do?
It does not perform the audit, test your records, or give audit or financial advice. Its output supports your audit work, and a licensed CPA or qualified auditor should make the audit and compliance decisions.