Audit evidence, sampling and workpapers

Harbor’s policy requires a second approval for every payment. Seeing the policy establishes a design expectation, not that every payment received it. A current role screen supports configuration at that moment. A period-wide operating claim needs transaction time, file identity and the relationship between preparer and approver. A well-presented report does not prove completeness or accuracy of its underlying data.

Record interview statements separately and identify corroborating records. Blocking a second approval by the same actor in an authorized test environment observes behavior; alone it cannot establish production operation over the whole period. Separating design, implementation and operation also reduces unnecessary collection. Attach the question answered to each evidence request.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗

The fictional source has 1,200 payment events while the first export has 1,180 rows. The difference of 20 may reflect cancellations, retries or an incomplete export; it is not yet explained. Do not delete unexplained rows to force agreement. Check query, timezone, period boundaries, environment, file key and status filters. Two events for one file are not necessarily two independent payments.

Define the unit: payment file, approval event or user account. Then reconcile using independent totals or a controlled query. A boundary-day record may fall on the previous day in another timezone. Assess missing periods and unknown statuses before selection. A very large sample cannot by itself repair an unvalidated population.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

Harbor may select 12 files involving holidays, administrator accounts and urgent payments. This judgmental selection explores important failure paths without yielding a confidence level or population error rate. Random selection alone is also insufficient: design the sampling unit, population completeness, target deviation, accepted uncertainty and evaluation method. This guide prescribes no universal sample size.

If 2 of 12 judgmentally selected files lack second approval, two verified deviations were observed in the selected files. The 2/12 = 16.7% figure describes that selected group; it is not a company-wide error estimate or statistical confidence interval. Do not minimize the exceptions or exceed their scope. Justify any expanded selection, other strata or suitable full-population analysis separately.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗

Evidence records include source, authorized producer, collection time, query/filter version, period, access class and a controlled-storage reference. A SHA-256 digest helps check whether the same bytes were preserved later. Alone it does not prove that the original data was true, complete or produced by the claimed person. Validate provenance and extraction separately.

Keep the controlled original and link analysis or masked copies as separate versions. Minimize data from the start rather than collecting unnecessary personal fields and forgetting them. Organizational obligations and authorized schedules determine retention; no fixed number of years is supplied here. A legal hold requires separate authorized review of routine deletion. This teaching page is not an evidence-upload repository.

Related primary references: NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗The IIA — Global Internal Audit Standards (2024) ↗

A Harbor screen shows the same person as preparer and approver; the owner says it is a service-account label. Before a dispute of opinion, this is an identity-mapping question. Compare raw actor IDs, delegation records, directories and timelines under controlled access. A senior person’s explanation does not override evidence, and a raw record should not be detached from context.

When resolving a conflict, explain why a record is stronger and which limits remain. Predefine scope and stop conditions for authorized tests. Do not generate evidence through real production payments. Unresolved records may leave a conclusion uncertain: report impact and further work rather than discarding an inconvenient record. Workpapers do not invent assumptions to create certainty.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

A good workpaper is more than attachments. Include engagement/question IDs, criteria, population, selection reproducibility, procedures, expected/observed behavior, references and conclusions. For Harbor file PAY-17, explain why second approval is considered absent and identify the applicable rule and record fields. Two identical names alone do not establish the same actor and file relationship.

The reviewer checks reproducibility and conclusion boundaries. Preparation and review must reflect real evaluation rather than ceremonial signatures. Later work retains its date and version instead of appearing to have existed earlier. Conclusions must match evidence and exclude unreviewed systems from positive assurances.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗ISO 19011:2026 — Guidelines for auditing management systems ↗

Investigate whether a candidate exception is a true criterion failure, faulty data or another authorized process. A Harbor record may belong to a test environment and have entered the production population incorrectly. Examine the remaining missing approval’s business effect without asserting an actual payment error or abuse without evidence. Separate observed facts from possible risk.

Hand verified observations to the findings guide with criteria, condition, evidence, scope and open questions. If no deviations were observed, report the test result and its limits rather than elimination of all fraud risk. Address causes and corrective actions with management next. Assign access and distribution classifications separately to evidence and reporting copies.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗The IIA — Global Internal Audit Standards (2024) ↗