A workpaper is documentation of the procedures performed during an audit, the evidence examined, and the conclusions reached. It should let a qualified reviewer understand what was tested, how the evidence supports the result, and who reviewed or approved the work. Workpapers may be digital records in an audit platform rather than paper documents.
In cybersecurity and governance, workpapers support repeatable controls testing and provide an audit trail for findings and decisions. They can also contain sensitive evidence, so organizations should protect them with appropriate access controls, version tracking, review sign-offs, and retention rules. In real audits, software can organize workpapers and record review notes, but it cannot establish that a test was well designed or that evidence is sufficient; those judgments require professional review.