Audit readiness: building an evidence trail that management can maintain

Audit readiness becomes more manageable when evidence is created, indexed and reviewed as work happens.

For public-sector finance and process owners, we recommend an evidence index that links each control to its records, owner and review date. The aim is a traceable record that management can maintain and an auditor can examine under the audit’s own scope.

Embedding Continuous Controls Across the Financial Year

In national and provincial 2024–25 audit outcomes, the Auditor-General South Africa highlighted that auditees must maintain basic internal controls throughout the financial year to prevent, detect, and address material errors AGSA Media Statement.

Treat the following workflow as proposed management practice. Start with the records already produced during operations, identify gaps and decide who will maintain the evidence index. Align review frequency with the control, applicable requirements and the institution’s reporting cycle.

The guidance presented across this framework represents proposed management practice and operational preparation designed to strengthen internal oversight. Audit readiness: building an evidence trail that management can maintain should be understood as a practical approach for management to structure internal controls, rather than a mandatory legal standard or a guarantee of external audit results.

Core Principles of Process-Level Evidence Ownership

Building an audit trail that management can maintain requires institutionalising process-level evidence ownership across all operating units. Process owners—ranging from supply chain managers to asset controllers—can supply the records and explanations needed to review control operation within their respective operational spheres.

Key operational principles for establishing robust evidence ownership include:

• Defining Explicit Ownership: Every key control objective can be assigned to a specific role rather than a general department. The accountable owner assumes responsibility for performing the control, assembling the primary supporting records, and ensuring that evidence is logged systematically.
• Safeguarding Primary Records: Management can protect the integrity of audit evidence by maintaining strict version histories, preserving original source documents, and establishing controlled access rights. Whether records are stored electronically or physically, restricting editing permissions and preventing unauthorised alteration reduces the opportunity for unauthorised changes.
• Distinguishing Management Preparation from Independent Audit: Audit readiness support is fundamentally an internal management function focused on organising records, reconciling financial data, and documenting internal controls. This management activity is conceptually distinct from the independent external audit, which operates under its own distinct mandate, testing procedures, and reporting conclusions.

By adopting these principles, management can check whether controls are supported by observable, preserved proof without relying on ad hoc retrospective record retrieval.

Practical Evidence-Index Model

To assist process owners in maintaining continuous evidence trails, management can implement a practical evidence-index framework. The following proposed model illustrates how key process areas, control objectives, evidence requirements, and review protocols can be systematically mapped across an organisation as a suggested starting point, rather than a prescribed timetable.

The Monthly Recurring Review Routine

To maintain continuous audit readiness and prevent evidence gaps from accumulating, management can implement a structured monthly review routine. Executing this routine allows leadership to evaluate control performance continuously throughout the financial cycle.

• Step 1: Evidence Assembly & Reconciliation
  Process owners gather primary source documents and complete the reconciliations required for the relevant process for the preceding operating period. Responsible staff verify that primary records are complete, mathematically accurate, and securely stored according to established access protocols.

• Step 2: Root-Cause & Control Testing
  Management evaluates whether observed controls operated as intended during the period. If a control fails or experiences delay, management formulates a root-cause hypothesis to analyse why the failure occurred, identifies any operational dependencies blocking performance, and determines whether corrected procedures have been successfully applied.

• Step 3: Action Register Tracking
  The implementation team reviews the recommended action register, tracking findings across designated statuses: open, underway, awaiting evidence, verified for management closure, or reopened. Responsible officers update target due dates and ensure operational dependencies are actively managed.

• Step 4: Management Closure Decisions
  Formally designated managers review submitted evidence to verify whether control objectives have been satisfied before marking items as verified for management closure. Management closure represents an internal verification decision tool; it does not dictate or bind the conclusions of independent external auditors.