Reliable audit data starts with an agreed request and a traceable extraction process. Analytics may help an auditor examine a transaction population for a particular purpose, but a large file or a full-population test does not establish that the underlying records are complete and correct.
Management’s task is to provide the requested records, explain how they were produced and resolve questions using evidence. The auditor determines the procedures and evaluates whether sufficient appropriate audit evidence has been obtained.
Agree the request before extracting the data
Confirm the entities, systems, period and transaction types in scope. Ask which fields, file format and supporting explanations are needed. Establish whether the extract must include opening balances, corrections, reversals and transactions posted after the period end. Agree who can answer accounting questions and who can explain the system extraction.
The MIA’s adopted auditing standards provide the professional framework. They do not mean every audit uses the same software or data tests. The practical request should be agreed with the appointed auditor for the engagement.
Keep an extraction record
A useful control record identifies the system, report or query used, extraction date, accounting period, filters, entity and responsible preparer. Preserve the original extract and record any subsequent transformation. If fields are renamed or codes are mapped, retain a data dictionary explaining the change.
Reconcile control totals to the trial balance or relevant subledger and explain differences. For example, confirm how opening balances, voided items and later postings affect the population. Do not force a reconciliation by removing unexplained transactions. If the system cannot produce a requested field, tell the auditor what is missing and discuss an alternative source.
Resolve exceptions with supporting evidence
An exception may be an error, a legitimate transaction or a limitation in the data. Keep a response log showing the item, question, explanation, supporting document and reviewer. A statement that an entry is “normal” is less useful than the underlying contract, invoice, approval or calculation.
Where an adjustment is made, preserve the link between the original item, approved correction and revised ledger. Keep unresolved matters visible so that management and the auditor can assess their effect. Management should not remove items merely because they may produce difficult questions.
Plan secure transfer and retention
Agree an approved transfer method, access permissions and the scope of the data requested. Check whether personal or confidential information is necessary for the agreed purpose and involve the relevant privacy or technology specialist where needed. The Personal Data Protection Department’s official material is a starting point for applicable data-protection requirements. Follow the organisation’s retention obligations and agreed engagement arrangements rather than deleting records on an assumed timetable.
Assign owners and review the final pack
- The finance owner confirms the period, balances and accounting explanations.
- The system owner documents the extract and relevant limitations.
- The authorised reviewer approves the information release and tracks outstanding questions.
- The auditor confirms whether the information meets the request and whether further evidence is needed.
For the wider preparation process, see our statutory audit preparation guide. Saifudin & Co’s audit and assurance work is subject to an agreed scope and applicable professional requirements. This article is a practical management checklist, not an audit procedure specification or a guarantee of the auditor’s conclusion.