Audit Checklist Examples: Scope, Evidence, Findings and Closure

Audit checklist examples are most helpful when they show what the auditor is trying to prove. A list of yes/no questions may look tidy, but it can hide weak evidence, vague criteria and findings that nobody owns.

This guide uses a fictional consulting firm reviewing whether a strategy review engagement followed its approved report process. The examples cover audit scope, evidence to inspect, findings and actions, and closure review. The goal is not to certify anything. It is to show how a checklist can support an evidence-based review.

Example 1: Audit Scope and Criteria

The first checklist section should define what is being reviewed and against what standard. Without scope, every later answer is ambiguous.

Draft language:

Objective: Determine whether the strategy review engagement followed the approved recommendations-report procedure.

Scope: Discovery completion, evidence register, findings table, peer review and issue of final recommendations report for Project SR-24.

Period reviewed: [date] to [date].

Criteria: Approved SOP SR-Report-01, signed statement of work and project decision log.

This is narrow enough to audit. "Review project quality" is not. The ISO 19011 public preview defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria; it defines audit evidence as relevant and verifiable records, statements of fact or other information (ISO 19011 preview).

For consulting work, criteria often come from the contract, statement of work, internal SOP, client-approved scope, policy or quality plan. State them before collecting evidence so the reviewer is not inventing the rules after seeing the result.

Example 2: Evidence to Inspect

Each checklist question should point to evidence. A question that cannot be evidenced is usually a discussion prompt, not an audit item.

Example evidence checklist:

EPA audit guidance says a draft findings report should include enough detail for readers to understand the current status and should avoid unsubstantiated generalizations or ambiguous remarks (US EPA QA/G-7 PDF). That lesson starts at the checklist stage. If the evidence field says only "checked files", the finding will be hard to defend later.

Use sample notes when the population is large:

Sample: five of twelve interview-note entries selected from the evidence register, including the two entries used in Recommendation 3.

State sampling limits. One clean example does not prove consistent operation.

Example 3: Findings and Actions

An audit finding should connect criterion, evidence and effect. It should not be a complaint.

Weak finding:

The team did not manage comments well.

Stronger finding:

SOP SR-Report-01 requires factual corrections to be recorded separately from preference changes. The reviewed comment log combines both types in a single "client comments" column for draft versions 0.3 and 0.4. This makes it unclear which edits corrected facts and which changed recommendations.

Then assign an action:

Action: Engagement lead updates the comment log to classify comments as factual correction, preference change or scope change. Quality manager verifies before final issue. Owner: Engagement lead. Due: [date]. Closure evidence: revised comment log and quality-manager review note.

The 2024 revision of GAO Government Auditing Standards, paragraph 8.113, explains that sufficient and appropriate evidence provides a reasonable basis for findings or conclusions within the audit objectives. These are US government auditing standards; an ordinary consulting review should not claim to follow them unless that is actually part of its authorized scope. For the example here, the editorial review rule is narrower: connect each finding to the criterion tested and the evidence examined, then assign any agreed action to an owner.

Example 4: Closure Review

Closure is not the same as "the owner says it is fixed." Closure should verify the evidence agreed in the action plan.

Draft closure language:

The quality manager reviewed the revised comment log dated [date]. Each client comment is classified as factual correction, preference change or scope change. Recommendation 2 was revised after classification. The finding is closed for this engagement. Future engagements will be checked in the next internal project audit.

Sometimes closure should be conditional:

The immediate correction is complete. Effectiveness will be checked on the next two strategy review engagements because the issue involved recurring use of the comment log.

Keep limitations visible:

Limitation: The review did not inspect private analyst notes outside the approved project workspace. The conclusion applies only to the records listed in the evidence table.

Closure review should also decide whether the checklist itself needs improvement. If the audit found that the comment log combined factual corrections and preference changes, add a future checklist item that inspects comment classification earlier in the project. Otherwise the audit records the failure but leaves the review method unchanged.

Draft improvement note:

Add a checklist item for draft-report reviews: "Client comments are classified as factual correction, preference change or scope change before final recommendations are issued." The quality manager will test the revised checklist on the next strategy review audit.

This turns the audit into a learning loop. The corrective action fixes the project record, and the checklist revision improves the next review.

Operational Review Criteria

Before using an audit checklist, review it with these questions:

• Objective: Does the checklist state what the audit is trying to determine?
• Scope: Are period, project, process and exclusions defined?
• Criteria: Are requirements named before evidence is collected?
• Evidence: Does each item say what record, interview or observation supports the answer?
• Sampling: Is the sample method recorded where not all items are checked?
• Findings: Does each finding link criterion, evidence and effect?
• Actions: Does each action have an owner, due date and closure evidence?
• Closure: Is closure based on verification, not a promise?
• Limitations: Are evidence gaps or scope limits disclosed?

The EPA guidance warns that corrective actions will not be implemented if findings are not effectively communicated to the auditee through the findings report (US EPA QA/G-7 PDF). Write findings plainly enough that the process owner knows exactly what to fix.

If the checklist is used by a consultant reviewing a client's process, add one more check: confirm who owns the final management decision. The consultant may report evidence and suggested actions, but the client normally decides which operational change to accept.

Create a Reusable Checklist

The consulting audit checklist template is an editable Word document with sections for objective, scope and criteria, evidence and sampling, findings and classification, actions and verification. Use it to prepare a checklist for your own engagement records and review method.

The best audit checklist does not make the auditor look busy. It makes the evidence, judgment and follow-up visible enough that another reviewer can understand the conclusion.