How to prepare data for audits and compliance reviews

When you own the prepared-by-client (PBC) list, the goal is one export that hands auditors every receipt, approval, general ledger code, and change record, with no fieldwork scramble.

To prepare data for audits and compliance reviews, you confirm the scope, close receipt gaps, verify approvals, and document every correction and late receipt. Then you export full audit trails with support attached and lock the evidence so it stays tamper-evident and retained.

What is audit-ready data?

Audit-ready data consists of transaction records that are complete, traceable to source documents, approved under policy, and exportable in the format your auditors request. You need it for year-end financial audits, Sarbanes-Oxley (SOX) and internal control testing, grant or lender reviews, and internal compliance reviews.

Each transaction's audit trail should let a reviewer move from the GL entry back to the receipt and approval without asking you a question. The same records work as audit evidence at year-end and as compliance evidence when a lender or grantor reviews your spend.

• Transaction record: Date, amount, merchant, cardholder, and payment method from the card feed or bank
• Receipt or invoice: The itemized source document that shows what you bought and from whom
• Approval record: The approver's name and the timestamp of their approval, tied to the transaction
• GL coding: The account the spend posted to, matching your general ledger (GL)
• Department or cost center: The owner of the spend, so auditors can test budgets and approval routing
• Change history: Every edit to coding, amount, or receipt, with who made it and when

If any one of these is missing for a sampled transaction, expect a follow-up request.

Why audit-ready data matters

Audit-ready data shortens fieldwork and gives auditors something concrete to test.

Fewer follow-up requests during fieldwork

Complete exports cut the back-and-forth over sample selections and missing support. When each sampled transaction arrives with its receipt, approval, and coding attached, auditors can clear it on the first pass.

Stronger evidence of internal controls

Timestamped approvals and policy-review records let auditors test your controls without re-performing them by hand. If the approval log shows who signed off on a $4,000 software purchase and when, the auditor inspects that record and moves on.

Lower risk of audit findings

Missing receipts, unapproved high-value spend, and unexplained edits are common sources of audit findings. Each one becomes a deficiency the auditor has to document, and repeat issues can land in your management letter. Clean records before fieldwork keep those items off the list.

What auditors request in a finance audit

Auditors request two kinds of evidence: support for each sampled transaction and proof that your controls ran throughout the period.

Tax substantiation follows the IRS receipt requirements, which run on a separate track from financial audit testing. Knowing where each request lives tells you which system owners to bring into audit preparation before the PBC list arrives.

How to prepare data for audits and compliance reviews

When you plan how to prepare data for audits and compliance reviews, start with the auditor's scope because every later step depends on it.

1. Confirm the audit scope and request list

Get the PBC list, audit period, entities, and sample criteria from your auditor before you pull anything. Then map each request to the system and report that produces it, such as your card platform's transaction export or your ERP's journal entry listing. Ask these questions to confirm the audit scope:

• What period does the audit cover, and does it include any stub or interim periods?
• Which legal entities and subsidiaries are in scope?
• What materiality threshold will the auditor use for testing?
• How many transactions will they sample, and how will they select them?
• What file format do they want, such as CSV, Excel, or PDFs with attachments?
• When is each PBC item due?

Write the answers into your PBC tracker so every owner works from the same scope.

2. Close receipt and documentation gaps before you export

Run a missing-receipt report for the audit period and chase receipts while employees still remember the purchase. A cardholder can usually find a 3-week-old receipt in their inbox. A receipt from last March often means a vendor portal search or a missing-receipt affidavit.

Set a cutoff for late receipts, such as 10 business days before fieldwork starts. Attach each late receipt to its original transaction with a visible upload date because swapping one in erases the evidence that it arrived late.

That upload date is part of audit-ready documentation since it shows the auditor exactly when support arrived. Anything still missing at cutoff goes on an exceptions list with a written explanation.

3. Verify approvals on high-value and exception transactions

Filter for transactions above your approval thresholds and confirm each one has an approver, a timestamp, and an approval that matches policy. If your policy requires vice president (VP) approval above $2,500 and chief financial officer (CFO) approval above $10,000, a $12,000 purchase approved only by a manager is a finding.

Review every policy exception for a documented resolution, such as a manager note, a repayment, or a reclassification.

• Approver name: The person who approved, matched to a user in your system
• Role: Their title or approval level, which should match your approval matrix
• Timestamp: The date and time of approval, at or before the time of spend
• Amount at approval: The amount the approver saw, which should match or exceed the final charge
• Policy rule applied: The threshold or rule that routed the transaction to this approver
• Comments: Any notes on business purpose or the reason for an exception

Document any routing gap you find, with the date you fixed it, before the auditor finds it in a sample.

4. Flag and resolve personal or out-of-policy expenses

Pull every personal charge on company cards for the period and record how each one was resolved, either by employee repayment or reclassification. Auditors also want to see how flagging happens, whether through automated review of every transaction or a manual spot-check of a sample.

Walk them through the workflow from flag to close: who receives the flag, how long they have to respond, and where the repayment or reclassification gets recorded. If you rely on manual spot-checks, state the sample size and frequency, such as 25 transactions a month, so the auditor can test the control as designed.

5. Document corrections, voids, and deleted transactions

Auditors want to see the original entry, what changed, who changed it, when, and why. An overwritten record breaks traceability, because the auditor can't confirm that the number you report is the number that originally posted.

The standard approach is to reverse the original entry and post a corrected one, leaving both in the ledger with their own IDs and timestamps. Keep change history for every edit to coding, amount, or receipt, including edits made in your expense platform before a transaction syncs to the ERP system.

Require a reason code or comment on each edit. A log that shows who and when still leaves the auditor asking why.

Before fieldwork, pull five recoded transactions from the change log and confirm each one shows the original value, the new value, and a reason.

6. Export full audit trails with receipts and approvals attached

Export each coded transaction with its receipt and approval history attached so auditors don't have to match separate files. Filter the export by department, cost center, and date range to match the auditor's sample request.

• Transaction ID
• Transaction date and posting date
• Merchant or vendor
• Amount and currency
• Cardholder or employee
• GL account
• Department, cost center, and class
• Approver and approval timestamp
• Receipt link or attachment
• Memo or business purpose
• Policy flag and resolution
• Last modified by and date

Reconcile the export total to the general ledger before you send anything. An unexplained difference sends the auditor back to the full population.

7. Lock, hash, and retain the evidence package

Make the evidence tamper-evident as soon as you send it. Use read-only or immutable audit logs, and record a SHA-256 checksum for each exported file so the auditor can confirm nothing changed after export.

Keep historical compliance evidence, including prior-period exports, policy versions, and employee policy acceptance logs, in an archive with access controls. Set an evidence-retention schedule based on your audit firm's requirements and any regulatory or contractual obligations, and assign one person to own it.

• Final export: The exact files you sent, with receipts and approvals attached
• Hash manifest: Each file name alongside its SHA-256 checksum
• Policy version in effect: The expense policy that governed spend during the period
• Policy acceptance log: Which employees accepted that version, and when
• Approval matrix: The thresholds and approvers that applied, such as VP sign-off above $2,500
• User access list: Who could create, edit, or approve records during the period

When next year's auditor asks about a prior-period balance, you can answer from one folder in minutes.

Best practices for continuous audit readiness

Continuous audit readiness means you could hand an auditor a complete sample on any day of the year.

Capture evidence when the transaction happens

Recording evidence at the time of purchase gives you more accurate records than reconstructing them at year-end. A cardholder who snaps a receipt at checkout remembers the business purpose, while one asked in December has to guess. Require a receipt and memo within a set window, such as 7 days, and send automatic reminders.

Standardize naming and coding conventions

Consistent conventions let any reviewer trace a transaction to its support without asking you. Name files with the transaction ID, date, and vendor, such as TXN10482_2026-03-14_Delta.pdf, and keep one folder per period and entity. Lock your chart of accounts and department list for the period so a code means the same thing in January and December.

Run a mock audit each quarter

Have someone who didn't create the records pull 20 transactions and trace each one end to end. They should get from the GL line to the receipt, approval, and any changes using only your systems and files. Every question they ask is a gap to fix before the real auditor asks it.

Restrict and log who can edit financial records

Access controls and change logs are part of the evidence auditors test. Limit edit rights on posted transactions to a small group, such as the controller and two senior accountants, and review the access list each quarter. Keep change logging on for every user, including admins, because admin edits draw the most scrutiny.

Common mistakes when preparing audit data

Most audit data problems trace back to a few habits you can fix before fieldwork.

Sending exports that don't reconcile to the GL

An export that's $3,200 off the GL balance makes the auditor question the whole population. Reconcile totals by account and period, and document any reconciling items before you send the file.

Deleting or overwriting transactions instead of reversing them

Deleting an entry removes the evidence auditors need to trace what changed. Reverse the original and post a correction, so both entries stay visible with their timestamps.

Keeping receipts and approvals in separate systems

When receipts live in email and approvals live in a spreadsheet, someone has to match them by hand for every sample. Attach both to the transaction record so one export carries everything.

Starting evidence collection after the auditor's request arrives

If collection starts when the PBC list lands, you're chasing receipts that are months old. Run a monthly check for missing receipts and approvals so the year-end pull is mostly done.

Keep audit evidence complete with Ramp Expense Management

Audit prep slows down when evidence lives in several places and half of it was collected months after the purchase. You end up chasing old receipts and rebuilding approval chains from email threads.

Ramp Expense Management collects the evidence for each transaction at the moment of spend, so it's complete before your auditor asks. Your export then carries the support auditors sample, with no matching across systems.

Ramp builds audit evidence into the way your team already spends:

• Capture receipts at the point of sale: Employees submit receipts by SMS, app, email, Slack, or Teams, and each one attaches to its transaction.
• Log every approval with a timestamp: Each approval records who signed off and when, so auditors can test controls from the log.
• Review every transaction with Policy Agent: Policy Agent is an always-on AI reviewer trained on your real policy. It surfaces only real exceptions, including personal and out-of-policy spend.
• Code and sync spend to your books: With Ramp Accounting Automation, the Accounting Agent auto-codes GL, department, and class fields and syncs to your ERP. Every AI decision shows a confidence level, rationale, and override option, giving you an audit trail for coding changes.

Try an interactive demo to see how Ramp keeps your audit evidence complete as you spend.