Guidance for using the RSM Internal Audit Guidance Framework – Working Papers

Individual Testing Sheet

This document is provided as guidance only and should be adapted to suit the needs of the
Member Firm and their clients. It should be referred to in conjunction with the Internal Audit
Guidance Framework Methodology. [Section 12.3]

This document should be branded appropriately in line with the RSM International Branding
Guidelines.

The sections in red need to be updated and re-written if necessary.

An individual testing sheet should be used to collate and summarise the findings from each
test performed as part of the fieldwork involved in an internal audit review. This allows the
internal auditor and manager to record the details of the test performed, results of the test, to
assess the outcomes and implication if their findings and to note any issues arising.

Please note that columns, rows and boxes may be deleted or added to fit the
requirements of the Member Firm and their clients.
 Company Name – this is the RSM Member firm’s branding.
 Working Paper reference – ensure that all your test sheets have a unique number which
corresponds with supporting documentation on how conclusions were drawn on the
testing undertaken. A well referenced file provides ease of understanding on the flow of
information.
 Client – Record the name of the client for whom you are undertaking the piece of work
for.
 Internal Audit Assignment Title – Include the title as per the internal audit annual
operational plan.
 Objective of system – In a risk based approach environment this should record the
objective of the area or process that is being reviewed as per the client. This may be
noted directly from their strategic or operational plans, risk registers, other client
documents, legislation that you may be considering. The objective may also be aims or
goals of the client.
 Risk – The risk recorded should be that associated with the objective of the area or
process being reviewed. [i.e. this should be the client’s risk and not one made up by the
auditor unless the client and their organisation is risk naïve] For example, consider what
will prevent the client or team from achieving their objectives.
 Control – Record the control identified and that you tested. This is the actual control in
place and not something aspirational by the client. Or the absent control that should be in
place, but you must note the failing identified.
 Testing Strategy and Methodology – This should be used to record the type of testing
performed, e.g. selection of a sample of X items, review of policy documents, discussion
with key staff, etc. You need to ensure that the testing strategy is clear so that if the test
were to be re-performed with the same approach, the same conclusions would be
reached.
 Sample Size – Record the number of items/cases, within the sample that have been
tested if applicable.
 Sample Source – Record where the sample was selected from if applicable, e.g. report
printout from the general ledger, latest payroll report, etc.
 Means of Selection – Record how the sample items/cases were selected if applicable,
e.g judgemental, every fifth item, using analysis tool, etc.
 Period of Selection – Record the period from which your sample items/cases have been
selected if applicable, e.g. for the current financial year, the last 6 months, etc.
 Other Comments – This allows for any additional relevant information to be recorded,
such as cross referencing to other working papers.
 Testing Results, Findings and Observations – Note testing performed and results,
and/or any other observations from the review.
 Evaluation of Control –This section should allow for an assessment of the control in
terms of whether it was well designed, being consistently applied and is effective.
 Implications and resulting Risks – This should record the implication of your findings
for the client or the resulting risk that will substantiate the recommendation raised.
 Recommendation Required – This identifies whether a recommendation is going to be
raised relating to the findings from the testing performed.
 Recommendation – This is the suggested corrective action that should be taken to
resolve any issues identified from testing and the review.
 Recommendation Category – In order to prioritise the issue, the recommendation
should be categorised as per the member firms internal definitions.
 Prepared by – The auditor that performed and writes up the results of the test should be
identified.
 Reviewed by – The reviewing senior, manager and director should sign off that they have
reviewed the individual testing sheet.
 COMPANY NAME Individual Testing Sheet Working
Paper Ref:
Internal Audit Service

Client:

IA Assignment
Title:

Objective of
system:
Associated Risk
to system:

Control[s]:

Testing Strategy
and Methodology:

Sample size: Means of

Selection:
Sample Source: Period of
Selection:
Other comments:

Testing Results, Findings and Observations:

Evaluation of
Control:
Implications and Recommendation
resulting Risks: Required:
Yes/No

Recommendation: Recommendation
Category:

Prepared by: Reviewed by:

D
Date:
Date: