I’m an auditor and if the auditee cannot provide documentation showing their claims are legitimate, the whole control fails because of lack of documentation. I don’t even need to look at anything else. If it’s not documented it never happened is our main response in these cases.

I’m an auditor and if the auditee cannot provide documentation showing their claims are legitimate, the whole control fails because of lack of documentation. I don’t even need to look at anything else. If it’s not documented it never happened.