The conversation that follows a control finding is nearly always the same. Someone from finance explains, correctly, that the reconciliation is performed every month and reviewed by a second person who genuinely reads it. The auditor agrees this is probably true and says it cannot be tested. Both leave believing the other has missed the point.
They are discussing two different things that share one name. One of them is the performance of a control. The other is the evidence that the performance happened, in the right order, by the right person, before the period closed. A control can be excellent at the first and produce nothing at all of the second, and only the second is what gets sampled.
This is why remediation programs stall. Companies respond to an evidence problem with a process improvement, which makes the work better and the file no thicker.
Performance And Evidence Are Different Things
The distinction is written into the auditing standards themselves. The standard on audit evidence (PCAOB, AS 1105) treats the inspection of records and documents as a primary procedure, and treats inquiry — asking the person whether they did it — as not sufficient on its own. The standard on audit documentation (PCAOB, AS 1215) applies the same logic to the auditor's own work: the file must let an experienced person with no prior connection to the engagement understand what was done, by whom, and when.
A control that leaves no durable trace is treated not as a weak control but as an absent one, because no available procedure could distinguish the two. A spreadsheet sits exactly on that line. It is superb at the calculation and silent about everything else.
| What a tester asks | What the file answers |
|---|---|
| Who performed this? | The last person to save it |
| When, relative to the close? | The last modification time, which may be later |
| Which version of the input was used? | Whatever is pasted in the tab |
| Was the reviewer a different person? | Nothing |
| What was rejected, and why? | Nothing — rejections are corrected in place |
| Did the steps run in the required order? | Nothing |
The last two rows are where most findings actually originate. An exception that was investigated and resolved correctly leaves the same file as an exception nobody noticed, because the resolution was applied by overwriting the original cell.
The file records the answer. The audit is about everything that happened before the answer.
Attention Is Not A Control
The most common remediation sentence in circulation commits to more review by more senior people. It is an appealing answer to give because it costs nothing to write, and it fails for a reason that researchers have measured for almost eighty years.
The original study of vigilance decrement (Mackworth, Quarterly Journal of Experimental Psychology, 1948) showed detection performance falling measurably within the first half hour of a monitoring task and continuing to fall after that. Sustained attention on repetitive checking work degrades, and it degrades fastest under time pressure and volume.
Period end is the window where volume and time pressure peak. The remediation plan is asking for the most attention at the moment the least is available. The design conclusion is to let the system carry sequence, identity, completeness and retention — the parts that are mechanical and unforgiving — and leave judgement to the person, who is good at it.
Make The Step Produce Its Own Record
The change that closes a finding is usually smaller than the plan implies. In most cases the spreadsheet should stay. What moves is performing and reviewing.
Four properties do essentially all the work:
- Identity. The person who performed the step is recorded from their sign-in, not from a typed name. The reviewer is a different identity, enforced rather than requested.
- Order and time. The step cannot be marked complete before its inputs are, and the completion time is recorded when it happens, not when someone remembers.
- Version. The exact input that was used is captured and then kept, so that any later question about which data extract fed the calculation has an answer.
- Exceptions as items. Anything that does not match becomes a thing with a state and an owner, rather than a corrected cell and a message in a chat window.
Such structure outperforms diligence in settings far harder than a monthly close. The trial of a surgical safety checklist across eight hospitals (Haynes et al., New England Journal of Medicine, 2009) reported substantial reductions in complications and death from a short structured procedure applied by teams already expert and trying. Making the required steps explicit, ordered and recorded changes outcomes among people who were not careless.
Language models are useful for reading a document or proposing a match, and wrong for the path that decides whether a step completed. Keeping AI on the surfaces and the execution deterministic is the shape that survives an audit: anything probabilistic is a suggestion a named person accepts or rejects, with the acceptance itself recorded.
First Steps
- Pick the control the auditor asked about last. Ask whoever performs it for the last three instances, unprepared. Time how long it takes and note what is missing.
- Write down the six questions a tester asks and mark which of those questions your current artifact answers. The unanswered ones are the specification.
- Do not change the calculation. Change where performance is recorded. Keeping the spreadsheet and moving the sign-off is a two-week change; replacing it is a project.
The Smallest Change That Closes The Finding
Most evidence findings do not require a new system of record, a consolidation project or a new hire. They require one workflow where the step cannot complete without leaving the six facts a sample asks for, and where exceptions live as owned items, not corrected cells.
A fifteen-minute call — nothing paid, nothing signed — takes one such control apart: what the record must contain, where each field comes from, and what it takes to build. Where the answer is build, that work runs as a monthly engineering partnership, with acceptance targets written down before each release starts and what happens when something goes wrong agreed in advance. The work runs in a repository we own, and paid-for deliverables transfer to you monthly — full history and documentation. The version of this approach that fails is the one in which the control gets more attention. Attention is the scarcest thing your team has in the last week of the quarter, and it leaves nothing behind for anyone to inspect.
References
- Public Company Accounting Oversight Board. AS 1105: Audit Evidence. PCAOB Auditing Standards.
- Public Company Accounting Oversight Board. AS 1215: Audit Documentation. PCAOB Auditing Standards.
- Mackworth, N. H. The Breakdown of Vigilance During Prolonged Visual Search. Quarterly Journal of Experimental Psychology, 1948.
- Haynes, A. B., et al. A Surgical Safety Checklist to Reduce Morbidity and Mortality in a Global Population. New England Journal of Medicine, 2009.
