When auditors send a request list, some teams react the same way: someone forwards the email, people panic about deadlines, and evidence arrives in fragments over the next few weeks. The problem is not the requests themselves. It is that nobody owns the workflow. A request workflow is easier to run when it connects to audit working papers and a recurring compliance calendar.
Quick Answer
Auditor requests need one tracker, one coordinator, clear owners, and consistent naming. Treat fieldwork as a workflow so responses stay complete and easy to reconcile.
Name a single coordinator
One person owns each auditor request's logistics: who answers what, by when, in which file. The coordinator does not filter what auditors see. Performers speak to auditors directly during walkthroughs. Each request flows through one person and one tracker.
Without this role, requests get answered twice, files go out in different versions, and the compliance lead spends fieldwork weeks chasing their own team instead of supporting the audit. The coordinator also catches ambiguities early. A request on a long list often means something different from what the first reader assumes. A coordinator reads the entire list in the first couple of days and sends clarifying questions as one batch, not a trickle.
Build a tracker before you answer anything
The tracker is the single source of truth during fieldwork. Use the auditors' numbering exactly, in the tracker and in each file name and email. A long list with many attachments becomes difficult to manage if the numbering drifts.
| Tracker Column | Purpose |
|---|---|
| Item Number | Matches the auditor's list exactly |
| Request Description | What was asked for, verbatim |
| Owner | Named individual responsible for the response |
| Due Date | Aligned to audit milestones, not internal convenience |
| Status | Not started, in progress, sent, accepted, returned |
| Source Location | Where the evidence lives (system, folder, ticket number) |
| Notes | Questions, clarifications, missing items |
A shared spreadsheet works fine. The tool matters less than the discipline. Each update goes through the tracker. Each file sent to the auditor references the item number. Each clarification gets logged.
Triage the list early
The most expensive mistake with a request list is discovering late that an item meant something different from what you assumed. Read the whole list early and give each item one of five codes:
- Ready — evidence exists, just needs to be packaged and sent
- Pull needed — a system extract or report needs to be generated
- Clarify — the request is ambiguous and needs a question sent to the auditor
- Dependent — cannot be answered until another item is completed first
- Missing — the evidence does not exist and needs to be documented as a gap
This turns a pile of requests into a plan. It also surfaces each question while there is still time to ask it. Send clarifying questions as one message with a proposed answer for each item. Auditors typically accept a reasonable proposal, and a confirmed interpretation protects you if the item is questioned later.
Package evidence the way auditors test it
When auditors select a sample, each item gets tested against specific attributes: authorization, approval, correct period recording, and supporting documentation. Ask the auditor for their test attributes when the sample is issued. Most will share them.
Build the response around the agreed request and test attributes. Check period, scope, completeness, and source details before submission. Automated evidence collection may help with repeatable collection, but the output still needs review.
Each sampled item should live in its own folder named with the auditor's sample number. Put a one-line note in any folder where something is missing, explaining what and why. A missing document with an explanation is an exception the auditor can evaluate. A missing document with no explanation is a deviation, and a single deviation in a small sample can fail the entire test.
Do not filter or tidy the data
Preserve the original extract. Agree on scope, filtering, redaction, and secure transfer before sharing it. Document transformations and explain exclusions so the reviewer can reconcile the supplied population.
The same rule applies to system extracts. Run the extract with the auditor's parameters. Offer to let them watch the extract being run, or to run it themselves with read-only access. Both approaches are faster than the back-and-forth that follows when an extract is questioned.
Hold short status calls during fieldwork
Request lists back up when samples, questions, and walkthroughs converge. A brief weekly status call with the audit lead keeps things moving. Walk open items, agree on next dates, and bundle follow-ups.
If the volume is genuinely beyond what the team can absorb while doing its regular work, say so early. Audit functions plan hours for the auditee's time too, and most auditors prefer to re-sequence rather than receive half-answered requests. Hiding the overload is worse than disclosing it.
Track unanswered requests and communicate delays. Where evidence is missing, disclose the limitation and agree on the next step rather than implying that the request has been satisfied.
Handle multiple audit parties without duplicating work
Internal audit, external audit, regulators, and compliance testing can land in the same quarter, often asking for overlapping evidence. Two rules keep this manageable:
Send each party the same version of the same evidence. A population sent to internal audit that differs from the one sent to the external auditor raises a question neither party wants to ask.
Tell internal audit what the others are testing. An auditor who knows the external auditor already tested a control this quarter may be able to rely on that work instead of requesting it again. Coordination between assurance providers is a standard expectation. Keeping evidence fresh between cycles matters when multiple parties review the same data.
FAQ
What should the first response to an auditor request list include?
Send a confirmation that you received the list, name the coordinator, and propose a response timeline. Include clarifying questions for any ambiguous items as a single batch with proposed answers. Auditors prefer one organized message over days of back-and-forth.
How do I handle a request for evidence that does not exist?
Document the gap honestly. Put a note in the tracker explaining what is missing and why. A missing document with an explanation is an exception the auditor can evaluate and may result in a recommendation rather than a finding. Pretending the evidence exists is worse than the gap itself.
Can I use the same evidence for multiple auditors?
Yes. Send each party the same version of the same evidence. If internal audit and external audit both need your access review report, send the same file. Different versions create confusion and raise questions about which one is accurate.
What happens if my team cannot keep up with the request list during fieldwork?
Tell the audit lead early. Most auditors prefer to re-sequence requests than receive incomplete responses. Audit functions plan hours for the auditee's time, and hiding the overload leads to late, low-quality responses that extend the audit timeline further.
How do I prevent the same scramble each audit cycle?
Build a reusable request tracker template. Document which evidence requests repeat each cycle and where the source data lives. Assign backup owners for critical controls. The coordinator role and the tracker template carry forward from one audit to the next, reducing setup time each cycle.
<a href="https://www.truvara.ai/">CASK by Truvara</a> can help draft responses and evidence summaries from the request list and records you provide. The coordinator assigns owners, tracks deadlines, checks the supporting evidence, and approves what is shared with the auditor.