An audit runs inside the client's own workspace, under the engagement the client granted. You read the client's records within the registers they authorised. You never edit them.
Who can do this
Members of the DPCO firm who can work on audits.
Plan the audit
Open Audits on the rail and press Plan an audit. The plan has six steps. You can press Save draft at any step and come back later.
- Who it’s for: choose A client on Asiri, then the client and its engagement under Client and authority. For an organisation that does not use Asiri, choose An organisation without Asiri.
- Purpose and period: choose the audit purpose (an annual compliance audit return, a readiness review before a return is due, or a review of a specific incident), the Reporting period starts and Reporting period ends dates, the Target opinion date and the client's Company collection period.
- What you’ll test: choose the Practice programme and version, then the Registers to test. Excluding a register needs a reason.
- Materiality: enter People affected and People affected where data is sensitive: how many people an exception must affect before it counts as material. Zero means every exception is material.
- Who does the work: name the Engagement lead, the Reviewer and the Signatory, and optionally Fieldwork. The reviewer and the signatory must not do fieldwork on the audit.
- Review and open: anything still missing is listed. Press Open audit.
If the plan needs the client's records first, press Save and enter client workspace.
Enter the client's workspace
From the client's page under Clients, or from the engagement, press Open client workspace. You are then working in the client's workspace, with only the registers they granted.
Ask for evidence
In the client's workspace, open Evidence, choose Requests and press Ask for something.
- Under Engagement, choose the engagement you are asking under.
- Write the Request title and Why this evidence is needed.
- Under How they will satisfy it, choose the requirements you need, and for each one Upload a document, A person declares it or Connect a system.
- Choose when you need it.
- Press Ask for evidence.
A due date is recorded and shown as due. Automatic reminders are not sent yet. Accepting or rejecting an answer is a judgement recorded on the audit.
What you can and cannot do
Under an audit engagement, the firm can read the granted registers, ask for and accept evidence, plan, perform and review tests, raise findings, keep internal notes, sign the opinion and file.
The firm cannot edit the client's records. An auditor who edits the record they are auditing has destroyed the thing they were engaged to attest.
Common questions
"Why can I not see a register I need?" The client did not grant it. Adding a register needs a fresh authorisation from the client.
"Can the client see our working papers?" The client sees what the audit asks of them and the findings. Firm notes marked as never shown to the client stay with the firm.