# Audit evidence, sampling and workpapers A screenshot, explanation or automated report cannot answer every question by itself. In Harbor’s payment audit this guide shows which record supports which claim, how to reproduce sample selection and how to bound conclusions. Numeric examples are fictional; no real employee, customer or payment data is requested. Workpapers are blank tools for recording reasoning, not ready-made audit conclusions. Original SecNet educational content with fictional examples, not publication/endorsement by referenced organizations. Page exercise choices last only for the open session; no real organizational data is collected. 2026.10 · 2026-10-23 ## What should I do tomorrow? 1. Describe one report’s query, population unit and period boundaries. 2. Record where one judgmental sample cannot be extrapolated. 3. Link one test result to a criterion and controlled evidence reference. ## Concepts **Evren** — All records defined for the question and period. **Evren uzlaştırması** — Checking consistency of sources, filters, scope and counts. **Amaçlı örnekleme** — Selection by risk or characteristics that alone does not support statistical extrapolation. **İstatistiksel örnekleme** — A method using probability selection and defined assumptions to evaluate uncertainty. **Kanıt izlenebilirliği** — Ability to trace a claim to source records, collection method and evaluation. **Sapma** — A verified sampled result that does not meet the defined criterion. ## Process map ### 1. Reconcile population Data owner + auditor Validate sources, period, filters, uniqueness and counts. Reproducible population definition. ### 2. Choose the method Auditor + relevant specialist Choose evidence and sampling for the question and claim. Justified method and limits. ### 3. Collect authorized evidence Authorized evidence custodian Protect minimum necessary data with provenance and access records. Controlled evidence reference. ### 4. Test and corroborate Audit team Evaluate results against criteria and resolve conflicts. Results, conflicts and limitations. ### 5. Review and hand over Reviewing auditor Compare claims with evidence chains and coverage. Traceable conclusion or candidate finding. ## First state the claim being tested Harbor’s policy requires a second approval for every payment. Seeing the policy establishes a design expectation, not that every payment received it. A current role screen supports configuration at that moment. A period-wide operating claim needs transaction time, file identity and the relationship between preparer and approver. A well-presented report does not prove completeness or accuracy of its underlying data. Record interview statements separately and identify corroborating records. Blocking a second approval by the same actor in an authorized test environment observes behavior; alone it cannot establish production operation over the whole period. Separating design, implementation and operation also reduces unnecessary collection. Attach the question answered to each evidence request. - [ ] Each evidence request maps to a specific claim and period. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## Investigate completeness before sampling The fictional source has 1,200 payment events while the first export has 1,180 rows. The difference of 20 may reflect cancellations, retries or an incomplete export; it is not yet explained. Do not delete unexplained rows to force agreement. Check query, timezone, period boundaries, environment, file key and status filters. Two events for one file are not necessarily two independent payments. Define the unit: payment file, approval event or user account. Then reconcile using independent totals or a controlled query. A boundary-day record may fall on the previous day in another timezone. Assess missing periods and unknown statuses before selection. A very large sample cannot by itself repair an unvalidated population. - [ ] Population unit, filters and the status of the 1,200/1,180 discrepancy are visible. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Do not present judgmental selection as statistical assurance Harbor may select 12 files involving holidays, administrator accounts and urgent payments. This judgmental selection explores important failure paths without yielding a confidence level or population error rate. Random selection alone is also insufficient: design the sampling unit, population completeness, target deviation, accepted uncertainty and evaluation method. This guide prescribes no universal sample size. If 2 of 12 judgmentally selected files lack second approval, two verified deviations were observed in the selected files. The 2/12 = 16.7% figure describes that selected group; it is not a company-wide error estimate or statistical confidence interval. Do not minimize the exceptions or exceed their scope. Justify any expanded selection, other strata or suitable full-population analysis separately. Claims supported and unsupported in the fictional example | Observation | Supported statement | Unsupported statement | | --- | --- | --- | | 2 deviations in 12 judgmental files | Two verified exceptions in the selected group | 16.7% company-wide error | | Current role screen | Configuration at the observed time | Year-round operation | | Matching SHA-256 digest | Sameness of compared bytes | Complete and accurate source data | - [ ] Selection method, rationale and extrapolation limits accompany results. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## A file hash does not prove source truth Evidence records include source, authorized producer, collection time, query/filter version, period, access class and a controlled-storage reference. A SHA-256 digest helps check whether the same bytes were preserved later. Alone it does not prove that the original data was true, complete or produced by the claimed person. Validate provenance and extraction separately. Keep the controlled original and link analysis or masked copies as separate versions. Minimize data from the start rather than collecting unnecessary personal fields and forgetting them. Organizational obligations and authorized schedules determine retention; no fixed number of years is supplied here. A legal hold requires separate authorized review of routine deletion. This teaching page is not an evidence-upload repository. - [ ] Digest, provenance, transformation and access records are distinct. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Do not average away conflicting evidence A Harbor screen shows the same person as preparer and approver; the owner says it is a service-account label. Before a dispute of opinion, this is an identity-mapping question. Compare raw actor IDs, delegation records, directories and timelines under controlled access. A senior person’s explanation does not override evidence, and a raw record should not be detached from context. When resolving a conflict, explain why a record is stronger and which limits remain. Predefine scope and stop conditions for authorized tests. Do not generate evidence through real production payments. Unresolved records may leave a conclusion uncertain: report impact and further work rather than discarding an inconvenient record. Workpapers do not invent assumptions to create certainty. - [ ] Conflicts have a validation path, resolution or recorded uncertainty. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Let another reviewer follow the reasoning chain A good workpaper is more than attachments. Include engagement/question IDs, criteria, population, selection reproducibility, procedures, expected/observed behavior, references and conclusions. For Harbor file PAY-17, explain why second approval is considered absent and identify the applicable rule and record fields. Two identical names alone do not establish the same actor and file relationship. The reviewer checks reproducibility and conclusion boundaries. Preparation and review must reflect real evaluation rather than ceremonial signatures. Later work retains its date and version instead of appearing to have existed earlier. Conclusions must match evidence and exclude unreviewed systems from positive assurances. - [ ] Another reviewer can trace question, criterion, selection, test and conclusion. Reference: [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011), [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) ## Validate facts before turning an exception into a finding Investigate whether a candidate exception is a true criterion failure, faulty data or another authorized process. A Harbor record may belong to a test environment and have entered the production population incorrectly. Examine the remaining missing approval’s business effect without asserting an actual payment error or abuse without evidence. Separate observed facts from possible risk. Hand verified observations to the findings guide with criteria, condition, evidence, scope and open questions. If no deviations were observed, report the test result and its limits rather than elimination of all fraud risk. Address causes and corrective actions with management next. Assign access and distribution classifications separately to evidence and reporting copies. - [ ] Facts, potential effects and unknowns are distinct, with traceable handoff. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## Common mistakes and better approaches **A large sample fixes an incomplete population.** — Investigate source and scope differences first. **A screenshot proves the whole year.** — Distinguish point-in-time configuration from period operation. **SHA-256 proves the file is true.** — Separate byte integrity from provenance and accuracy. ## Decision examples and explained answers ### 1,200 events, 1,180 rows The fictional source shows 1,200 events; the export contains 1,180 rows for an unknown reason. **Ignore the missing 20 and select a large sample.** — Revisit A large sample cannot restore excluded records. Cancellations or retries are not yet established; an unexplained gap must not be presented as clean data. **Reconcile units, filters and period boundaries.** — Supported approach Explaining the difference defines the records to which selection applies. If gaps remain unresolved, keep the test and conclusion limitations explicit. ### Two deviations in 12 files Two of 12 files selected judgmentally for high-risk features do not meet the rule. **Report the company-wide error rate as 16.7%.** — Revisit The 2/12 ratio describes the selected group. A statistical population estimate without a probability design and appropriate assumptions creates false certainty about coverage. **Report the two deviations and selection limits; justify further work.** — Supported approach Reporting sample limits without hiding the observed problem supports a sound decision. Further strata or population analysis can follow the failure mechanism without prejudging wider results. ### The digest matches The SHA-256 digest matches the delivered copy, but the source query and filters are unknown. **Matching digest proves complete and accurate evidence.** — Revisit A digest supports sameness of compared bytes. A faulty or incomplete extraction can retain the same digest, so accuracy and completeness require separate support. **Validate byte integrity separately from provenance and scope.** — Supported approach Collection method, authorized producer and filter validation establish which claim the file supports. Record limitations if sufficient information remains unavailable. ## Official references - [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011) — Official scope and edition record for the May 2026 guidance standard. This package does not reproduce its text or a licensed checklist; ISO 19011 is not itself a certification standard. - [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) — Official entry point for professional standards effective 9 January 2025. These original workpapers are not an IIA publication, authorization or professional credential. - [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) — Reference for control-assessment methods; the publication page’s 2025 Release 5.2.0 update was also checked. Examples are not a NIST assessment or automated compliance decision. - [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) — Dated foundational reference for planning, authorization boundaries and analysis of technical assessments. Historical tool examples are not treated as current tool recommendations.