Is an electronic signature legally valid?

Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally enforceable if intent, consent, attribution, and record retention are satisfied.

When is notarization required?

Most internal audit checklists do not require notarization; notarization is only needed when a checklist or attached document creates or transfers legal rights requiring acknowledgment under state law.

How long should I retain completed workpapers?

Retain audit workpapers per the most stringent applicable rule: IRS records three years (IRC §6501(a)), HIPAA records six years (45 CFR §164.530(j)), or longer if state law requires it.

What if names or dates don’t match supporting evidence?

Mismatched names or incorrect dates can impair evidence validity and trigger requests for clarification; correct errors promptly and document reasons in the checklist notes.

Can I use simple image signatures for audit sign-off?

Simple electronic signatures are acceptable under ESIGN/UETA if the signing intent and attribution are clear; higher-assurance signatures may be required by internal policy or regulated industries.

How do I handle missing evidence during fieldwork?

Document attempts to obtain evidence, escalate to process owners, and note residual risk in findings; unresolved items should be tracked as open issues with remediation dates.

Electronic Signature
Templates
Miscellaneous
Internal Audit Checklist Template

Internal Audit Checklist Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Internal Audit Engagement Agreement and Checklist

Client Name: Auditor Name:

Recitals

WHEREAS, Client Name represented above (the "Client") operates business activities and systems that require periodic internal auditing to evaluate controls, risks, and compliance; and

WHEREAS, Auditor Name represented above (the "Auditor") is engaged to perform internal audit services described herein to assist the Client's management and board in assessing governance, risk management, and control effectiveness; and

WHEREAS, the parties desire to set forth the scope, deliverables, schedule, payment, confidentiality and other terms governing the engagement.

Scope of Work

Scope Description

Deliverables will include a written audit report detailing observations, findings, risk ratings, recommendations, and an agreed corrective action plan. The Auditor shall conduct fieldwork, testing, interviews, and document review sufficient to support conclusions documented in the audit report.

Audit Checklist — Assessment Areas

Use the following checklist items to record tests performed, evidence obtained, findings, and recommended corrective actions. Check the box when the control or requirement has been tested and evaluated.

1. Control Environment

a) Tone at the Top and Governance Structure

Tested Compliant Risk Rating:

Evidence / Notes Findings Recommended Action

Responsible Party: Due Date:

2. Risk Assessment and Management

a) Identification and Prioritization of Risks

Tested Compliant Risk Rating:

Evidence / Notes Findings Recommended Action

Responsible Party: Due Date:

3. Information Systems and Data Security

a) Access Controls, Change Management, and Backup Procedures

Tested Compliant Risk Rating:

Evidence / Notes Findings Recommended Action

Responsible Party: Due Date:

Payment Terms

Total Fee Payment Schedule Late Payment Fee

All payments are due pursuant to the Payment Schedule above. Unpaid balances beyond the stated due date shall accrue the Late Payment Fee and the Client shall reimburse Auditor for reasonable expenses of collection, including attorneys' fees where permitted by law.

Term and Termination

Engagement Start Date Engagement End Date Termination Notice Period

Either party may terminate this engagement for material breach by the other party if the breaching party fails to cure within the notice period specified above. Upon termination, the Client shall pay the Auditor for work performed through the effective date of termination, including reasonable wind-down costs.

Confidentiality

The Auditor shall maintain in confidence all non-public information obtained from the Client in connection with this engagement and shall not disclose such information except as required by law or with the Client's prior written consent. The confidentiality obligation shall survive termination for a period of years, except that trade secrets and legally privileged information shall remain protected for so long as allowed by applicable law.

Governing Law

Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified above, exclusive of its conflicts-of-law principles.

Entire Agreement

This Agreement, including the Scope of Work and any attachments executed contemporaneously, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings, whether written or oral. Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

Audit Summary

Executive Summary / Overall Conclusion Overall Risk Rating

The items, findings, and recommended corrective actions recorded on this checklist are intended for management's remediation and the Board's oversight. Management is responsible for implementing corrective actions and for providing evidence of remediation to the Auditor for verification.

Client Name:

By:

Date:

Auditor Name:

By:

Date:

What an Internal Audit Checklist Template Is and When It’s Used

An Internal Audit Checklist Template is a structured, reusable document that guides auditors through consistent, documented reviews of processes, controls, and compliance areas. It lists scope, objectives, procedures, evidence to collect, control tests, and fields for findings, severity ratings, and remediation actions. Organizations use the template to standardize audits across departments, track recurring issues, and produce audit-ready records for management and regulators. The checklist supports internal control frameworks, risk assessments, and follow-up monitoring, helping ensure audits are repeatable and auditable.

Why a Standardized Checklist Matters for Audit Quality

A formal template reduces variability, documents tested controls and evidence, and creates a single source of truth for findings and remediation.

Who Typically Uses an Internal Audit Checklist Template

Internal audit teams, compliance officers, risk managers, and process owners commonly use checklist templates to run and document reviews.

Internal Audit Teams: Use checklists to document tests of controls, capture evidence links, and produce workpapers for reporting.
Compliance Officers: Validate regulatory requirements, document exceptions, and escalate systemic noncompliance to leadership.
Process Owners: Confirm corrective actions, supply evidence, and track remediation status for assigned findings.

The template also supports external reviewers, internal control owners, and enterprise risk functions who need repeatable evidence and clear remediation tracking.

Core Sections to Include in a Professional Checklist

A complete template organizes the audit from scope to closure and ensures evidence, findings, and remediation steps are captured uniformly across engagements.

Audit Header

Identification data: audit title, owner department, lead auditor, effective date, period covered, and version control for traceability.

Scope & Objectives

Clear statement of what the audit covers, objectives, in-scope systems/processes, and reference to related policies and control frameworks.

Checklist Procedures

Step-by-step control tests and verification items with pass/fail options and fields for evidence references and sample sizes.

Findings and Severity

Structured fields for observation details, root cause, risk rating, business impact, and recommended remediation actions.

Remediation Tracking

Action owner, target completion date, status, and evidence of correction to support follow-up testing and closure.

Audit Sign-off

Fields for auditor, review manager, and business owner signatures, along with dates and version history for final acceptance.

Essential Information to Capture on Every Checklist

Audit Title: Unique identifier

Period Covered: MM/DD/YYYY range

Department: Business unit name

Lead Auditor: Name and contact

Evidence Links: Document paths

Risk Rating: Low/Medium/High

Step-by-Step: Completing an Internal Audit Checklist

Follow a consistent sequence from planning to closure to ensure all control tests and evidence requirements are completed and recorded.

01

Plan: Define scope and populate header fields
02

Test: Execute procedures and mark results
03

Document: Attach evidence and explain exceptions
04

Close: Assign remediation and obtain sign-offs

How to Configure a Digital Checklist Workflow

Define roles, notifications, and approval order before running the checklist to enable automated routing and maintain an audit trail.

Field	Configuration
Reviewer Role	Assign primary and secondary reviewers
Approval Order	Sequential or parallel routing
Notifications	Email and in-app reminders
Retention Rule	Auto-archive after closure

Digital Signing and File Formats to Support

Choose a platform that supports PDF and DOCX, captures audit trails, and integrates with enterprise storage and workflow tools.

File Formats: PDF, DOCX, XLSX
Integrations: Salesforce, Microsoft 365, NetSuite
Security: TLS 1.2/1.3 and AES-256

Where to Send or Store Completed Checklists

Decide on a central repository and access controls; route copies to audit committee, process owner, and long-term archive per retention rules.

Audit Repository: Secure document management system
Process Owner: Assigned owner for remediation
Executive Distribution: Summary to audit committee
Long-Term Archive: Retention store with immutable logs

Typical Timelines and Deadlines for Internal Audit Workpapers

Set clear deadlines for each engagement phase to ensure timely completion and enable regulatory or board reporting when needed.

Planning Complete:

2–4 weeks before fieldwork

Fieldwork Finish:

Depends on scope; typically 1–4 weeks

Draft Report:

Within 2 weeks after fieldwork

Management Response:

Typically due 10–20 business days

Closure Testing:

Follow-up within 60–180 days

Common Preparation Errors to Avoid

Using inconsistent naming conventions that make it hard to track versions and search historical audits.
Failing to attach primary evidence or linking to transient files that are later moved or deleted.
Leaving procedure results blank or using ambiguous language that obscures whether a control was tested.
Not assigning remediation owners or dates, which prevents meaningful follow-up and closure verification.

Risks and Consequences of Poor or Incomplete Checklists

Regulatory Exposure: Fines, enforcement

Financial Misstatement: Restatements risk

Operational Disruption: Unaddressed control failures

Reputational Harm: Stakeholder loss of trust

Audit Opinion: Adverse or qualified

Data Privacy: HIPAA/FERPA violations

Representative eSignature Pricing and Capability Snapshot

Compare baseline costs and key capabilities for eSignature vendors commonly used to complete and sign internal audit checklists and related workpapers.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About Using the Template

Answers to common questions about completion, signing, retention, and legal validity to help auditors and process owners avoid common pitfalls.

Need help? Contact support

Is an electronic signature legally valid?
Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally enforceable if intent, consent, attribution, and record retention are satisfied.
When is notarization required?
Most internal audit checklists do not require notarization; notarization is only needed when a checklist or attached document creates or transfers legal rights requiring acknowledgment under state law.
How long should I retain completed workpapers?
Retain audit workpapers per the most stringent applicable rule: IRS records three years (IRC §6501(a)), HIPAA records six years (45 CFR §164.530(j)), or longer if state law requires it.
What if names or dates don’t match supporting evidence?
Mismatched names or incorrect dates can impair evidence validity and trigger requests for clarification; correct errors promptly and document reasons in the checklist notes.
Can I use simple image signatures for audit sign-off?
Simple electronic signatures are acceptable under ESIGN/UETA if the signing intent and attribution are clear; higher-assurance signatures may be required by internal policy or regulated industries.
How do I handle missing evidence during fieldwork?
Document attempts to obtain evidence, escalate to process owners, and note residual risk in findings; unresolved items should be tracked as open issues with remediation dates.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now