Browse documentation
THE RAILBASE PRODUCT GUIDE
Audit the process and issue a reviewed report
Follow Acme's purchase from independent scope and evidence to finding, owner response and the exact issued report.
Updated
Continue the Acme case
Audit examines Acme's $6,000 Aster purchase, its accounting trace, risk assessment, compliance case and reviewed control test. The audit team forms its own conclusion; it does not copy management's “closed” status as proof.
Role and prerequisites
The audit head establishes the engagement and team. Assigned auditors prepare procedures and findings; independent reviewers assess the work and report. Process owners answer source-bound requests in Core My work. Read access to Accounting evidence requires an approved mandate; GRC ownership alone grants neither unrestricted financial data nor payroll access.
From engagement to issued report
- Create the engagement with Acme, October, supplier-selection scope, objective, criteria and assigned team. Retain the policy revision and the auditor's understanding of the process.
- Request the allowed purchase/decision records from the assigned representative. Where available, refresh approved risk and control source snapshots and record their versions. Do not substitute inaccessible data with invented rows.
- Plan a procedure against the disclosure-timing criterion. Define the population and selection rationale. If using the Internal Control test, separately justify reliance, objectivity and any additional testing.
- Record evidence and conclusion, then submit for independent review. A returned workpaper retains its reason; revise and resubmit before basing a finding on it.
- Prepare a finding about the late disclosure. The authorised head issues a recommendation with owner, deadline and acceptance criterion. The owner replies; independent reviewed follow-up determines closure.
- Prepare the report and obtain the required sequential independent decisions on the pinned revision. Reopen the issued report and download through its permitted route.
Verify the saved result
The engagement, reviewed work, finding, recommendation and issued report remain connected. An owner reply means “response received”, not verified closure. A draft or internally submitted report is not issued. Withdrawal before a decision and reversal after issue use separate supported processes and retain history.