ITGC audit / Workpaper
Workpaper T-09: NS-CHG-01
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-CHG-01 |
| Objective | Normal changes are approved by an independent authoriser before implementation. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 77 Normal changes (Normal-type changes in the audit period) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-003, EV-008, EV-010 (see evidence register) |
| Rule(s) applied | R-CHG-02, R-CHG-03 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Obtain the change register (EV-003). 2. Compare approver with requester. 3. Compare approval time with implementation time.
Expected result
Approver differs from requester and approval precedes implementation. Tolerable deviation: 0%.
Result
5 of 77 Normal changes failed (6.5%)
Conclusion: Not operating effectively
Limitations
Standard changes follow pre-approved templates and are covered by NS-CHG-05, which was not tested. Evidence EV-003: Export parameters show an end date of 2026-05-31.
Exceptions (5)
| Rule | Record | Detail |
|---|---|---|
| R-CHG-02 | CHG-0049 | SYS-02 Normal change approved by its requester E0379 |
| R-CHG-02 | CHG-0112 | SYS-05 Normal change approved by its requester E0262 |
| R-CHG-03 | CHG-0004 | SYS-01 approval 2026-01-28T10:15:00Z after implementation 2026-01-27T09:00:00Z |
| R-CHG-03 | CHG-0094 | SYS-04 approval 2026-06-23T10:15:00Z after implementation 2026-06-22T11:00:00Z |
| R-CHG-03 | CHG-0115 | SYS-05 approval 2026-01-21T10:15:00Z after implementation 2026-01-20T12:15:00Z |
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.