conversion from Zola to Weblorg

1 files changed, 0 insertions, 77 deletions

diff --git a/content/blog/2023-06-20-audit-review-template.md b/content/blog/2023-06-20-audit-review-template.md
deleted file mode 100644
index ede3092..0000000
--- a/content/blog/2023-06-20-audit-review-template.md
+++ /dev/null
@@ -1,77 +0,0 @@
-+++
-date = 2023-06-20
-title = "Audit Testing Review Template"
-description = ""
-draft = false
-+++
-
-# Overview
-
-This post is a _very_ brief overview on the basic process to review audit test
-results, focusing on work done as part of a financial statement audit (FSA) or
-service organization controls (SOC) report.
-
-While there are numerous different things to review and look for - all varying
-wildly depending on the report, client, and tester - this list serves as a solid
-base foundation for a reviewer.
-
-I have used this throughout my career as a starting point to my reviews, and it
-has worked wonders for creating a consistent and objective template to my
-reviews. The goal is to keep this base high-level enough to be used on a wide
-variety of engagements, while still ensuring that all key areas are covered.
-
-# Review Template
-
-1. [ ] Check all documents for spelling and grammar.
-2. [ ] Ensure all acronyms are fully explained upon first use.
-3. [ ] For all people referenced, use their full names and job titles upon first
-       use.
-4. [ ] All supporting documents must cross-reference to the lead sheet and
-       vice-versa.
-5. [ ] Verify that the control has been adequately tested:
-    - [ ] **Test of Design**: Did the tester obtain information regarding how
-          the control should perform normally and abnormally (e.g., emergency
-          scenarios)?
-    - [ ] **Test of Operating Effectiveness**: Did the tester inquire, observe,
-          inspect, or re-perform sufficient evidence to support their conclusion
-          over the control? Inquiry alone is not adequate!
-6. [ ] For any information used in the control, whether by the control operator
-       or by the tester, did the tester appropriately document the source
-       (system or person), extraction method, parameters, and completeness and
-       accuracy (C&A)?
-    - [ ] For any reports, queries, etc. used in the extraction, did the tester
-          include a copy and notate C&A considerations?
-7. [ ] Did the tester document the specific criteria that the control is being
-       tested against?
-8. [ ] Did the tester notate in the supporting documents where each criterion
-       was satisfied?
-9. [ ] If testing specific policies or procedures, are the documents adequate?
-    - [ ] e.g., a test to validate that a review of policy XYZ occurs
-          periodically should also evaluate the sufficiency of the policy
-          itself, if meant to cover the risk that such a policy does not exist
-          and is not reviewed.
-10. [ ] Does the test cover the appropriate period under review?
-    - [ ] If the test is meant to cover only a portion of the audit period, do
-          other controls exist to mitigate the risks that exist for the
-          remainder of the period?
-11. [ ] For any computer-aided audit tools (CAATs) or other automation
-        techniques used in the test, is the use of such tools explained and
-        appropriately documented?
-12. [ ] If prior-period documentation exists, are there any missing pieces of
-        evidence that would further enhance the quality of the test?
-13. [ ] Was any information discovered during the walkthrough or inquiry phase
-        that was not incorporated into the test?
-14. [ ] Are there new rules or expectations from your company's internal
-        guidance or your regulatory bodies that would affect the audit approach
-        for this control?
-15. [ ] Was an exception, finding, or deficiency identified as a result of this
-        test?
-    - [ ] Was the control deficient in design, operation, or both?
-    - [ ] What was the root cause of the finding?
-    - [ ] Does the finding indicate other findings or potential fraud?
-    - [ ] What's the severity and scope of the finding?
-    - [ ] Do other controls exist as a form of compensation against the
-          finding's severity, and do they mitigate the risk within the control
-          objective?
-    - [ ] Does the finding exist at the end of the period, or was it resolved
-          within the audit period?