Prepare for an Audit Before Anyone Schedules One

• A readiness score answers whether the books could go to an auditor today, from eight signals: open anomalies, unexplained movements, control exceptions, attestation coverage, close status, depreciation posted, approval backlog and open review notes. It refuses to show a number when too little has been measured.

• The readiness score is recorded on a schedule, so readiness has a history, and a fall from one band to a worse one raises an alert.

• The readiness attestation and an internal control summary ship as sections of the pack itself, beside the statements they vouch for.

Readiness is not a feeling about the books; it is a score computed from them, with each of its eight signals shown beside it so the number is a worklist rather than a verdict. It is recorded on a schedule, so you can see it move, and a fall into a worse band tells someone. The attestation goes into the monthly pack, next to the statements it vouches for.

• Ten tests run over the ledger, for duplicates, Benford's law, round amounts, after-hours and post-close postings, self-posted entries, dormant accounts reactivated and concentration, plus checks across bills, payments, vendor bank changes and payroll.

• Every flag is dispositioned on the record, and a judgement goes stale on its own if the evidence under it changes.

• Proposed adjustments and the uncorrected-misstatement summary, review notes, sampling plans and sealed analytical reviews live beside the findings, not in a separate file.

• Period-over-period movements are explained inside the close, so the question an auditor asks in March is answered in the month it happened.

An auditor’s first afternoon is spent looking for duplicates, round numbers, entries posted after the period closed, and the one person who posts everything. Here those tests run over the ledger continuously, every flag is answered on the record, and an answer goes stale by itself if the evidence under it changes. Proposed adjustments, the uncorrected misstatement summary and the sampling plan live beside the findings. The movements that need explaining are explained in the month they happened.

• A control library with owners, attestations, exceptions and a deficiency schedule. An attestation, once signed, is reopened only with a written reason.

• Evidence bundles are signed when assembled, so an auditor can confirm nothing in them changed afterwards, and a period-scoped auditor package exports with its own seal.

• The books' tamper-evident seal is re-checked automatically on a schedule, and a break raises an alert rather than waiting to be discovered during an audit.

A control library with named owners, attestations that can only be reopened with a written reason, an exceptions log with a deficiency schedule, control testing, walkthroughs and a segregation-of-duties record. Evidence is bundled and signed when it is assembled, and the period-scoped package an auditor takes away carries its own seal. The books’ own tamper-evident record is re-checked every day, not discovered during fieldwork.

• Audits, reviews, agreed-upon procedures and diligence exercises are tracked as engagements, each with a period, a team, its own materiality and its own request list.

• One link for the whole engagement: every open request in one place, an upload against each item, and the answer filed as evidence. Reminders go out for what is due.

• Every document view and download is recorded on a tamper-evident log, so who saw what is a matter of record rather than of trust.

The audit is an engagement with a period, a team and a request list, and the request list is answered through one link: every open item in one place, an upload against each, and the answer filed as evidence with a reminder when it is due. Who opened what, and when, is a matter of record. “Did they receive the bank reconciliations?” stops being an email.

• History is never overwritten. Every record is sealed to the one before it, and a correction is a new entry that reverses the old one, so the original stays in the books.

• A closed period is locked at the point of entry: anything dated into it is refused outright, not flagged for someone to notice later.

• A period is signed off by a named approver before it can be locked, and reopening it revokes that sign-off — so a lock always stands on an approval somebody gave.

The question every audit procedure exists to approximate is whether the history has been edited. Here it cannot be: a correction is a new entry that reverses the old one, a closed period refuses anything dated into it, and a lock stands on a sign-off somebody actually gave. That is what turns sampling from a necessity into a formality.

An auditor works the trial balance in one place: what supports each line, where the gaps are, tickmarks against the lines they have tested, and a seal that freezes the schedule they concluded on under two signatures — against live records rather than exported spreadsheets.

The auditor does not only receive packages, evidence and answers from the system — they can work in it. The audit index walks the whole trial balance and says, line by line, what supports it and what does not; a line nobody has touched is the one thing no individual workpaper can show you, because there is no artifact to render for work that was never done. Tickmarks record what was tested, and a seal freezes the schedule under two signatures so a conclusion covers a population that cannot move afterwards.