ITGC audit / Workpaper
Workpaper T-14: NS-OPS-02
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-OPS-02 |
| Objective | Restoration of critical-system backups is tested at least quarterly. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 8 system-quarters (4 critical systems x 2 quarters) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-005, EV-022, EV-023, EV-024, EV-025 (see evidence register) |
| Rule(s) applied | R-BKP-02 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (applies to this test).
Steps
- Obtain the restore register (EV-005). 2. For each critical system and quarter confirm a test is recorded. 3. Ask the owner to confirm the register is complete.
Expected result
At least one restoration test per critical system per quarter. Tolerable deviation: 0%.
Result
3 of 8 system-quarters failed (37.5%). Design review: The control says restoration is tested 'as scheduling permits', with no minimum frequency, whereas the backup standard requires quarterly testing.
Conclusion: Inconclusive; design deficiency noted
Limitations
Absence of a record is not proof that no test was run. Conclusion is held until the owner confirms completeness. Evidence EV-005: Register maintained manually; completeness not confirmed by owner.
Exceptions (3)
| Rule | Record | Detail |
|---|---|---|
| R-BKP-02 | SYS-03 | 2026-Q1 |
| R-BKP-02 | SYS-03 | 2026-Q2 |
| R-BKP-02 | SYS-07 | 2026-Q2 |
Design assessment
The control says restoration is tested 'as scheduling permits', with no minimum frequency, whereas the backup standard requires quarterly testing.
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.