Construction Audit Management Software Consulting

Most audit management tools ship with a process-based audit universe: revenue, procure-to-pay, payroll, financial close. That structure works for a company where revenue recognition is a point-in-time event. It breaks down for a contractor recognizing revenue over time under ASC 606's cost-to-cost method, because the actual control risk lives inside individual projects — a specific contract's EAC, a specific change order's accounting treatment, a specific project's WIP position — not in an abstract 'revenue' process that spans the whole company. An internal audit function testing controls at a contractor needs the audit management system to maintain a rolling, risk-ranked population of active projects and to sample from that population every period, the way the external auditor's PCAOB-driven approach does.

This changes how the tool needs to be configured. Audit programs should be built at two levels: an entity-level program that tests company-wide controls (segregation of duties in the ERP, IT general controls over the project-system interface, period-end close procedures) and a project-level program that samples individual contracts for EAC review evidence, change-order approval documentation, and WIP schedule sign-off. The sampling methodology itself — how many projects get tested each quarter, and whether the selection is risk-weighted toward large-dollar or margin-fade projects — needs to be documented and defensible, because it is exactly what the external auditor will scrutinize when relying on management's testing.

Testing a percentage-of-completion control is fundamentally different from testing a mechanical control like a three-way match. An EAC review control doesn't have a single correct answer to check against — it has a judgment that has to be evaluated for whether it was made with appropriate rigor and independence. Audit management software needs workpaper templates that capture what a tester actually has to document for this kind of control: who prepared the EAC, who reviewed it and what their reporting line is relative to the preparer, what supporting detail (subcontractor commitments, remaining scope, historical productivity) the reviewer examined, and whether the review resulted in any adjustment. A checkbox that just says 'EAC reviewed: Y/N' does not produce evidence an auditor can rely on.

The same discipline applies to change-order testing and WIP review testing. A change-order workpaper should capture the commercial approval, the accounting determination (separate contract, modification with cumulative catch-up, or termination-and-new-contract under ASC 606), and confirmation that the EAC and billing were updated consistently with that determination. A WIP review workpaper should capture which projects were flagged for unusual over/under-billing swings or margin fade, what follow-up questions were asked, and how they were resolved before the period closed. Audit management platforms that support configurable, control-specific workpaper templates — rather than one generic template for every control — produce materially better evidence for 404(b) attestation.

A meaningful share of the control deficiencies internal audit finds at contractors originate at the boundary between the project-management/job-costing system and the financial ERP — a batch interface that silently drops records, a cost-code mapping that changes without governance, a reconciliation that isn't performed consistently. Audit management software needs to track these findings with enough structure to show a pattern: the same interface failure recurring across multiple periods is a much more serious finding than an isolated one, and if the issue log doesn't tag findings by control point and system, that pattern is invisible until it becomes a material weakness.

Remediation tracking also needs an owner outside of the team that caused the finding — if the project-accounting team both creates the reconciliation gap and is solely responsible for closing the finding, that is itself a control weakness. Good audit management practice ties every open issue to a remediation owner, a target date, and a re-test date, and escalates automatically when a finding crosses quarters without closure. For SOX purposes, an issue that stays open across two consecutive testing cycles without documented remediation progress is exactly the kind of thing that gets elevated in conversation with the external auditor and, if unresolved, contributes to a significant deficiency or material weakness conclusion.