Audit pack — what auditors get
The audit pack is the single bundle of evidence that the external auditor reads to sign off on the ECL number. It is generated automatically after each run is posted and contains the model documentation, governance sign-offs, validation results and sensitivities the auditor needs to form an opinion.
Why the pack exists
Two reasons. First — IFRS 9 is judgement-heavy and external auditors will not accept a number without a documented model. Second — Kenyan banking supervision (CBK) requires that the institution can demonstrate, at any time, the model, the assumptions, the governance and the controls behind every reported provision.
The pack is built per run and per period. It is immutable once generated (regenerating creates a new versioned document; old versions are kept). At year end the four quarterly packs are bundled into an Annual ECL File that is the primary deliverable to the external audit.
Pack contents
Each pack is a single navigable PDF (typically 60-120 pages) with the following sections. The structure is fixed; the contents are pulled from the run.
| Section | Title | Source |
|---|---|---|
| 1 | Executive Summary | Headline ECL, coverage ratio, Q/Q bridge |
| 2 | Methodology & Model Documentation | Model paper (v-controlled) + scenario design |
| 3 | Portfolio Overview | Gross book, segment mix, top exposures |
| 4 | Staging | Stage distribution + migration matrix + override list |
| 5 | Assumptions | PD, LGD term structures, version, calibration memo |
| 6 | Macro Scenarios | Three scenarios, weights, factor projections, sign-offs |
| 7 | ECL Results | By segment, stage, scenario; sensitivity |
| 8 | Governance & Sign-Offs | Risk Committee minute, CFO approval, audit log |
| 9 | Reconciliation | GL vs run, journal listing, reference mapping |
| 10 | Validation Results | Built-in validation outcomes; explained overrides |
| 11 | Adjustments & Reversals | Any reverse-and-replay during the period |
| 12 | Appendices | Raw run-line export (CSV link), assumption versions, control owners |
How it's built
After a run is posted, the engine schedules an async build job. The build pulls live data from the run, the assumption versions, the scenario records and the journal entries, and renders each section through a QWeb PDF template. The job runs in ~5-15 minutes.
- Run is posted →
ifrs9.audit.packcreated in statequeued. - Worker picks up; pulls run data, fetches all sign-off records, embeds attachments.
- QWeb template renders to PDF; supporting CSVs are attached as separate files.
- Pack moves to state
built; CFO is notified via email. - CFO reviews; clicks Approve audit pack → state
approved. - From
approved, the pack can be downloaded or shared with the auditor via secure link.
The four sign-offs
Each pack carries four sign-offs which are reproduced in the cover page and validated by the auditor:
| Sign-off | Role | Captures |
|---|---|---|
| Analyst | IFRS 9 Analyst | Run completed and reviewed for data quality |
| Risk Manager | Risk Manager | Staging, assumptions, scenarios appropriately applied |
| CFO | CFO | Numbers approved for accounts; journal posted |
| Internal Audit | Internal Audit lead | Controls and governance tested; no exceptions |
Giving the auditor access
Two options for the external auditor:
The portal route also gives the auditor access to the raw ifrs9.run.line table — they can pull their own samples and reconcile lines to mfi.loan directly. This is the gold-standard audit interaction and we recommend it for the year-end audit.
- Portal user — create a portal user (group MFI / IFRS 9 / Auditor (read-only)) for the audit partner. They log in to the system and view runs, packs, lines and journals directly. Best for in-depth audits.
- Secure download link — from the approved pack click Share with auditor. System generates a time-limited (7-day) signed URL emailed to the partner. They download the PDF + supporting CSVs without an account. Best for the partner who wants to review offline.
Year-end annual file
At year end the four quarterly packs roll up into a single Annual ECL File. This adds the year-on-year ECL bridge, the annual assumption recalibration memo, the back-test of prior-year predictions against actual defaults, and the Risk Committee year-in-review minute.
- Q1-Q4 packs as appendices
- Year-on-year ECL bridge by attribution (staging migration, macro overlay, originations, write-offs, recoveries, assumption changes)
- Annual back-test: predicted PD vs actual default rate per segment
- Annual recalibration memo and Risk Committee approval
- Governance summary: who signed off what, when
What auditors actually look for
Across the four most recent year-end audits, this is what consistently shows up in the auditor's enquiry list:
All of these can be answered from a well-built audit pack without ever opening Excel. The single best investment in audit preparation time is ensuring every override has a 50-character-plus justification at the time it is applied — auditors flag thin justifications and revisits cost days.
- Stage 2 sampling — pull 10 loans by judgement, confirm SICR captured and reasonable.
- Stage 3 sampling — pull 10 loans, confirm LGD and EAD; check specific allowance.
- Manual overrides — every override reviewed with justification.
- Macro scenario weighting — challenge the weights; ask for the minute.
- PD back-test — predicted vs actual default rate per segment for the year.
- Reverse-and-replay — any reversals during the year reviewed individually.
- Reconciliation — pack figure to GL closing balance on 1290.
- Going concern — does the downside scenario affect going concern conclusion?
Worked scenarios
Scenario — External audit walkthrough — Aisha samples the Q4 pack
| Character | Role |
|---|---|
| Aisha Hassan | External Audit Partner |
| Florence Achieng | CFO |
| Kimani Mwangi | Risk Manager |
| David Karanja | Internal Audit lead |
Timeline
- Feb 8, 09:00: Aisha given portal access (MFI / IFRS 9 / Auditor read-only). Aisha logs in, opens Q4 run. (res.users new — login audit captured)
- Feb 8, 10:30: Aisha downloads the audit pack PDF + the run-line CSV. Confirms sign-offs all present. (Download logged)
- Feb 8, 14:00: Aisha samples 25 Stage 1 loans. Pulls each loan record in the portal. Confirms DPD < 30 and no SICR trigger. All 25 OK. (Sample evidence printed)
- Feb 9, 09:00: Aisha samples 10 Stage 2. One looks borderline (member tenure 11 months, normal loan, no SICR per system — Aisha suspects PD doubling). (—)
- Feb 9, 10:00: Kimani walks Aisha through the loan: PD at origination was 5.4%, current PD is 8.2%, ratio 1.52× — below the 2× SICR trigger. Stage 1 correct. (Justification captured live)
- Feb 9, 14:00: Aisha tests the macro overlay. Asks for sensitivity if downside weight raised to 40% from 25%. Kimani runs scenario sandbox, shows +KES 5.4M ECL. Floor for going-concern: KES 22M weighted ECL doesn't change conclusion. (Sandbox run id=99 (not posted))
- Feb 10, 11:00: Aisha tests reverse-and-replay. Pulls the Q3 reversal trio (see provisioning_je scenario). Confirms documentation in pack section 11. Clean. (—)
- Feb 11, 09:00: Aisha tests Stage 3 LGD. Samples 5 written-off loans from the prior year. Compares actual recovery to LGD assumption. 4 within 5pp, 1 outside (vehicle-secured, recovered 70% vs LGD assumption 45% — over-provisioned). Captured as audit observation, not adjustment. (Observation in management letter draft)
- Feb 12, 16:00: Aisha closes fieldwork. One management letter point (revisit vehicle-secured LGD assumption). No material adjustment. (Audit sign-off issued Feb 22)
Outcome — Year-end audit closes clean; one management-letter point on vehicle LGD calibration; no qualification.
Reference
Audit pack states
| State | Meaning | Next state |
|---|---|---|
| queued | Awaiting build worker | building |
| building | PDF rendering in progress | built or failed |
| built | PDF generated; awaiting CFO review | approved or rebuilding |
| approved | CFO approved; can be shared with auditor | archived |
| archived | Year-end roll-up complete | — |
| failed | Build error; check engine log | queued (retry) |
Files produced
| File | Format | Purpose |
|---|---|---|
| audit_pack_Qx_yyyy.pdf | Main bundle, 60-120 pages, navigable | |
| run_lines.csv | CSV | Per-loan: id, segment, stage, EAD, PD, LGD, ECL (one row per loan) |
| assumption_versions.csv | CSV | All assumption rows applied to the run |
| scenarios.json | JSON | Scenario records with macro factor projections |
| sign_offs.csv | CSV | Sign-off audit trail with user and timestamp |
| validation_results.csv | CSV | Validation check outcomes |
| journal_listing.csv | CSV | Journals posted by the run |
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Pack stuck in 'building' for > 30 minutes. | wkhtmltopdf hanging on a complex chart, or worker killed. | (managed by the platform team — raise a support case if needed) — kill any zombie. From the pack, click Retry build. If repeated, simplify the bridge chart or split into multiple smaller charts. |
| Internal Audit sign-off not appearing. | David's user not in 'Internal Audit' group, or he ticked 'reviewed' on the wrong run. | Settings → Users → David Karanja → groups → tick MFI / Internal Audit. Then ask David to re-open the correct pack and tick the sign-off. |
| Auditor reports 'sign-offs missing' in the PDF cover. | Pack was built before all four sign-offs were captured. | Capture missing sign-offs, then click Rebuild. The new version supersedes the old; old kept for audit-of-audit purposes. |
| CSV exports missing one or more files. | Run had zero rows for that section (e.g. no manual overrides, no reversals). Engine skips empty CSVs. | Expected. If you need a placeholder for the auditor, tick Include empty CSVs in Settings → IFRS 9 → Audit pack and rebuild. |
| Auditor's secure download link returns 404. | Link expired (default 7 days), or pack was rebuilt after the link was shared (old version archived). | From the latest approved pack click Share with auditor to issue a fresh link. Communicate the new URL to the auditor. |