Every time we reviewed an exception.

The director would ask the same question.

“Why did we not ask this in the walkthrough?”

The first few times I froze.

I could explain what we tested.

I could explain what we found.

But I could not explain why the question that would have surfaced the issue earlier was never asked.

Then I realised something.

If I went back through most of the issues we raised, the majority could have been caught earlier.

Not with better testing.

With better walkthrough questions.

Every great finding starts with a great walkthrough.

The questions you ask in that meeting set the tone for every answer you will get.

Shallow questions produce shallow answers.

Generic questions produce generic process understanding.

Procedural questions miss every risk that lives outside the procedure.

Most auditors treat walkthroughs like a formality.

Confirm the process. Confirm the control owner. Confirm the frequency. Move on.

That is not a walkthrough.

That is a checklist.

A walkthrough is where you should be probing the edges of the process.

Because the edges are where things break.

The shift I made was simple.

Before every walkthrough, I stopped listing process steps to confirm.

I started listing things that could go wrong.

Then I built my questions around those failure points.

Not what the process is.

What happens when it does not work.

What happens when someone bypasses it. What happens when the system is down. What happens when the control owner is on leave.

Those questions surfaced things a standard walkthrough never would.

And when the findings came later, I already knew the story behind them.

Because I had already heard it in the walkthrough.

Think about the last finding you raised. Could a better walkthrough question have surfaced it earlier?

Everything in this newsletter comes from lived experience. Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open. If you want to explore more, everything lives here.

You are not alone in figuring this out. I am here every week.

Chinmay Kulkarni

https://chinmaykulkarni.in/

Who performs the control?

How often?

Who reviews it?

What evidence is retained?

What happens next?

All useful questions.

But there was a problem.

Most of them helped me understand how the process was supposed to work.

They didn’t necessarily help me understand where it could fail.

That distinction changed the way I approach walkthroughs.

Because a walkthrough shouldn’t simply confirm the process description.

It should help you understand the process well enough to challenge it.

There is a big difference.

Imagine someone explains a process to you.

First, this happens.

Then someone reviews it.

Then an approval happens.

Then the evidence is retained.

Everything sounds reasonable.

You could document the walkthrough and move on.

But understanding the sequence is only the beginning.

The more important questions often sit underneath it.

What happens when this step fails?

Can this process ever be bypassed?

What happens when the usual reviewer is unavailable?

Where does someone need to exercise judgment?

What would happen if that judgment was wrong?

When was the last time an exception occurred?

Those questions change the conversation.

You stop documenting a process.

You start understanding its risk.

And that changes everything that comes afterwards.

Your understanding of the control becomes sharper.

Your testing becomes more purposeful.

You know which evidence matters.

You know where you need to challenge further.

And when something doesn’t look right, you understand why it matters instead of simply knowing that an attribute failed.

This is why I no longer judge the quality of a walkthrough by how many questions I managed to get through.

A prepared list still matters.

Preparation gives you the foundation.

But the best question in a walkthrough is often the one you didn’t write down beforehand.

It comes from listening carefully enough to notice something that doesn’t quite make sense.

A dependency.

An assumption.

A manual intervention.

An unusual scenario.

A sentence that makes you think:

“Wait. What happens if that doesn’t work?”

That question might take the conversation somewhere you hadn’t planned.

Good.

That is often where the real understanding begins.

I see walkthroughs differently now.

They are not information-gathering meetings.

They are thinking sessions.

Your job isn’t to prove that you prepared twenty questions.

Your job is to leave understanding the process, the control, and the risk better than you did when you entered.

Because weak questions can still produce a beautifully documented walkthrough.

They can still produce a completed workpaper.

They can still get you through review.

But completion and understanding are not the same thing.

And when the understanding is shallow, everything downstream becomes weaker.

What you test.

What evidence you request.

What you challenge.

And ultimately, what you conclude.

So before your next walkthrough, prepare your questions.

But don’t become trapped by them.

Listen for the moment when the process stops sounding obvious.

Then ask the question that isn’t on your list.

That might be the most important question of the entire audit.

A question to reflect on

In your last walkthrough, were your questions helping you understand how the process works?

Or were they helping you discover how it could fail?

Thank you for reading Clarity with Chinmay.

If this edition made you reconsider how you approach walkthroughs, share it with an auditor who still thinks a successful walkthrough means getting through every question on the list.

It was watching how people reacted to them.

Early on, I used to think the conversation would be straightforward.

The evidence was there.

The testing was complete.

The control had a weakness.

I assumed the discussion would focus on the facts.

It rarely did.

Sometimes the stakeholder questioned the testing.

Sometimes they challenged the wording.

Sometimes they explained why the process had to work that way.

At first, I thought they were arguing with the finding.

Over time, I realized something important.

They weren’t arguing with me.

They were protecting something else.

Think about it from their perspective.

They may have designed that process.

They may have owned it for years.

Their team follows it every day.

Now an auditor walks in and points out a weakness.

What they hear isn’t always,

“This control has a gap.”

Sometimes they hear,

“You didn’t do your job.”

That’s a very different conversation.

And it’s a very human reaction.

Once I understood that, I changed how I approached audit discussions.

I stopped trying to convince people that my finding was correct.

Instead, I focused on helping them understand the risk.

Not,

“You missed this control.”

But,

“Here’s what could happen if this control doesn’t operate consistently.”

Not,

“This process is wrong.”

But,

“Here’s the business exposure we’re trying to reduce.”

That small shift changed the quality of my conversations.

Because people are much more willing to discuss risk than defend their reputation.

I also realized something else.

The objective of an audit discussion isn’t to prove that someone made a mistake.

It’s to help the organization make a better decision about risk.

Those are two completely different goals.

When the conversation becomes about blame, people naturally become defensive.

When the conversation becomes about protecting the business, people become part of the solution.

That doesn’t mean every discussion becomes easy.

There will always be disagreement.

There will always be difficult conversations.

But your role as an auditor isn’t to win an argument.

It’s to create enough clarity that management can make an informed decision.

That’s where audit creates value.

Not when the finding is written.

Not when the report is issued.

But when people understand the risk well enough to act.

Looking back, one lesson changed the way I communicate findings.

Every finding is technical.

Every conversation is human.

The auditors who understand both are the ones who leave the biggest impact.

A question to reflect on

The next time a stakeholder pushes back on one of your findings, pause for a moment.

Are they disagreeing with your evidence?

Or are they trying to protect something that matters to them?

Thank you for reading Clarity with Chinmay.

If this edition resonated with you, consider sharing it with another auditor who’s learning that great audit conversations start with understanding people, not just controls.

The testing was complete.

The evidence was documented.

The workpaper was signed off.

I felt accomplished.

Then I moved on to the next control.

That was my mindset during my early years.

At EY, my work focused on integrated audits supporting the financial statement audit.

If an issue surfaced in an IT application control or an IT general control, we documented it and passed it to the team responsible for consolidating the final deficiencies.

Finding the issue felt like the finish line.

Then I moved into Internal Audit.

That is when I realized I had been celebrating too early.

Because writing the finding was only halftime.

The second half was far more difficult.

Nobody enjoys being told that something they own is broken.

Think about it.

The process owner may have designed that control.

Their team may have been operating it for years.

They may genuinely believe it works.

Now an auditor walks into the room and says,

“There is a weakness.”

The conversation is no longer about evidence.

It becomes about trust.

About perspective.

About helping someone see a risk they don’t yet believe exists.

That is where the real work begins.

A technically correct finding that nobody accepts creates very little value.

An average finding that leads to meaningful improvement creates far more.

Over time, I realized that great auditors don’t stop after identifying the issue.

They help stakeholders answer three questions.

Why does this matter?

Not from an audit perspective.

From a business perspective.

What could actually happen if this control fails?

What risk is the organization accepting?

Why should I believe this finding?

Can you clearly explain your evidence?

Can you connect the control weakness to the risk?

Can your conclusion withstand healthy skepticism?

What should we do next?

A finding should create clarity.

Not confusion.

The goal is not to prove that management is wrong.

The goal is to help management make a better risk decision.

That changed the way I look at audit.

Today, I spend as much time thinking about how I communicate a finding as I do identifying it.

Because the quality of an audit is not measured by the number of findings it produces.

It is measured by the improvements those findings create.

The finding is only the beginning.

The conversation that follows is where trust is built.

Where judgment is tested.

And where auditors create their greatest value.

A question to reflect on

Think about the last finding you raised.

Did you only prove that a control failed?

Or did you help the business understand why it mattered?

Thank you for reading Clarity with Chinmay.

If this newsletter helped you think differently about audit, consider sharing it with another auditor who is learning that great auditing is as much about influencing people as it is about testing controls.

See you next week.

I was handed a prior year workpaper and told to replicate it.

So I did.

I described the control. I attached the evidence. I wrote the conclusion. I pushed it up the chain.

Nobody stopped me to ask whether I understood what the automated portion of the control actually did. What data it relied on. What would happen if the trigger failed to execute on time.

I did not know those questions existed.

Years later I sat in meetings with auditors who had far more experience than me. And I could tell within minutes. Not from what they said. From what they could not answer.

The workpaper had been completed. The understanding was never there.

That is the gap I built this template to close.

It is an IT Application Controls Testing Lead Sheet.

10 sections. Every section is a question a good manager, a regulator, or an informed client would ask you about the control you are testing.

Section 5 alone is worth downloading it for. It is the section that asks you to isolate exactly what the system does automatically. Most ITAC workpapers I have reviewed skip this entirely. That is why most ITAC conclusions are not fully defensible.

It is free.

Completely free.

No course pitch at the end.

Download it. Use it on your next engagement. Tell me what you think.

This is what Clarity with Chinmay is for. Giving you what nobody gave me.

Download the template below.

Note: This template is based on my personal experience in IT audit across public accounting and internal audit. It is intended as a practical reference tool and does not constitute professional audit guidance, regulatory advice, or a substitute for your organisation’s methodology. All views expressed are my own and do not represent any affiliated institution. The template is shared in good faith for educational purposes. Adapt it to your engagement context before use. No two audits are identical.

The control was simple in principle.

The system was designed to reject unbalanced journal entries.

Only balanced entries could be posted.

That was the control objective.

To test it, I needed two things.

Positive testing.

And negative testing.

Positive testing was straightforward.

We posted a balanced journal entry.

The system accepted it.

Evidence captured.

Then I asked the stakeholder to help me with the negative test.

Try posting an unbalanced entry.

Show me the system rejecting it.

That is where the conversation stopped.

The stakeholder hesitated.

Then refused.

“We cannot do that. What if the system crashes? This is production. We are not breaking it for an audit.”

I tried to negotiate.

He was firm.

The walkthrough call ended without the evidence I needed.

I was stuck.

I could not push harder.

This was a long standing client relationship.

I had to find another way.

After the call I went to my manager.

We talked through it.

And that is where I learned something I had not been taught in any training.

There is a way to test controls when production is off limits.

You do it in a non production environment.

But you cannot just run the test there and call it done.

You have to do more.

Here is the principle.

If you test a control in non production, you have to prove that the non production environment is identical to production.

If the environments are not identical, your test is meaningless.

The system might behave differently in production. The control might not exist. The version might be different.

Your evidence is only as strong as the environment you tested in.

So when you take this route, you have to add procedures.

The procedures look like this.

Verify the version of the system in non production matches the version in production.

Verify the configurations match.

Verify the rules engine, the validation logic, and the relevant settings are identical.

Verify the refresh frequency.

A non production environment that is refreshed monthly is reasonable.

One that has not been refreshed in a year is not.

Document every check.

Take screenshots of both environments side by side.

Show the reviewer that what you tested in non production reflects production reality.

Only then is the negative test defensible.

I went back to the stakeholder.

I did not push him to break production.

I asked them to perform the testing in non production environment.

We ran the negative test there.

The system rejected the unbalanced entry as expected.

I documented everything.

The version match. The configuration match. The refresh frequency. The screenshots.

The control was tested.

The client relationship was preserved.

The workpaper was defensible.

Most auditors do not know this option exists.

When the client refuses, they either give up or settle for a weaker conclusion.

Neither is acceptable.

A skilled auditor finds a way to test the control without putting the client in a difficult position.

That is what separates a checklist auditor from someone who actually provides assurance.

Leave a comment

1 Question For You

The next time a stakeholder refuses to let you test something in production, will you give up?

Or will you ask for the non production environment with the right additional procedures?

That choice is what defines the quality of your evidence.

Call to Action

The next time you are scoping an automated control, plan your negative testing approach in advance.

Identify whether production testing is feasible.

If not, request them to perform the testing in non production early.

Build the additional procedures into your testing plan from day one.

That preparation is what makes the difference when the stakeholder says no.

The world is full of AI generated content. The world is full of noise.

Everything in this newsletter comes from lived experience. Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open. If you want to explore more, everything lives here.

You are not alone in figuring this out. I am here every week.

Chinmay Kulkarni

Audit Hub: https://chinmaykulkarni.in/

Substack:

Clarity with Chinmay

My weekly newsletter where I share insights and valuable knowledge on IT auditing, personal lessons learned and everything else that will set you up for success!

By Chinmay Kulkarni

A partner said something to me.

Casually.

Like it was obvious.

It was not obvious to me at the time.

“Wherever you state something, you are presenting your opinion and judgment. Make sure every statement has evidence behind it.”

That was it.

One sentence.

He moved on with the conversation.

I did not.

That sentence rewired how I write workpapers.

Before that moment, I was writing narratives.

Confident ones.

Clear ones.

Well structured ones.

But I was not auditing my own statements.

I was assuming the reader would trust what I wrote because I had written it clearly.

That is not how audit works.

An independent reviewer does not know your control.

Does not know your environment.

Does not know your reasoning.

All they have is what you wrote.

The moment they read a statement without evidence, their brain asks one question.

Where is the proof?

If your workpaper cannot answer that question without you in the room, it is not finished.

Every statement needs a backing.

Determining operating effectiveness?

Show the evidence.

Stating a fact about the control?

Cite the source.

Drawing a conclusion?

Document the reasoning that got you there.

It is not enough to know why you wrote what you wrote.

The workpaper has to show it.

This matters even more now.

AI will give you a narrative.

A clean one.

A confident one.

A well structured one.

But AI hallucinates.

It will produce sentences that sound right but cannot be defended.

Our profession runs on one principle.

Trust but verify.

That applies to every statement you write.

Including what AI writes for you.

Especially what AI writes for you.

The next time you finish a workpaper, do one thing.

Read every sentence and ask whether the evidence directly supports it.

Not nearby.

Directly.

If a reviewer cannot trace the statement to a specific piece of evidence in your file, the statement is not yet earned.

That is the standard.

Not whether it sounds confident.

Not whether it reads well.

Whether it can be defended without you in the room.

1 Question For You

How many statements in your last workpaper had no evidence directly behind them?

Before your next submission, read your workpaper one more time.

For every claim you have made, point to the exact piece of evidence that supports it.

If you cannot, that is the gap to close before anyone else finds it.

The world is full of AI generated content. The world is full of noise.

Everything in this newsletter comes from lived experience. Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open. If you want to explore more, everything lives here.

You are not alone in figuring this out. I am here every week.

Chinmay Kulkarni

Audit Hub: https://chinmaykulkarni.in/

Substack:

Clarity with Chinmay

My weekly newsletter where I share insights and valuable knowledge on IT auditing, personal lessons learned and everything else that will set you up for success!

By Chinmay Kulkarni

It is not.

But many auditors still walk into stakeholder conversations with that lens.

I have seen peers open a change management testing meeting by hunting for the one ticket that was not approved.

I have seen auditors run user access reviews looking specifically for what was missed.

I have seen junior auditors enter walkthrough meetings with a list of gotchas instead of a real understanding of the process.

That energy is felt the moment you walk into the room.

And it is the reason your stakeholders go defensive before you have even asked your first question.

The auditors who struggle are not the ones with knowledge gaps.

They are the ones who walk in looking for something wrong.

Stakeholders pick up on that energy immediately.

The moment they sense you are questioning their decisions instead of trying to understand them, they pull back.

The audit stalls.

Conversations become guarded.

Evidence requests take longer.

Findings land badly.

And then the auditor walks away thinking the stakeholder was difficult.

The stakeholder was not difficult.

The stakeholder was responding to the energy you brought into the room.

Here is the shift that changes everything.

You are not against the stakeholder.

You are not testing them.

You and the stakeholder are on the same side.

Both of you versus the risk.

The control owner did not design the process to fail. They designed it to work.

Your job is not to catch them.

Your job is to understand the process, identify where things can go wrong, and have an honest conversation about whether the existing controls address that risk.

That shift shows up in how you ask questions.

Instead of “Why did you do it this way?”

Try “Can you help me understand the rationale here?”

Instead of “Why was this change not approved?”

Try “Walk me through how approvals usually work for this type of change.”

Instead of “This control failed.”

Try “Here is the risk we think exists if this control did not operate as designed. What are your thoughts?”

The information you collect is exactly the same.

But the tone, the posture, the energy is completely different.

The stakeholder stops defending.

They start engaging.

The audit moves forward.

No amount of AI, data analytics, or sampling rigour changes this.

At the end of every audit there is a negotiation with a human being waiting.

Whether it is a finding discussion. A control rating debate. A management response.

Are you preparing for that conversation with the same rigour you prepare for control testing?

If not, you are leaving half the audit on the table.

The technical work matters.

The human work matters more.

1 Question For You

Think about your last stakeholder meeting.

Did you walk in trying to understand the process?

Or did you walk in trying to catch something?

The answer to that question already tells you why the meeting went the way it did.

Call to Action

In your next walkthrough or evidence request meeting, change one line.

Replace “why did you do it this way” with “can you help me understand the rationale here.”

That one swap will tell you everything about how much smoother the conversation becomes.

The world is full of AI generated content. The world is full of noise.

Everything in this newsletter comes from lived experience. Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open. If you want to explore more, everything lives here.

You are not alone in figuring this out. I am here every week.

Chinmay Kulkarni

Audit Hub: https://chinmaykulkarni.in/

Substack:

Clarity with Chinmay

My weekly newsletter where I share insights and valuable knowledge on IT auditing, personal lessons learned and everything else that will set you up for success!

By Chinmay Kulkarni

They ask the control owner what happens.

They write down what they were told.

They attach the email or note from the walkthrough.

And they call it evidence.

It is not.

It is a record of a conversation.

That is the gap most workpapers carry quietly until a manager or a regulator asks the question nobody wants to hear.

“How do you know what they told you is true?”

If your workpaper cannot answer that, you have a problem.

There are four audit procedures.

Most auditors can name them.

Few apply them with the discipline they require.

Here is what each one actually proves and what it does not.

1] Inquiry

Obtaining information through questions. In meetings, emails, walkthroughs, or conversations.

Inquiry proves what someone told you about the control.

It does not prove that what they told you is accurate or that it actually happened.

Inquiry is never sufficient on its own.

It is the starting point of testing. Not the conclusion.

If your workpaper is built only on inquiry, you have not audited anything.

You have documented a conversation.

2] Observation

Directly witnessing the control being performed. Live, virtually, or in person.

Observation proves the control was performed correctly at the moment you observed it.

It covers only that moment.

Not the entire audit period.

Watching a control owner reject an unauthorised change in a walkthrough tells you the control worked once. It does not tell you it worked the other 364 days of the year.

Pair observation with inspection or reperformance to cover the full period.

3] Inspection

Reviewing documents, screenshots, system reports, tickets, or offline records.

Inspection proves the document or record exists and contains what it claims to contain.

This is the most common procedure in ITGC and ITAC testing.

Inspecting an approved change ticket. Reviewing a user access listing. Checking a system generated log.

Inspection is strong. But on its own it tells you what was recorded. It does not tell you the underlying activity happened the way the document describes it.

Pair inspection with inquiry and observation when needed.

4] Reperformance

Independently redoing the exact steps the control owner performed.

Reperformance proves the control produces the correct result when executed independently by you.

This is the most rigorous procedure in audit.

It is non-negotiable for calculation controls, reconciliations, and anything where a number must be defended.

Recalculating a purchase order total and tying it to the system output. Independently extracting a population and comparing it to the one provided. Re-running an access rule against the user listing.

If you have done reperformance well, no reviewer will challenge your evidence sufficiency.

The Rule

Every control attribute must be supported by at least two procedures.

Inquiry must always be paired with inspection, observation, or reperformance.

A workpaper built only on what people told you is not a workpaper.

It is a record of conversations.

What they told you is not what you verified.

The auditors who get trusted are the ones whose workpapers can answer one question without hesitation.

“How do you know?”

If your answer starts with “the control owner told me” and stops there, the workpaper is incomplete.

If your answer includes what you inspected, observed, or reperformed alongside what you were told, the workpaper defends itself.

That is the difference between completing a control test and providing reasonable assurance.

1 Question For You

Open the last workpaper you submitted.

For every control attribute you tested, can you point to at least two procedures supporting it?

If inquiry is the only one, the gap is not in the control.

It is in the workpaper.

Before your next control test, write down the two procedures you will apply to each attribute.

Not after. Before.

That one habit will change the quality of every workpaper you submit going forward.

The world is full of AI generated content. The world is full of noise.

Everything in this newsletter comes from lived experience. Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open. If you want to explore more, everything lives here.

You are not alone in figuring this out. I am here every week.

Chinmay Kulkarni

https://chinmaykulkarni.in/

Clarity with Chinmay

My weekly newsletter where I share insights and valuable knowledge on IT auditing, personal lessons learned and everything else that will set you up for success!

By Chinmay Kulkarni

We were talking recently and he said something I was not expecting.

“I just do not know how to keep up. Every week there is a new AI agent, a new tool, a new thing the organisation is pushing. I feel like everyone around me knows something I do not.”

I did not immediately give him an answer.

Because I recognised exactly what he was feeling.

The pressure to use everything.

The guilt of not using anything.

The quiet fear that everyone else has figured it out and you are the only one still catching up.

Here is what I told him.

You do not need to use every AI tool your organisation promotes.

You do not need to learn every agent, every platform, every workflow that lands in your inbox.

You need to answer one question first.

Where am I spending time that does not require my thinking?

That is where AI belongs.

Not everywhere. There.

There are three places AI will immediately give you time back in audit.

1 - Repetitive tasks that do not require your judgment.

Writing emails. Drafting follow up requests. Replying to routine messages. Summarising meeting notes.

These tasks consume time but they do not require the thinking that makes you a better auditor.

Hand them to AI. Get that time back.

2- Understanding concepts faster.

When you encounter a new risk area, a new control type, a new regulatory requirement, use AI to understand it before you go into the room.

Not to replace your thinking. To accelerate it.

Ask it to explain the risk.

Ask it to challenge your understanding.

Ask it to find the gaps in your reasoning.

That is AI making your thinking sharper, not replacing it.

3 - Automating mechanical tasks.

Excel formulas. Python scripts. Data formatting. Population preparation.

If it is mechanical and repeatable, AI can do it faster than you.

Let it.

But here is the filter I apply before I invest time in any new tool.

If learning this tool takes five hours and saves me one hour of work, it is not worth it.

If learning this tool takes one hour and saves me five hours across the next month, it is worth it.

That is the only question.

Does this tool carve out time I can spend thinking better in audit?

If yes, use it.

If no, ignore it.

You do not need to be an AI expert.

You need to be an auditor who uses AI to protect the time that matters.

My friend left that conversation a little less anxious.

Not because I gave him a list of tools.

Because I gave him a filter.

Start there.

3 Ideas From Me

I. Do not be afraid of trying new things. Everyone is learning. Every single person in that room is figuring it out as they go. Curiosity is not a weakness. It is the only honest response to a world that keeps changing.

II. How you present yourself in a room full of professionals matters. Our profession is a respected one. Walk in like you belong there, because you do.

III. Never go into a stakeholder meeting treating it like an interview. You are not there to impress them or answer their questions. You are there to understand their process and evaluate their controls. That shift in posture changes everything.

2 Things I Wish Someone Had Told Me Earlier

I. Time boxing your day around specific tasks is not a productivity hack. It is the difference between getting things done and getting the right things done. You do not need a sophisticated tool. You need one place where everything is noted down and nothing is forgotten.

II. You do not need another app to manage your tasks. One note. One list. One place. As long as it is written down somewhere and you return to it, that is enough.

1 Question For You

Tomorrow morning, before you open anything else, look at where you spent your time yesterday.

How much of it required your actual thinking?

How much of it could have been handed to AI?

That gap is where you start.

The world is full of AI generated content.

The world is full of noise.

Everything in this newsletter comes from lived experience.

Things I have personally tested, failed at, learned from, and carried forward.

No theory. No generic advice. Just what I know to be true.

If you ever need anything, my inbox is open.

If you want to explore more, everything lives here.

You are not alone in figuring this out.

I am here every week.

Chinmay Kulkarni

They told me what to test.

I mapped the evidence.

I submitted the workpaper.

And I kept getting review comments.

I thought the work was hard.

I thought the controls were complex.

I thought I needed more experience.

None of that was true.

The real problem was simpler and more uncomfortable than any of that.

I did not understand why I was doing what I was doing.

I was completing work without understanding the process behind it, the risk it was designed to address, or why the control existed in the first place.

I was auditing on autopilot.

That is when I built something for myself.

Not a framework I read in a textbook.

Not something a certification taught me.

Something I developed because I was tired of not being able to answer my manager’s questions.

I called it PRC.

Process. Risk. Control.

In that order. Always in that order.

Process first.

Before you test anything, understand the business process the control sits inside.

Where does data flow? Where does it originate? Where does it go?

What are the steps? Who is responsible for each one?

If you cannot draw the process from memory, you do not understand it well enough to audit it.

Risk second.

Once you understand the process, ask where things can actually go wrong.

Not what the audit objective says can go wrong.

What can actually go wrong in this specific process at this specific organization.

What is the realistic failure point? What is the consequence if it fails?

That is the risk you are there to evaluate.

Control third.

Only after you understand the process and the risk does the control make sense.

Now you can see whether the control actually addresses the risk.

Whether it is designed effectively.

Whether the evidence you are collecting actually demonstrates it is operating effectively.

Without PRC, you are testing evidence against a description.

With PRC, you are evaluating whether a control addresses a real risk in a real process.

That is the difference between completing work and providing assurance.

My manager stopped giving me review comments not because I worked harder.

Because I started understanding what I was testing before I tested it.

PRC gave me the why behind every workpaper.

It will do the same for you.

3 Ideas From Me

I. Quality work takes time because it requires understanding. If you are rushing through a control, you are not auditing it. You are processing it. There is a difference and your manager can see it immediately.

II. Before you submit anything, ask yourself one question. Is this work presentable to someone who has no context? If you have to explain it verbally, the workpaper is not finished.

III. Review your own workpaper before you submit it. Not a quick scan. A real review. Half the comments your manager raises are things you would have caught yourself if you had sat with it for ten more minutes.

2 Things I Wish Someone Had Told Me Earlier

I. Your work is your brand. Every workpaper you submit is a signal about how you think. Protect that signal from day one because it compounds in every direction.

II. Do not be in a hurry to learn new things. Spend time with what is in front of you. Make the most of the tools and resources you already have before chasing the next thing. Depth always beats breadth in this profession.

1 Question For You

In your next control test, can you explain the process it sits inside, the risk it is designed to address, and why your evidence demonstrates the control is operating effectively?

If you cannot answer all three, you are not ready to test it yet.

Before your next control test, apply PRC.

Write down the process first. Identify the risk second. Then and only then evaluate the control.

Do this once deliberately and see how differently you approach the evidence.

Until next week,

Stay curious

Chinmay

She never had to call me.

She never had to ask what I meant.

She picked it up, read it, and could defend every conclusion I had formed.

That was not an accident.

That was the standard I had set for myself before I even submitted it.

Most auditors write workpapers for the person sitting next to them.

The manager who was in the meeting.

The senior who knows the context.

The colleague who was there for the walkthrough.

But your chief auditor was not in that walkthrough.

Your regulator was not in that fieldwork meeting.

Your inspector was not there when the control owner explained the process.

Your workpaper is their only version of you.

It is the only thing that speaks on your behalf when you are not in the room.

And most workpapers are written as if someone who already knows everything will be reading them.

They will not.

A workpaper that defends itself does three things.

It tells the reader what risk was being addressed.

It explains why the evidence collected is sufficient to form a conclusion.

It states that conclusion clearly enough that someone with no prior context can understand and defend it.

That is it.

Not more detail. Not longer narratives.

Just those three things done with precision.

The next time you are about to submit a workpaper, ask yourself one question.

If my chief auditor picked this up tomorrow without any context, could they explain it to a regulator?

If the answer is no, it is not ready.

Not for your manager.

Not for your file.

Not for anyone.

Write it for the person who was not in the room.

That is the standard.

3 Ideas From Me

I. Walkthroughs are not about ticking agenda items. They are about understanding the business process first. Listen. Understand. Then think.

II. Generic checklists do not cut it in walkthroughs. The questions you ask should be tailored to the specific risks of that business process. That is what separates a walkthrough from a conversation.

III. Want to grow faster? Start by admitting what you do not know. Honesty about your gaps is not weakness. It is the only honest starting point for getting better.

2 Things I Wish Someone Had Told Me Earlier

I. Asking for help is not a sign that you are behind. It is a sign that you are serious about getting it right. The auditors who ask the right questions early close gaps faster than anyone else in the room.

II. No one knows everything. The pressure to have all the answers is real but it is also a trap. The moment you stop pretending to know is the moment people start trusting you more.

1 Question For You

If your chief auditor picked up your last workpaper tomorrow with no context, could they defend every conclusion in it without calling you?

If this made you think differently about how you document your work, share it with one person on your team before your next engagement.

Not yet subscribed to Clarity with Chinmay? This is the weekly conversation you have been missing.

Subscribe now

Deadlines in bold. Evidence lists numbered. Tone that assumes compliance.

And then the auditor wonders why the stakeholder is unresponsive.

Why the evidence is incomplete.

Why follow ups go unanswered.

The answer is almost never the stakeholder.

It is the email.

Here is something most auditors never stop to consider.

You are the last group of people the first and second line of defense wants to hear from.

They have their own work. Their own deadlines. Their own pressures.

Every request you send is extra work on top of everything they are already carrying.

If someone handed you extra work outside your job description with a tight deadline and a demanding tone, how would you respond?

You would deprioritize it.

You would give the minimum.

You would feel obstructed.

That is exactly how your stakeholders feel when your emails are written without empathy.

And yet we wonder why people dislike auditors.

It is not because of what we ask for.

It is because of how we ask.

No certification teaches you this.

Every employer expects you to already know it.

Here is what changes when you reframe the email:

You are not instructing. You are requesting.

You are not demanding. You are explaining.

Before you send anything, place yourself in the receiver’s position.

Is this clear?

Is the tone respectful?

Does it explain why you need this, not just what you need?

Does it acknowledge that this is additional work for them?

Does it give them an option to discuss if they need clarity?

Have you been explicit about exactly what you are looking for and why?

Unless the stakeholder understands why you need something, they will never prioritize giving it to you.

That is not resistance. That is human nature.

Audit is more about communication than documentation.

The auditors who understand this early do not just get better evidence.

They get trusted faster.

They spend less time chasing.

They build relationships that make every future engagement easier.

The ones who never learn it spend their careers wondering why stakeholders are difficult.

They are not difficult.

They are responding to the tone you set.

3 Ideas From Me

I. Use AI to challenge your own work, not just to complete it faster. Ask it to find the gaps in your reasoning, the weaknesses in your conclusion, the questions your manager will ask. That is where the real value is.

II. Curiosity is not a personality trait. It is a discipline. The auditors who keep asking why, even after they have the answer, are the ones who find what everyone else missed. Stay keen. Refine constantly.

III. Your knowledge has a shelf life. What made you competent two years ago is the baseline today. The gap is not laziness. It is the pace of change outrunning the pace of learning.

2 Things I Wish Someone Had Told Me Earlier

I. Communication will differentiate you from the crowd faster than any technical skill. If you can get stakeholders on board, make them feel heard, and make them want to help you, you have a skill most auditors spend their entire careers without developing. That is the real competitive advantage.

II. Understanding humans is the most underrated skill in audit. Technology will change. Frameworks will evolve. AI will automate. But the auditor who understands people, reads the room, and builds trust in a conversation will survive every wave of change.

1 Question For You

Go back to the last three audit emails you sent.

Place yourself in the shoes of the person receiving them.

How would you feel?

Until next week,

Chinmay Kulkarni

Not because they lack self-awareness.

Because nobody has ever asked them the right questions.

Not technical questions. Not framework questions.

Just honest ones.

I built this self assessment after years of watching two types of auditors in the same room.

Both completing the same work.

Both hitting the same deadlines.

One getting trusted. One getting managed.

The difference was never technical knowledge.

It was the quality of thinking behind the work.

This exercise takes 60 seconds.

No right or wrong answers. Just honesty.

Rate yourself 1 to 5 on each statement. 1 = Never. 5 = Always.

1. I can explain why my evidence is sufficient before my manager asks.

2. I understand the risk behind every control I test, not just the control description.

3. I own my work until it is signed off, not until it is submitted.

4. I challenge prior year workpapers instead of copying them.

5. I can defend every conclusion I have formed this week out loud right now.

6. I use AI to stress-test my thinking, not just to complete tasks faster.

7. I understand the business impact of the risk I am testing, not just the audit impact.

8. I prepare for walkthroughs by understanding the risk first, not the agenda.

9. I know the difference between completing a control and providing reasonable assurance.

10. My manager trusts my conclusions without verifying every piece of evidence I obtained.

Your score:

40 to 50: You are already thinking like a trusted auditor. The question is whether you are consistent.

25 to 39: You have the foundation. But specific gaps are quietly costing you trust in every review.

10 to 24: You are completing work. You are not yet providing independent judgment. That gap is fixable but only if you name it.

The auditors who score below 30 and do nothing with that score are the ones who stay stuck.

The ones who score below 30 and decide to close the gap are the ones who get promoted.

Which one are you?

Save this. Come back to it in 90 days and score yourself again.

3 Ideas From Me

I. The only thing you truly control is how you react. To a difficult manager. To a tough review comment. To an unfair situation. That reaction is your character in real time. It is also the hardest thing to train.

II. Saying “I do not know” is not a weakness. It is the only honest starting point for learning anything real. The auditors who pretend to know everything are the ones nobody trusts to find what they do not know.

III. Your work will only get done if it is listed and tracked. Good intentions do not close audit findings. A system does.

2 Things I Wish Someone Had Told Me Earlier

I. Asking the right question is a skill that will take you further than knowing the right answer. Right questions lead to right answers. But nobody teaches you how to construct the question. I wish I had spent less time memorising frameworks and more time practising how to ask.

II. The ability to detach from work the moment you close your laptop is a skill. Not laziness. Not lack of commitment. A skill I wish I had started building from day one instead of year four.

1 Question For You

What did your score tell you that you already knew but had not said out loud yet?

Then I spent almost three years at EY.

Then I came back to Internal Audit.

People ask me why I left Big Four.

The honest answer is simple.

EY gave me enough.

Not everything. Enough.

Enough discipline to know what high quality output looks like under pressure.

Enough standardization to understand why frameworks exist before you challenge them.

Enough ownership to know that excuses do not survive a deadline.

When I felt I had absorbed what that environment had to give me, I made the move.

Not because Big Four was wrong.

Because I wanted to know what the other environment would force me to become.

And Internal Audit built something different.

At EY I worked inside a defined scope. ITGCs. ITACs. Standardized testing approaches. Financial statement risk.

Inside a bank, the risk landscape changes entirely.

Operational risk. Cybersecurity resilience. Controls that keep a company functioning, not just controls that satisfy an audit objective.

Real risk. Real consequences. Real depth.

The liberty to evaluate what actually matters, not just what fits inside a pre-defined scope.

But here is the part nobody told me before I made the move.

The process of providing assurance does not change.

Understand the risk. Evaluate the control. Form a defensible conclusion.

That is the same whether you are at a Big Four firm or sitting inside a bank.

What changes is the environment that shapes how you think.

Big Four sharpens your discipline.

Internal Audit deepens your curiosity.

If I could do it again, I would want both.

Not to collect experience on a resume.

To understand what each environment forces you to become.

3 Ideas From Me

I. Most people rush into certifications to get through the door. Few stop to ask what they actually need once they are inside. A certification gets you the interview. Judgment gets you the career.

II. Before you try to impress anyone in a new role, sit down and truly understand the business process. Not the control. Not the risk. The process. Impression built on shallow understanding does not survive the first hard question.

III. Confidence is not the absence of doubt. It is the ability to act clearly while the doubt is still there. Most auditors wait for certainty before they speak. The room does not wait with them.

2 Things I Wish Someone Had Told Me Earlier

I. Client serving roles have a nuance nobody prepares you for: time boxing. If you cannot justify X hours, structure your day across multiple engagements, and deliver under that constraint - the work will break you before the work teaches you. That skill is not in any syllabus. But it is the first thing that separates people in a firm.

II. Certifications open doors. But nobody tells you that half the people who walk through that door have no idea what to do next. Spend less time collecting credentials and more time understanding what problem you are actually trying to solve.

1 Question For You

Which one are you in right now and what is it building in you?

If this made you think, share it with one auditor who is trying to make this decision right now.

And if you are not yet subscribed to Clarity with Chinmay, this is the weekly conversation you have been missing.

Chinmay

He wanted to share something I had written with a friend.

He knew I had covered it. He had read it himself.

But he could not find it.

He scrolled. And scrolled. And gave up.

That stayed with me.

Not because it was criticism.

Because it was coming from someone who reads almost everything I post.

If he could not find it, nobody could.

I have been posting since November 2021.

Three years of frameworks, testing approaches, mental models, real audit scenarios, career lessons, and control walkthroughs.

All of it buried in a feed that moves on every 24 hours.

A post about IT application controls from six months ago.

A workpaper defensibility framework from last year.

A user access review walkthrough that got 83 saves.

All of it still relevant. All of it practically impossible to find.

If something is hard to access, it is not useful.

No matter how good it is.

So I built something.

I call it the Audit Hub.

It is a Notion-based dashboard that brings everything I have ever shared into one place.

Structured. Searchable. Organised by the areas that matter most to IT auditors.

IT Application Controls. IT General Controls. Automated Controls. ISO 27001. Audit Career. IT Testing. Sampling. Audit Mindset. Frameworks.

Every category built from content I have personally experienced and tested.

Nothing fabricated. Nothing generic.

Just everything I have shared over three years, finally in one place you can actually use.

It is not perfect.

It is still evolving.

But it is live.

And now when a colleague wants to share something with a friend, he does not have to scroll endlessly.

He goes straight to the Hub.

You can too.

Explore the Audit Hub here!

This is not just a content library.

It is a thinking resource.

Built for the auditor who wants to go beyond completion and start building real judgment.

3 Ideas From Me

I. Knowledge buried is knowledge wasted. It does not matter how good your thinking is if nobody can find it when they need it. Accessibility is part of the value.

II. Most auditors are building skills nobody can see. The work is in the workpaper. The judgment is in the conversation. Start making both visible.

III. The auditors who accelerate are not the ones who know the most. They are the ones who can retrieve the right thinking at the right moment. That is not memory. That is a system.

2 Things I Wish Someone Had Told Me Earlier

I. Your best thinking has a shelf life of 24 hours on LinkedIn. Archive it somewhere it can compound. A post that helped someone today can help someone else two years from now if they can find it.

II. Building in public is only half the work. The other half is making sure what you build stays findable, usable, and organised. Sharing is not enough. Structure is what creates lasting value.

1 Question For You

If someone asked you to find your best piece of audit thinking from two years ago, how long would it take?

Nobody asked them to.

Nobody paid them to.

Nobody would have noticed if they did not show up.

But they did.

I hosted a free webinar yesterday called What No Certification Teaches You.

339 people registered. 42 showed up live.

For a second, I looked at that number and felt the gap. Then I looked at the chat.

People were typing questions before I even started. Someone asked about risk-control mapping within the first 5 minutes. Another person asked how to defend a conclusion they were not confident in.

These were not passive attendees. These were auditors who came with real problems.

So I gave them everything I had.

1. The PRC Framework.

2. Why most workpapers fail under review.

3. What ownership actually looks like at 1-5 years.

4. The exact sentence to use in a feedback meeting with your manager.

5. How to use AI without becoming dependent on it.

6. Six things they could apply starting Monday morning.

No theory. No slides full of definitions. Just lessons from real audit experience.

Here is what I learned from hosting this:

The number that registers is not the number that matters. The number that shows up is not even the number that matters.

The number that applies something from the session tomorrow morning. That is the only number that matters.

I do not know what that number is yet.

But I built them a tool to track it.

339 people told me the demand for this kind of thinking is real. 42 people proved it with their time.

The next session is coming. And it will be sharper because of this one.

I have a CRISC.

I have a CCSK.

I spent years at EY. I am now an AVP at Barclays managing audits across some of the most complex technology environments in financial services.

Not one certification taught me how to think.

They taught me what to test.

They gave me frameworks, checklists, and control objectives.

But nobody told me why most auditors freeze when a manager challenges their conclusion.

Nobody told me why completing a workpaper and defending a workpaper are two completely different skills.

Nobody told me that the auditors who accelerate are not the ones who work harder.

They are the ones who think differently.

I had to learn that through failures.

Through a manager question I could not answer in front of a client.

Through review comments that told me my evidence was fine but my reasoning was not.

Through years of hard conversations that no syllabus ever prepared me for.

That is exactly why I am running this webinar.

Not to teach you what certifications already cover.

To share what they never do.

The Audit Mindset That Accelerates Careers Free Live Webinar 29 March | 6 PM to 7 PM IST Live session + Q&A

This is a 60-minute session built entirely from what I absorbed through real audit work.

The failures. The hard moments. The shifts in thinking that changed how I work and how I am perceived.

Here is what we will cover:

Why most auditors confuse completion with competence and why this one blind spot holds more careers back than any skill gap.

The mindset shift that senior auditors carry but never explain out loud. The thing that separates the ones who get trusted from the ones who get managed.

How to make your conclusions defensible under any scrutiny. Not just documented. Defensible.

Real lessons from the mistakes I made in the last three years. Not polished case studies. The actual moments.

This is not a lecture.

This is a conversation.

From someone who is still in the room, still doing the work, and still learning.

If you have ever frozen on a manager question, if you have ever completed a workpaper and still felt uncertain, if you have ever wondered what the auditors above you actually think differently this session is for you.

It is free.

It is live.

And it will not be recorded.

Register here: REGISTRATION LINK

I will see you on 29 March.

Chinmay Kulkarni

Share Clarity with Chinmay

Everything looked good.

System accounts reviewed. Attributes tested. Conclusion documented.

Then my manager asked one question.

“It’s good to see the system account access. But which users are actually operating that account? Do we have evidence for that?”

I did not have an answer.

Worse, when the client pushed back and said they had done everything on their end, I could not articulate why that was not sufficient.

I had the evidence. I had the completion. I did not have the explanation.

That was the moment I realised something most auditors take years to see.

Knowledge is not the upgrade. Translation is.

Here is what I was doing wrong.

I was presenting facts.

What the control does. What the sample showed. What the attribute confirmed.

But I was not answering the question behind the question.

What is the actual risk here?

Why should a stakeholder care?

What can genuinely go wrong versus what I assumed could go wrong?

A completed workpaper answers the first question.

A defensible conclusion answers all three.

That conversation stayed with me.

Later in my career, I was in a room with an audit director. Someone who had managed over 300 audits across a 25-year career. A billion dollar client on the table.

I had two years of experience.

He did not challenge my evidence.

He challenged my reasoning.

And I was ready.

Not because I had more knowledge. Because I had learned to explain how the evidence connects to the risk. Not just what I found. But what it means. And why it matters.

That is the shift.

Share

The three questions I now answer before every conclusion:

1. What is the risk this control is designed to mitigate?

2. Does my evidence demonstrate the risk is effectively controlled, or just that the control was performed?

3. If a skeptical manager asked me why this is sufficient, can I answer without hesitation?

Most auditors answer question two.

The ones who get trusted answer all three.

The biggest upgrade in your audit career is not technical knowledge.

It is the ability to explain how evidence demonstrates that a risk is effectively controlled.

Anyone can complete a workpaper.

Not everyone can defend the thinking behind it.

Which question are you currently stopping at?

Early in my career, I thought I was doing everything right.

Walkthroughs attended. Screenshots captured. Attributes mapped. Workpaper submitted.

Review comments came back anyway.

Every single time.

I was not lazy. I was not careless.

I was starting in the wrong place.

And nobody told me that was the problem.

Here is the sequence most auditors follow.

• Receive the procedure.

• Open the prior year workpaper.

• Copy the attributes.

• Obtain evidence.

• Document and submit.

This sequence feels productive.

It is not audit thinking. It is task execution.

The difference is invisible until your manager asks one question.

“How does this evidence mitigate the risk?”

If you freeze, the sequence failed you.

Here is the sequence that actually builds careers.

• Understand the risk.

• Define what proof of mitigation looks like.

• Determine what evidence would demonstrate that.

• Obtain that evidence.

• Document why it is sufficient.

Same five steps. Completely different starting point.

When you start with the risk, everything that follows has a purpose.

When you start with the procedure, everything that follows is just activity.

Here is why this matters beyond the workpaper.

Managers do not promote auditors who complete work.

They promote auditors they trust to form a judgment independently.

Judgment starts before you open the workpaper.

It starts the moment you ask: what am I actually trying to prove here?

That question, asked early, eliminates most review comments before they exist.

It changes how you conduct walkthroughs. It changes what questions you ask the client. It changes what evidence you accept as sufficient. It changes how you write your conclusion.

One question. Asked earlier. Changes everything downstream.

The auditors who stay stuck are not less capable.

They are just starting in the wrong place.

Completion is a task mindset.

Defensibility is an audit mindset.

The moment you stop asking “what do I need to complete” and start asking “what do I need to prove,” everything shifts.

Here is your one actionable insight for this week.

Before you touch your next workpaper, write one sentence.

Just one.

The risk I am testing is ___ and my evidence needs to prove ___.

That sentence forces clarity before execution.

If you cannot complete it, you are not ready to test yet.

Come back to that sentence after submission. Does your workpaper answer it?

If not, you now know exactly what is missing.

One sentence. Before every control. Starting this week.

Chinmay

If this gave you one thing to apply, forward it to one auditor in your team.

New here? Subscribe to Clarity with Chinmay. One audit insight every week. No fluff.