Recently, our Big 4 consultants have indicated that the "Golden Rule" for Financial Institution IA Departments is for auditors to maintain copies of all supporting documents for every detailed test in order for the AIC to review all passes and fails. This rule applies for every sample and even for documents that reside in a system of record such as a loan origination system that could easily be obtained.

I have always only maintain copies of supporting documents for exceptions and observations.

Do any other IA shops follow this "Golden Rule"?

No we do not. There are certain audits we do follow this process, FDICIA and our HUD audit work. But for our normal audits, we only maintain documents of our exceptions. If I have a new auditor, I might have them print all documents during the training period, so I can identify their work process. I have never heard of this "Golden Rule".

Why were these Big 4 consultants in your shop?

I subcontract for a CPA firm occasionally and that has never been the case. I would be asking for more information and the basis to support such a recommendation prior to implementing such a change. It is going to significantly increase man hours per audit, which is probably the reason for such a recommendation by the big 4 consultant.

The consultants are here assisting with the annual risk assessments. The question came up and they were happy to provide their input, which was immediately implemented. My response was that they are creating a resource issue so they can then offer their help $$$$. As a supervisor, I was told I must now review 100% of team's work including the work of my senior auditors. What happened to relying on the competency of my team?

I would be looking for new "consultants" as they should be helping you streamline processes not develop new meaningless processes.

Who implemented?? - only the board or the audit committee should be instituting such major changes to the audit processes.

It is a reactive environment right now. The audit managers implemented the change.

We do not maintain copies of all audit supporting documentation. Only for exceptions. As oscupa also pointed out, for a new auditor, I may have him or her maintain copies so I can review their work process, understanding of the audit work, judgement, etc., until I am comfortable with the quality of their work. That is only for my review of the work, not for the official workpapers.

The audit managers implemented the change.

Without reviewing your audit charter, it would be hard to say whether they have that power without concurrence of the audit committee. Hopefully they have fully assessed the additional time and costs for implementing this change and have fully informed the audit committee of the overall impact this change will have on the overall audit process, schedule and budget.

I've been an external and internal auditor for fifteen years and I've never heard of this "golden rule". Sounds like someone wants to go back to "auditing by the pound". When I select a sample I enter the sample into a spreadsheet, with various details (customer name, account/loan number, transaction amount, date, etc.); enough to allow a second person to pull the same source documentation I did and come to the same conclusions. I can't imagine any accounting systems these days where prior records aren't archived and easily obtainable (subject to record retention rules). I will keep copies of exceptions, as others mentioned, to enable the reviewer of my workpapers to see the exception noted and support the conclusion that was made.