Internal audit workpaper templates

Audit workpapers are the evidence artifacts that survive in the binder long after a control test is complete. Internal audit (or external audit, or your friendly local assessor) needs each workpaper to do three things: state the control being tested, attach the evidence observed at the test date, and carry the sign-off chain (preparer, reviewer, conclusion).

Auditors do this work today by hand: open a checker, screenshot the result, paste into a Word doc, fill in the sign-off block. This tool collapses the first half to a one-click download - the captured evidence is already wired into a workpaper-format PDF with the sign-off rows ready for the auditor's pen.

Five templates ship today: Email authentication posture (DMARC / SPF / DKIM / MTA-STS / BIMI), TLS / certificate inventory (chain, expiry, protocols, HSTS), Third-party sender inventory (vendor blast-radius classification), DNS + domain governance (NS topology, DNSSEC, CAA, registrar, blocklists), Incident-response readiness (DMARC reporting, TLS-RPT, abuse@ probe).

What each workpaper contains:

• Title block: workpaper reference (e.g. WP-EML-01), entity name, audit phase, period covered, evidence capture timestamp.
• Control objective: framework-language statement of what the control is supposed to do.
• Observed evidence: tables of the actual values resolved from public sources at the capture date. Monospaced so they're trivially comparable across runs.
• Auditor observations: automated findings the auditor confirms or rejects.
• Sign-off block: preparer, reviewer, conclusion / exception narrative.

Customise the title block via query parameters on the generator URL: ?entity=My%20Co, ?period=Q3%20FY26, ?phase=Interim, ?preparer=Alex%20Smith, ?reviewer=Sam%20Jones. The form on the result page wires these for you.