Audit workpaper evidence: why are screenshots not enough?

Internal auditors keep asking in discussions on Reddit whether others lose hours capturing screenshots for workpapers. We listen to what practitioners are talking about so we can share what is being discussed and add to the conversation.

This piece is for UK internal audit teams. It compares four ways of capturing evidence by what an independent reviewer can verify from each, then sets out what to retain so the reviewer can see how a conclusion was reached: the source, the date, who pulled it, how it was selected and what was tested.

Audit workpaper evidence is the record that lets someone who was not on the engagement see what was examined and how the conclusion followed from it.

Four capture methods compared by what a reviewer can verify

The useful test for any capture method is simple. Can a reviewer who was not there confirm what was examined, and repeat it if they need to?

• Screenshot: shows what was on a screen at one moment. The reviewer cannot see the source system, the report settings or the user who captured it unless they are visible in the image. The image can be cropped and cannot be re-run. It confirms appearance and little else.
• System export: a file holding the data as the system returned it. The reviewer can examine the contents, filter them and trace figures. The export is only as useful as its context, so the run date, the user and the report settings need to be recorded with it.
• Recorded query: the query text, the run date, the user and the output saved together. The reviewer can see the exact selection logic and repeat it against the same source. This depends on the reviewer having access and on the system data not having changed.
• Re-performance: the auditor independently repeats a control or a calculation and records the inputs and the result. It gives the reviewer the most direct view of whether the control operates as described. It takes the most time and needs the source data to be kept.

Screenshots still have a place. A screenshot is the right record of a configuration setting or an error message. It works as supporting evidence next to an export, a query or a re-performance, and it is weak as the only evidence behind a conclusion.

What to keep so a reviewer can follow the conclusion

Documentation should show how the conclusion was reached. The IIA’s Global Internal Audit Standards are the mandatory component of the International Professional Practices Framework, and the IIA expects all internal audit functions to conform to them. Teams should read the Standards directly for their wording and apply them to their own engagement files.

Five items let a reviewer follow the line from evidence to conclusion. They fall into three groups.

The source and the date

Record the system or document the evidence came from, including its version where that is relevant. Then record the date and time the data was pulled. Data in an operational system changes. A date turns an export into a statement about a specific point in time.

Who pulled it and how it was selected

Record the name of the person who ran the report or query. Then record how the items were selected: the filters, the date range and the report parameters, or the query text itself. A reviewer who sees only the output cannot tell what was left out. A reviewer who sees the selection can repeat it.

What was tested and what the result was

State the test performed on the evidence, the criteria applied and the result for each item. Keep the conclusion next to this note. The reviewer should be able to move from the conclusion to the test to the evidence without asking the auditor to explain.

A worked example: a leavers test a reviewer can follow

The example is illustrative. A UK internal audit team tests whether leavers lose system access. The workpaper holds the HR system leavers report for 1 July to 30 September, run on 14 October by the named auditor, with the report parameters recorded. It also holds the active user list exported from the directory on the same day, with the export date and user recorded.

The test note states that every leaver on the HR report was matched to the active user list and that the criterion was no active account after the leaving date. It records the result for each leaver. Three accounts were still active and each is listed by name with the leaving date. The conclusion refers to the test note and the two files.

A reviewer reading this can see where each file came from, when it was produced and by whom. The reviewer can repeat the match from the two files. A screenshot of the HR report would show none of that.

Audit work paper management software UK: moving from screenshots to a structured evidence trail

Much of the time lost to screenshots comes from capturing evidence after the test is done and then rebuilding the link between the image and the conclusion. A structured evidence trail reverses that order. The evidence is attached to the test step when the test is performed, with its source, date and user recorded at that point.

Audit work paper management software supports this when each piece of evidence sits against a named test, carries its capture details and stays visible to the reviewer alongside the conclusion. It should also keep the review notes with the workpaper. Ideagen’s internal audit solution is one example of an audit platform where workpaper and documentation management sit alongside the rest of the audit work.

A shared drive and a spreadsheet can hold the same fields. The difference is whether the structure is enforced as the work is done or reconstructed at the end of the engagement.

Five screenshot habits that weaken workpapers and what to keep instead

What the workpaper shows today	What to keep instead	What the reviewer gains
A cropped screenshot with no date or user visible.	The export or query output with the run date and the user recorded.	The date and the person without having to ask.
Screenshots pasted in after fieldwork has ended.	Evidence captured when the test is performed and attached to the test step.	Fewer hours spent rebuilding evidence and the evidence sits next to the test.
A report screenshot with the filters hidden.	The report parameters or the saved query text.	A selection the reviewer can repeat.
A conclusion of no exceptions with no note of what was tested.	A test note stating the criteria and the result for each item.	A clear line from the conclusion to the evidence.
Evidence saved in a personal folder or an email thread.	Evidence stored in the engagement file against the test step.	Evidence that colleagues can find without the original auditor.

Keep what lets a reviewer reach the same conclusion

A screenshot records what a screen looked like. A workpaper has to record how a conclusion was reached. Exports, recorded queries and re-performance give a reviewer something to check, and the source, the date, the user, the selection and the test show the route from evidence to conclusion.

To continue the discussion with other practitioners, join Ideagen’s Reddit community.