Lesson 6 of 6
Audit trail and evidence
9 min
Listen to this lesson
A migration ends; the questions about it do not. The external auditor will test the opening balances in the first year-end audit, and may ask about the migration again in later years. The answer to every question should be a document you can find in minutes, not a memory of someone who has left the program.
What auditors typically ask
| Question | Evidence that answers it |
|---|---|
| How do you know the migrated balances are complete and accurate? | Reconciliation reports at three points, with totals, counts and samples; signed acceptance |
| Who approved the mapping rules and when? | Approved mapping documents with version history, for example payment term CR30 to 0004 |
| What differences were found and how were they resolved? | The difference log with causes, resolutions and re-validation references |
| Were tolerances agreed in advance and applied consistently? | The approved tolerance policy and its application in each cycle |
| Who could change data during the migration? | Access lists for migration users, removal after go-live, and segregation between loading and validation |
| Were any manual adjustments posted? | List of adjustment postings with approvals and document numbers |
| Did anything post in legacy after cut-off? | Legacy period lock evidence and the cut-off reconciliation |
Questions external auditors commonly raise about a migration and the evidence that answers them.
The migration audit pack
Assemble one audit pack per migration, built during the program, not after it. For Contoso that means one pack for the conversion (1710, 1810) and one for Wave 2 (1910). Each pack has a fixed index, so anyone can find an item without the people who built it.
Making evidence usable
- Reproducible: each report shows its selection parameters, the system and client (CMP, not CMQ), the user and the run date and time.
- Unaltered: store outputs in a read-only or versioned repository; keep the original export next to any workbook built from it.
- Linked: the acceptance references each reconciliation; each difference references its evidence and fix.
- Retained: follow the company's record retention policy for financial records, which is usually longer than the program's life.
- Owned: after the program ends, a named finance owner holds the pack, not the departed system integrator.
- Plan approvedReconciliation plan and tolerance policy filed with approvals
- Each cycleReports, workbooks and difference log versions filed per mock
- CutoverFinal reports, signed acceptance and go/no-go minutes filed
- HandoverPack indexed and handed to the finance owner
- Year-end auditAuditor requests answered from the pack
What would you do?
Six months after go-live, the system integrator's team has left. The auditor asks for the reconciliation of fixed assets for 1810 at conversion. The workbook exists, but the asset history sheet output it was built from is missing. What does this show, and what should Contoso change for Wave 2?
- Auditors ask about completeness, mapping approvals, differences, tolerances, access and adjustments.
- Build one indexed audit pack per migration during the program.
- Evidence must be reproducible, unaltered, linked, retained and owned by finance.
- Keep segregation between loading and validating, and remove migration access after go-live.
Check your understanding · not graded
Lesson check
1. What makes a reconciliation report reproducible as evidence?
2. Who should own the migration audit pack after the program ends?
3. Why do auditors care about who loaded and who validated the data?