Workpaper preparation for audit firms
Send the evidence package for one SOC 2, ISAE 3402 or C5 engagement. Get back a documented workpaper for every control, in your template and your style. Your reviewer reviews, concludes and issues.
It works as outsourced fieldwork support for controls testing, and it leaves your firm in charge.
What your firm gains
Senior capacity in busy months, without hiring
When reports cluster at one year-end, your senior people run out of hours. You hand over one engagement's package, and they spend their hours on review instead of on writing up. You do not need a new hire.
You keep control
You plan, review, conclude and issue. Osianic prepares. Nothing is issued by Osianic.
Your template and your style
Each workpaper is written in your firm's template and follows your sampling method. For a recurring client it follows last year's documentation style. It is not a standard set of procedures applied to every client.
A named senior auditor answers for the work
I decide every proposed conclusion myself before a workpaper is returned, and you deal with me by name. I was a Senior Manager in Digital Audit at a UK Big Four firm.
Start small
The first step is a paid pilot of ten controls that you choose. You judge the result with your own review checklist.
Clear answers on evidence
You are told in writing where your client's evidence is kept, who processes it and when it is deleted.
In plain words
- Workpaper
- Also called a working paper. The document that records how a control was tested, what evidence was seen and what was concluded.
- Evidence package
- Everything your client has provided for one engagement: documents, system settings, record lists and samples.
- SOC 2
- A report by a licensed audit firm on how a company protects the data it holds for its customers.
- ISAE 3402
- The international standard for a report on the controls of a company that provides a service to others.
- C5
- The German government's standard for the security of cloud services.
How workpaper preparation works
A short call. We talk for about 20 minutes about your engagements, your template and your busy months.
Agreements first. Before any evidence is sent, your firm and Osianic sign a contract and a data processing agreement. Your firm approves in writing how AI is used, and decides what its client must be told.
You send the package. You send the evidence, your workpaper template and your sampling method through your own secure channel. For a recurring client you add last year's workpaper.
The workpapers are prepared. AI tools sort the evidence to each control and draft the workpaper text to your method. I decide every proposed conclusion myself. Anything that needs your firm's judgement goes on a list of open points. Questions go to your team, never to your client.
You get them back. I upload the completed workpapers to your channel myself, with one list of open points for the whole package.
You review and conclude. Your reviewer reviews, concludes and issues. Osianic hands back and deletes its copy as the contract says.
Who decides what
| Your firm | Osianic | |
|---|---|---|
| Accepting the client and agreeing the scope | Decides | No part |
| Planning the engagement and setting the method | Decides | Follows your method |
| Testing the evidence and drafting each workpaper | Reviews | Prepares |
| The conclusion on each control | Concludes | Proposes, with reasons |
| Contact with your client | Yours alone | None |
| Issuing the report | Issues | No part |
| The engagement file | Keeps it | Deletes its copy as the contract says |
Start with a pilot of ten controls
You choose ten controls from a real engagement. You get ten workpapers in your template. The pilot is paid and priced by the control, so the first step is small. If the work is not what you need, you stop there.
Questions audit firms ask
Where does our client's evidence go?
It comes through your secure channel. Before any evidence is sent, the contract and the data processing agreement set out where it is kept, which providers process it and when it is deleted. No evidence is processed by AI unless the provider's terms forbid training on it. Nothing is sent until your firm has agreed to this in writing.
What will our peer reviewer say?
Your firm supervises, reviews and concludes. The procedures follow your method and your template for each engagement. They are not a standard set applied to every client. How you describe the arrangement to your reviewer is your firm's decision, and I will give you what you need to describe it.
Who answers for the work?
I do, by name. I decide every proposed conclusion myself before a workpaper is returned. Your reviewer then reviews and concludes, as with any work prepared for your file. The contract sets out who is responsible for what. Before you sign, I will tell you in writing what insurance cover the business holds on that date.
How is AI used?
AI prepares the paperwork. It sorts evidence and drafts workpaper text. Every judgement is made and logged by a person. Nothing is sent by AI. Your firm approves this in writing before any work starts.
Why not offshore preparers?
There are two reasons. The work is prepared under a senior auditor who has reviewed this kind of file, so it reads the way a reviewer expects. For a recurring client, each workpaper also follows your prior-year style.
What does it cost?
It is priced by the control, so a pilot of ten controls is a small first step. You get a written quote after the first call.
Which standards do you cover?
I cover SOC 2, ISAE 3402 and C5. If your firm works to another standard, ask.
Do you contact our clients?
No. Questions for your client go to your team. Your client remains your client.
Contact
Tell me which standards you report under and when your busy months are. I will suggest a time for a 20-minute call.
I read and answer every email myself. There is no form on this site and nothing to sign up for.