How to Prevent Evidence Gaps in Financial Audits

I've sat in more than 50 audits across GCC & Europe (ISO 27001, SOC 2, SAMA etc..) You rarely fail for missing a piece of evidence... You fail because the proof is scattered, outdated, ownerless, or can't be found (while the person providing it swears they submitted already) To avoid this: 1- Pick one system of record for evidence (SharePoint or Google Drive, etc.). No WhatsApp, Teams DMs, or email threads as “evidence.” 2- Create one folder per Framework. Create sub folder per control group. Use a clean name for files, {ControlName}{YY-quarter(e.g. Q1)} 3- Assign one named owner per domain (Access, Assets, Change, Incident). Give each an audit response cheat sheet: what to show, where it lives, who to pull in (good luck with getting other teams doing it!) 4- Run a pre-audit dry run: fresh eyes click every link, open every file, check dates/signatures, and tie each piece of evidence to the control ID. Time-box to 2 hours. Ask the team: “If we were audited tomorrow, where would you point the auditor to?” 5- Automate refresh: exports/screenshots as needed (monthly?), owner sign-offs, and expiry checks so proofs don’t go stale. Simple fix: Make evidence hygiene the product, not an afterthought. Or simply save yourself the headache, at Vamu we automate a large part of this, and map controls to owners and time-stamped proofs so the folder is clean by default. But you can start with the list above this week. Audits are won (or lost) in the evidence folder.

🔒 CONTROL TESTING: Turning Assumptions into Evidence Designing internal controls is essential—but proving they work is where real assurance lies. Control testing is the bridge between theory and reality, showing whether detective, preventive, and corrective measures actually protect your organization. 1️⃣ Why it Matters • Detective controls (e.g., reconciliations) must flag anomalies. • Preventive controls (e.g., approvals) should stop errors before they occur. • Corrective controls (e.g., backups) need to restore operations swiftly. If these fail under scrutiny, risk hides in plain sight. 2️⃣ Essential Control Testing Cycle 1. Define Control Objective – What risk does the control tackle? 2. Test Design – Does the control, in theory, cover the risk? 3. Test Operating Effectiveness – Does it work in real life? Sample transactions, observe processes, interview owners. 4. Document Results – Evidence speaks louder than opinions. 5. Report & Remediate – Highlight gaps, assign fixes, and track closure. 6. Retest & Improve – Controls evolve as processes and threats change. 3️⃣ Real-World Example Imagine a monthly vendor payment review meant to prevent duplicate payments. Testing uncovers that the reviewer only checks high-value invoices, leaving small duplicates undetected. Insight gained? Adjust the review scope and automate a report for all invoices. 4️⃣ Tips for Effective Testing • Risk-Based Prioritization: Focus on controls guarding material risks first. • Cross-Functional Teams: Auditors, process owners, and IT build a fuller picture. • Continuous Testing: Embed into workflows—don’t wait for year-end audits. Remember: good controls are useless if unproven. Test them early, test them often, and turn risk management into actionable evidence. 🔖 #ControlTesting #InternalControls #RiskManagement #Audit #GRC #Compliance #OperationalRisk #ProcessImprovement #Governance #Assurance #ISO31000 #SOX

You’re reconciling your bank accounts. Your ledger shows ₦500 million.   Your bank statement says ₦501 million.  Just ₦1 million, right? No big deal? Not so fast.  What if that ₦1 million is the net result of ₦50 million in debits and ₦49 million in credits? Does it still feel immaterial now? Now it’s not just a small gap—it’s a warning sign. 𝗪𝗵𝘆 𝗦𝗺𝗮𝗹𝗹 𝗗𝗶𝘀𝗰𝗿𝗲𝗽𝗮𝗻𝗰𝗶𝗲𝘀 𝗗𝗲𝗺𝗮𝗻𝗱 𝗬𝗼𝘂𝗿 𝗔𝘁𝘁𝗲𝗻𝘁𝗶𝗼𝗻  1️⃣ Small Gaps, Big Consequences   That ₦1 million difference could be masking fraud, errors, or systemic process failures.   Left unchecked, it could snowball into millions more.  2️⃣ They Erode Trust in Your Numbers   Your board, investors, and lenders rely on clean, accurate reports.   One small error undermines the integrity of your entire financial story.  3️⃣ The Cost of Ignoring It is Massive.   A company I worked with dismissed discrepancies as "minor." Months later, they were untangling ₦12 million in unresolved issues. Fixing it was expensive and avoidable.  𝗪𝗵𝗮𝘁 𝗖𝗮𝗻 𝗬𝗼𝘂 𝗟𝗲𝗮𝗿𝗻 𝗳𝗿𝗼𝗺 𝗧𝗵𝗶𝘀?  The lesson isn’t just “find the gap.”   It’s to understand what it’s telling you about your processes, controls, and oversight.  𝗛𝗼𝘄 𝘁𝗼 𝗦𝘁𝗼𝗽 𝗦𝗺𝗮𝗹𝗹 𝗚𝗮𝗽𝘀 𝗕𝗲𝗳𝗼𝗿𝗲 𝗧𝗵𝗲𝘆 𝗕𝗲𝗰𝗼𝗺𝗲 𝗕𝗶𝗴 𝗣𝗿𝗼𝗯𝗹𝗲𝗺𝘀  1️⃣ Reconcile Often and Consistently   Make reconciliation part of your routine. The more frequently you do it, the fewer surprises you’ll face.  2️⃣ Investigate Every Unexpected Discrepancy A difference where there shouldn't be one isn’t just a number—it’s a clue. Follow it to the root cause. 3️⃣ Automate—but Don’t Abdicate   Automation speeds things up, but your team’s eyes are the ultimate safeguard. Balance tools with human oversight.  4️⃣ Build a Culture of Precision   Train your team to think critically, ask questions, and treat every discrepancy as important.  Your Financial Reports Are Only as Good as Your Reconciliations So don’t ignore that small difference. It’s not just a number—it’s an opportunity to strengthen your processes, your accuracy, and your business.  #myCFOng 𝘗.𝘚. 𝘞𝘩𝘢𝘵’𝘴 𝘵𝘩𝘦 𝘴𝘮𝘢𝘭𝘭𝘦𝘴𝘵 𝘥𝘪𝘴𝘤𝘳𝘦𝘱𝘢𝘯𝘤𝘺 𝘵𝘩𝘢𝘵 𝘤𝘢𝘶𝘴𝘦𝘥 𝘺𝘰𝘶 𝘢 𝘣𝘪𝘨 𝘪𝘴𝘴𝘶𝘦?

SOX teams at companies with non-December 31 fiscal year ends are experiencing a growing challenge in their SOX programs. And it involves their SOC reports. Specifically, SOX programs are increasingly encountering challenges when vendors cannot provide assurance coverage beyond their annual SOC report and single bridge letter. External auditors can rely on inquiry procedures confirmed by a SOC vendor's bridge letter, but only for up to four months after its issue date. Unfortunately, many companies don't realize this issue until year-end approaches, when External Audit requires management to perform their own procedures to validate the completeness, accuracy, and reliability of information used in their controls. This forces management and the SOX team to scramble at the last minute to create, perform, and document these new procedures. To prevent this last-minute runaround with the External Auditor, there are a few things management can do to avoid this situation in 2025. 1. When planning to use a new vendor that requires a SOC report, make the frequency of SOC reports and year-round coverage a key part of your due diligence process. If the vendor cannot commit to or demonstrate SOC report frequency beyond an annual report plus bridge letter, you risk facing coverage gaps. 2. For existing vendors, management should increase pressure on their SOC vendors to engage their independent auditors for more frequent assessments. This can be accomplished by having the budget owner for the application speak directly with the vendor's leadership team. If the conversation is timed during around a contract renewal, that will help. Additionally, coordinating with other SOX leaders to communicate requests collectively can be effective. From my experience working at a software provider, this strength in numbers approach often captures the attention of vendor senior leadership. 3. During your fiscal year planning phase, analyze the SOC report coverage for all vendors in your SOX program to ensure complete coverage. Share this analysis with your external auditor to prevent last-minute requests. As organizations increasingly rely on third-party vendors and applications for financial reporting, SOX programs require a growing number of SOC reports. Addressing this challenge proactively now will help you, your team, and management avoid these headaches in the new fiscal year. Internal Audit Collective #InternalAudit #SOX #ConnectedRisk

If you’re on the other side of the table during an audit this is for you. Over the last two years, I have witnessed one pattern that keeps showing up. The most common audit exceptions don’t come from bad intentions or lack of controls. They come from manual processes. Pulling a report. Running a script. Uploading a file. Capturing a screenshot. Anything involving a human step has a chance for human error. And that’s okay. But here’s the thing. As auditors, our job is to test the design and effectiveness of your controls. If something’s unclear or incomplete, we ask questions. (And then more questions. And then a few more.) Not to annoy you. But because we need to validate the risk is truly addressed. So if you’re a control owner, or someone supporting audit requests, I want to offer you 3 golden rules to reduce audit fatigue: 1. Document Your Process (In Your Own Words) Don’t just tell us what the control says. Tell us what you actually do. From start to finish whether it’s a user review or a system change note the steps you follow. The clearer your explanation, the fewer the follow-ups. 2. Ensure Evidence is Complete and Accurate If you’re running a report, screenshot the parameters. If you’re using a script, include the script and the environment. Add date stamps, URLs, timestamps whatever proves completeness. Your screenshots should speak for themselves, even without an explanation. 3. Know Your Control (And Say It With Confidence) If you’re leading a walkthrough, take time beforehand to understand the flow. Auditors rely on what you say to tie things together. If the actual process differs from what the control says, please say it. WE ARE HERE TO UNDERSTAND, NOT TO CATCH MISTAKES. I know the pressure of explaining something you’ve done a hundred times, while still getting asked: “But can you clarify this one step again?” But when your process is clear, your evidence is clean, and your walkthrough is confident, Audits go smoother. Questions go down. Exceptions go away. Let’s make audits less painful together. Tag someone on the control owner side who needs to see this.

Dear IT Auditors, Evidence Quality in IT Audits. Audit conclusions rise or fall on evidence. Leaders trust your work when you show proof that stands up to scrutiny. Weak evidence damages credibility fast. You avoid that by setting a high bar and applying it consistently. You treat evidence as a decision asset. You collect it with intent. You document it with clarity. You link it directly to risk. 📌 Define acceptable evidence upfront You specify what proof supports each control. You avoid generic descriptions. You name system outputs, logs, tickets, configurations, or reports. You align expectations with stakeholders before testing begins. 📌 Prefer system-generated evidence You rely on logs, configuration exports, and automated reports. You reduce dependence on screenshots or verbal confirmation. You use evidence that shows how systems behave, not how teams describe them. 📌 Test completeness and accuracy You confirm evidence covers the full audit period. You verify time stamps and data sources. You check for gaps or manual edits. You challenge samples that feel curated or incomplete. 📌 Trace evidence to the control You map each artifact to a specific requirement. You explain what the evidence proves. You avoid collecting documents with no clear purpose. You keep your work focused and defensible. 📌 Validate consistency across sources You compare evidence from different systems. You check if access logs match IAM records. You confirm that tickets align with change logs. You highlight conflicts that signal deeper issues. 📌 Document context and limitations You record how you obtained the evidence. You note assumptions and scope boundaries. You explain constraints without weakening conclusions. You protect your work during review or escalation. 📌 Reject weak substitutes You push back on policy statements without proof. You reject outdated screenshots. You refuse evidence that does not reflect current operations. You set a standard that others respect. 📌 Close with evidence-driven conclusions You tie findings directly to proof. You show leaders what you saw and why it matters. You make your report hard to dispute. #ITAudit #InternalAudit #AuditEvidence #GRC #CybersecurityAudit #CloudAudit #RiskManagement #ITGovernance #AuditQuality #TechLeadership #CyberVerge

Dear Accountants,  Audit Mistakes That Cost Millions & Kill Donor Confidence (And How to Avoid Them) Every year, organizations lose millions, not to fraud, but to avoidable audit mistakes that trigger ineligible costs and donor refunds. The culprits? Gaps in documentation, weak controls, late reconciliations, poor coordination, and ignored recommendations. Small errors repeated over time quietly drain resources, damage credibility, and frustrate donors. The good news? Most of these mistakes can be prevented long before the auditors arrive. Here are the some of the top Costly Audit Mistakes and how to avoid them: 1. Poor Documentation: Missing Receipts, Invoices & Support When documentation is incomplete, auditors assume the worst and the organization pays the price. How to Avoid:  ✔️ Maintain a real-time filing system ✔️ Digitize everything ✔️ Train teams on documentation requirements 2. Weak Internal Controls:  Lack of segregation of duties, no reviews, or inconsistent approvals create loopholes for errors and fraud. How to Avoid: ✔️ Strengthen approval workflows ✔️ Enforce monthly reviews ✔️ Test controls regularly 3.Late Reconciliations (Especially Bank Recs): Delayed reconciliations let small errors snowball into major misstatements, often discovered right in front of the auditor. How to Avoid: ✔️ Reconcile monthly (or weekly for high-volume accounts) ✔️ Investigate variances immediately ✔️ Use automation to reduce errors 4.Poor Coordination Between Finance and Program Teams: When program activities don’t match financial reports, auditors quickly flag inconsistencies. How to Avoid: ✔️ Hold monthly joint review meetings ✔️ Align program data with financial reporting ✔️ Train non-finance staff on compliance basics 5.Ignoring Past Audit Recommendations: Nothing frustrates auditors (and donors) more than repeat findings, it signals weak accountability. How to Avoid: ✔️ Create an audit action plan ✔️ Assign owners and deadlines ✔️ Monitor progress quarterly 💡 Great teams do not wait for auditors to point out gaps. They fix issues early, monitor controls, and build systems that protect the organization year-round. 👉 What’s the most expensive audit mistake you have seen, and what did your organization learn from it? Share your insights below, your experience could help another team avoid costly pitfalls.

👀🦆 CDD - Take a Closer Look 🦆👀 Getting CDD documents - EIDV reports, ID, bank statements - is not enough ❌️ You actually need to scrutinise what you obtain 👀 ⚠️ Lack of scrutiny of CDD was an emerging risk identified in the SRA's Sectoral Risk Assessment last year. ⬆️ Audits often show a lack of scrutiny of CDD - whether it is a case of scrutiny isn't taking place or whether it is but isn’t being documented. 🟢 Do the documents support what you know about the client/what they've told you. ➡️ Cross reference dates, spellings, values, transactions. Are there any red flags present or areas which warrant you digging a bit deeper because they change the risk profile of the client/matter. 🔵 Do not overly rely on EIDV reports. ➡️ Understand what the report checks and confirms and where there may be deficiencies. If you know something which is not supported (or is contradicted) by the EIDV report - you need to investigate. This means you need to read the report!! 🟣 Evidence your scrutiny. ➡️ Annotate the documents, do a file note, include narrative in your Risk Assessment. There are lots of ways to evidence your scrutiny - ensure you know how your firm want you to do this. ⚠️ Don't assume someone else will undertake the scrutiny - especially where you have built in escalation processes. Those processes only work if everyone applies a critical eye. The takeaway here - make sure you join the dots ✒️ and capture that thought process in your audit trail. The documents alone are not enough.

Good audit points don’t “appear.” They’re dug out. Here are 5 deeper strategies that have helped me find high-impact audit observations: 1️⃣ Don’t Just Read SOPs. Read Between the Lines. Most SOPs are written after the process already started. They cover the “ideal” world, not the “real” one. -Compare SOP vs actual flow. Ask: What steps are skipped? What approvals are being overridden in practice? That’s where control failures usually start. 2️⃣ Zoom Out Before Zooming In Instead of starting with sampling or walkthroughs, begin by asking: • What decisions drive this function? • Where is the money flow? • What data is recorded vs what is actually done? Audit observations often lie in the gap between intent and execution, not just errors in entries. 3️⃣ Follow Exceptions Like a Blood Trail Instead of focusing on the 95% compliance, chase the 5% exceptions: • Manual overrides • Backdated transactions • Non-SAP entries • Approvals by “someone on behalf of someone” Digging into 2–3 of these often reveals system loopholes, control bypasses, or even fraud risks. 4️⃣ Link Control Gaps to Business Risk Don’t stop at saying “approval missing” or “SOP not followed.” Translate that into real business impact: • Could this lead to vendor overpayment? • Could stock valuation go wrong? • Could customer refund be misused? A good audit point doesn’t just show failure it shows why it matters. 5️⃣ Build Comfort With Data...Even Imperfect Ones Audit teams often avoid using data because it’s “dirty” or “incomplete.” But even partial data can show patterns: • Multiple returns by same customer • Multiple PO amendments • High discounts by same user ID You don’t need perfection - you need direction. Data can guide you to the audit area worth deep-diving. Bottom line: Good audit points are not found. They are earned by thinking deeper, asking sharper, and connecting dots others ignore. #InternalAudit #Audit

If your team stood up AI fast, I’d double-check who owns what before year-end. I’ve seen too many builds with no paper trail… and auditors won’t be kind. Here’s what I’m recommending to accounting and finance leaders right now: 1. Accounting owns it. If your team isn’t leading the team’s AI effort, you’re setting yourself up for trouble. IT may help build or deploy, but finance needs to steer. That’s the only way to ensure accuracy, context, and defensibility when questions come up later. 2. Centralize the setup. I’ve seen teams running five tools for five workflows with zero visibility across them. That creates blind spots and bloated risk. A centralized platform gives you one system of record with built-in controls and fewer surprises when the auditors ask, “Where’s the source?” 3. Lock in the audit trail. Every AI decision, handoff, and action should be logged and explainable. If you can’t trace what the agent did and why, it’s going to be a nightmare to justify the outcomes. Especially when financial data is involved. Think like an auditor before they arrive. 4. Fix it now, not during the year-end crunch. By December, everyone’s buried. If you wait until then to clean up any loose ends, it’ll either slip or get patched in a panic. Either way, that’s not ideal. Here's the reality: If ownership is murky, you're going to have a rough December. Better to lock in these principles now than explain yourself later.