Finance Department. Audit Checklist

Standard Operating Procedure: Financial Operations Audit & Compliance Verification

Document ID: SOP-FIN-TR-4091
Effective Date: October 24, 2023
Version: 3.2
Review Cadence: Semi-Annual
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade workflow for executing internal financial audits within Template Registry. The purpose of this protocol is to ensure systemic financial integrity, enforce internal controls, validate ledger reconciliation, and guarantee absolute compliance with GAAP, SOX, and localized regulatory frameworks. Execution of this checklist mitigates material misstatements, fraud vectors, and operational latency in the financial architecture.

2. Scope & Prerequisites

Scope

This procedure applies to all transactional reviews, general ledger reconciliations, payroll audits, accounts payable (AP), accounts receivable (AR), and tax liability assessments conducted by the Finance Department across all operating entities of Template Registry.

Prerequisites & Required Access

• Software Systems: NetSuite ERP (Enterprise Edition), BlackLine (Reconciliation Module), Workday Adaptive Planning, AWS Cost Explorer, SecureFile Transfer (SFTP).
• Credentials: Role-Based Access Control (RBAC) Level 4 (Auditor-Read-Write-Secure) or higher. Multi-Factor Authentication (MFA) token required.
• Documentation: Prior Quarter Audit Workpapers, Chart of Accounts (COA v4.2), Delegation of Authority (DoA) Matrix.
• PPE: N/A (Digital Systems Environment).

3. Roles & Responsibilities (RACI Matrix)

R = Responsible, A = Accountable, Consulted = C, Informed = I

---

4. Step-by-Step Procedure

Phase 1: Pre-Audit Preparation & Data Extraction

• 1.1 Initialize the Audit Engagement workspace within the BlackLine compliance module and lock the target period (e.g., Q3 Close).
• 1.2 Extract Trial Balance (TB), General Ledger (GL) detail, and Subledger balances from NetSuite ERP as of 23:59:59 on the final day of the audit period.
• 1.3 Verify cryptographic hashes (SHA-256) of extracted CSV/XML datasets against NetSuite system logs to ensure data integrity.
• 1.4 Import extracted datasets into the audit analytics engine and run automated variance scripts against the previous period (Threshold: >5% or >$10,000 variance requires mandatory testing).

Phase 2: Balance Sheet & General Ledger Reconciliation

• 2.1 Reconcile Cash and Cash Equivalents: Match NetSuite GL cash accounts directly against institutional bank statements and lockbox feeds.
• 2.2 Verify Outstanding Checks and Deposits in Transit: Trace all reconciling items older than 30 days to subsequent bank clearances.
• 2.3 Accounts Receivable (AR) Aging Review: Cross-reference AR aging reports with the allowance for doubtful accounts; validate write-offs against the DoA matrix.
• 2.4 Prepaid Expenses & Fixed Assets: Inspect depreciation schedules, verifying additions and disposals against physical/digital asset tags and purchase orders.
• 2.5 Accrued Liabilities & Deferred Revenue: Validate that unearned revenue schedules align with ongoing contractual delivery milestones.

Phase 3: Revenue Recognition & Accounts Payable Testing

• 3.1 Revenue Completeness & Cut-Off: Select a statistical sample ($n=60$) of transactions 5 days pre- and post-period end; verify recognition matches ASC 606 performance obligations.
• 3.2 AP Three-Way Match Verification: Audit a randomized sample of invoice disbursements. Confirm 100% correlation among Purchase Order (PO), Receiving Report, and Vendor Invoice.
• 3.3 Duplicate Payment Scan: Execute the automated duplicate payment algorithm across all AP disbursements for the period; investigate any flags with matching vendor IDs, invoice numbers, and amounts.
• 3.4 T&E (Travel & Expense) Compliance: Audit corporate credit card statements against submitted expense reports; verify adherence to Template Registry Travel Policy v3.

Phase 4: Payroll, Benefits, & Tax Compliance

• 4.1 Headcount Reconciliation: Compare HRIS (Workday) active employee rosters against NetSuite payroll disbursement registers for the final pay period of the audit cycle.
• 4.2 Compensation Variance Analysis: Verify executive compensation changes against Compensation Committee meeting minutes and authorized salary bands.
• 4.3 Tax Withholding & Remittance: Validate that federal, state, and local payroll tax withholdings match quarterly Form 941 filings and state unemployment insurance (SUI) returns.
• 4.4 Benefit Plan Contributions: Confirm 401(k), health savings, and insurance premium remittances are posted to custodial accounts within statutory deadlines (e.g., DOL 7-business-day rule).

Phase 5: Reporting, Remediation, & Closure

• 5.1 Compile audit findings into the Standard Audit Working Paper format, categorizing exceptions by severity (Low, Medium, High, Critical).
• 5.2 Issue Draft Findings Report to Process Owners; establish a mandatory 5-business-day remediation window for management responses.
• 5.3 Conduct formal sign-off meeting with the Controller and Chief Financial Officer.
• 5.4 Archive all audit workpapers, datasets, and sign-off sheets in the immutable compliance vault with a 7-year retention tag.

---

5. Quality Assurance & Pro-Tips

Best Practices (Pro-Tips)

• Continuous Sampling: Do not wait until period-end. Run continuous automated controls testing for high-risk accounts (Cash, Revenue) bi-weekly to prevent quarter-end bottlenecks.
• Audit Trail Hygiene: Never alter an exported dataset manually. If data transformations are required, execute them via version-controlled Python scripts stored in the audit repository to maintain an unassailable audit trail.

Common Pitfalls to Avoid

• Accepting verbal explanations: All exceptions must be substantiated by documentary evidence (e.g., signed contracts, bank confirmations, system logs). Verbal assertions hold zero weight in compliance grading.
• Ignoring immaterial trends: Systematic small-dollar discrepancies often indicate process decay or skimming schemes. Investigate variance clusters rigorously.

Metric Thresholds

• Reconciliation Variance: Target = $0.00. Acceptable threshold: <$1.00 for rounding differences.
• Exception Remediation SLA: High/Critical findings must be remediated within 14 calendar days; Medium/Low within 30 calendar days.

---

6. Frequently Asked Questions (FAQ)

Q1: What is the mandatory protocol if an unreconciled variance exceeds $50,000 during Phase 2?
A: Immediately halt the affected ledger review, tag the item as a Critical Exception, and issue an automated P1 incident notification to the Controller and CFO within 2 hours. Do not force-balance the ledger via manual journal entries without written authorization from the Controller.

Q2: How should missing supporting documentation for an AP disbursement be handled during testing?
A: If a required document (e.g., PO or receiving slip) is missing from the digital archive, the auditor must issue a formal Document Request Notice to the AP Manager. If the document is not produced within 48 hours, classify the transaction as an internal control deficiency and flag it in the final audit report.

Q3: Can automated scripts replace manual sampling for Phase 3 revenue testing?
A: Yes. If 100% population testing is executed via approved scripts in the analytics engine, statistical sampling ($n=60$) is waived. However, the underlying script logic must be verified and signed off by the Internal Audit Lead prior to execution.