CECL audit checklist: what your auditor asks for, item by item

A CECL audit checklist is best written backwards, from the tests rather than from the requests. Your auditor has to understand and evaluate the controls over the estimate, test the completeness and accuracy of the data underneath it, challenge the assumptions, and reach a conclusion on an amount that is largely judgement — and the request list that lands in your inbox is simply that programme, broken into pieces. The allowance is also where inspectors find more deficiencies than anywhere else in a bank audit, which means the questions arrive sharp. CECL Allowance Management builds the file as the quarter runs: every factor cell with a current cited source, a bridge that shows any unexplained difference, and an indexed evidence binder the auditor opens read-only the day the package is final.

The file described below is a fictional sample bank's in the solution — Ashgrove Plains Bank, third quarter 2026, audited by a fictional firm. The tests and findings are the agencies' and the PCAOB's own, linked where they appear.

What is on a CECL audit checklist?

Six groups of evidence, in the order the audit tends to move. The data the estimate was built on, tied out. The methodology and the policy it follows. The model and its results by segment. The assumptions — the forecast, the horizon, the reversion, the scenarios. The qualitative overlay and the support behind every cell of it. And the governance: who proposed, who challenged, who approved, and what the minutes say.

What makes the list feel arbitrary from the inside is that requests arrive in the order the audit team reaches them rather than in the order you built them. The fix is not to argue with the sequence but to have the file assembled by group before fieldwork, indexed to the memo, so that a request becomes a lookup rather than a reconstruction. The practical difference is a month of back-and-forth against a reading exercise.

What does the external auditor test in the allowance?

Three things, in roughly this order: the controls, the data, and the judgements. The controls come first because the rest of the audit's shape depends on whether they can be relied on — which is why committee minutes and approval records are requested early and read carefully. The data comes next because every test above it inherits its weaknesses. The judgements come last and take the longest.

For a guide to the whole programme, the AICPA publishes a practice aid covering "audit considerations with a focus on loans measured at amortized cost for depository and lending institutions as well as insurance companies" (AICPA, Practice Aid: Allowance for Credit Losses — Audit Considerations). Reading the auditor's own reference is the cheapest preparation a controller can do, because it shows which of your answers will be treated as evidence and which as assertion.

The handbook's list of what an auditor of the allowance may assess ends with "elements susceptible to management's bias" (Comptroller's Handbook, Allowances for Credit Losses), and the qualitative overlay is the plainest example of one. That phrase explains the asymmetry of attention. A modelled rate produced by a documented engine is tested for accuracy. A 35 basis point factor set by a person is tested for accuracy and for motive — whether the evidence drove it, or the answer did.

Why is the allowance so often a critical audit matter?

Because it combines the two things that raise audit risk at once. The PCAOB puts it plainly: "The estimation of a bank's ACL can involve significant management judgment as well as the use of complex models. Therefore, it is common for an auditor to identify heightened levels of risk related to the ACL, and if those risks are significant, it leads to the inclusion of critical audit matters in its audit opinion" (PCAOB, Spotlight: Bank Financial Reporting Audits).

For a listed bank the consequence is visible in the opinion itself, and the critical audit matter paragraph describes what the auditor did about it. That paragraph is written from your file. A file that lets the auditor describe testing the support behind every qualitative factor reads differently from one that lets them describe testing a sample of management's assertions, and the difference is decided months before anyone drafts the opinion.

The other half of the reason is the inspection record behind the audit, which is why the questions are sharp.

Historically, the auditor's procedures to test the ACL is the area where we identify the most deficiencies in our reviews of bank audits.

PCAOB, Spotlight: Bank Financial Reporting Audits, September 2024

An audit team that has been inspected on this area does not accept a summary where it needs a source. Reading that sentence from the preparer's side is clarifying: the pressure on your file is second-hand pressure, and it does not relent because the relationship is good.

What evidence should a CECL file contain, item by item?

The policy statement gives the standard in one line: the allowance and the provision are to be well documented, with the supporting analyses and the rationale clearly explained (Interagency Policy Statement on Allowances for Credit Losses). The words that do the work are explanations and rationale — not schedules, not printouts. A number with a source attached is documentation; a number with a reason and a source attached is an explanation.

Three properties turn a pile of attachments into a file. It has to be indexed: every paragraph of the memo points at the items that support it, so a request resolves to an item rather than to a folder. It has to be dated: each source carries the date it was produced, so staleness is visible rather than discovered. And it has to be complete in the awkward places: the decisions that went the other way, the factor that was proposed and rejected, the difference that was explained rather than absorbed.

The last of those is where files most often fall short, because nothing prompts you to keep it. A quarter in which a proposed increase was rejected and the prior level kept is a quarter with a judgement in it, and the only trace is whatever was written at the time. Making rejection a recorded decision with a written reason — rather than the absence of a change — is the single cheapest improvement available to most allowance files, and it is the heart of what one factor's support looks like in full.

The binder the auditor opens on day one, indexed to the memo

Each open request is answered by the item that supports it — support for the office collateral factor, item 3.2.

What do auditors ask for on qualitative factors?

Everything, cell by cell, and in a particular order: what the factor is for, what evidence supports the level it is set at, when that evidence was produced, whether the same information is already in the model, and why the direction of the factor matches what the underlying trend did. Those five questions are also the design of a defensible factor schedule, which is why a file built to answer them rarely has to be rebuilt.

Two of the five produce most of the findings. Staleness is the first: a factor supported by a survey from two quarters ago, carried forward because nothing prompted a refresh, while newer evidence in the same file says something different. Double counting is the second: an economic factor for conditions the model's own drivers already carry, which the policy statement warns against and which is almost always found by comparing the factor schedule against the driver list rather than by reading the memo. The worked version of that one is the factor the model already carries.

The third question auditors ask, less often and more awkwardly, is about the ones that did not move. A cell that has read 10 basis points for six quarters either reflects a stable condition — in which case say so, with this quarter's evidence — or reflects nobody looking. From the outside the two are identical.

The data question underneath every other question

Before any judgement is tested, the data it rests on has to be. This is a frequent inspection theme in its own right: "We observed several instances of engagement teams not evaluating the accuracy and completeness of the underlying data used in a control or substantive test, including data sent to an auditor-engaged specialist" (PCAOB, Spotlight: Bank Financial Reporting Audits).

Two consequences follow for a preparer. The first is that the tape-to-ledger reconciliation is not housekeeping; it is the foundation of every test above it, and the working papers for it should be in the file at the same standard as the memo. The second is that extracts sent to anyone else — a vendor model, an engaged specialist, a validator — have to be reconciled too, with the extract, the parameters and the tie-out kept. An elegant estimate built on an extract nobody tied out is a finding waiting to be written, and it takes the whole estimate down with it rather than one assumption.

In the sample bank the reconciliation runs before anything is calculated and a difference above one dollar stops the close. The threshold is less important than the behaviour: the close cannot proceed past an unexplained difference, so the reconciliation can never become the thing that is finished last.

How do you prepare for a CECL audit without rebuilding the quarter?

By making the file a by-product of the close rather than a project that follows it. Most of the cost of audit preparation is re-derivation — finding the survey the factor rested on, working out which forecast vintage was used, reconstructing why a number changed — and all of it is cheap at the moment the decision is taken and expensive three months later.

Four habits do most of the work. Cite at the point of decision, so every number in the memo carries the source it came from when it is written, not when it is challenged. Date every source, so staleness is a property of the file rather than a discovery. Record decisions, including the ones that changed nothing. And tie out before you calculate, so the foundation is never the last thing finished. None of these is a tool; they are the shape of a close, and a product's job is to make them the path of least resistance rather than a discipline someone has to sustain in the fourth week of a quarter.

Internal audit and external audit: who tests what

They test different things and should not be substituted for each other. Internal audit's remit is set out in the handbook: it "should assess the risks of material misstatement posed by estimates of expected credit loss and evaluate control effectiveness" (Comptroller's Handbook, Allowances for Credit Losses). That is a view of the process: whether the controls are designed well and operated, quarter after quarter, including in quarters nobody is watching.

The external auditor's remit is the financial statements: whether the allowance is materially correct and whether the evidence supports it. The two overlap at the controls, which is where reliance is negotiated, and the negotiation goes better when internal audit's work is current, scoped to the estimate rather than to lending generally, and documented to a standard the external team can test. A bank that gets reliance saves weeks of fieldwork; a bank that does not pays for the same tests twice.

A third party sits alongside both: the examiner, who reads the same file for a different purpose and who is interested in the judgements the audit treats as management's. A file built for the auditor usually serves the examiner, with one addition — the examiner wants the governance trail in more detail, because it is the supervisory expectation rather than the financial statement assertion that they are testing.

What the committee approved, and the record the auditor reads first

When the auditor should get access, and what they should see

From the day the package is final, read-only, to the whole file rather than to a curated selection. Early access changes the character of the engagement: questions arrive while the people who made the decisions still remember them, and the audit's first week is spent reading rather than requesting. Read-only matters for the opposite reason — the file the auditor sees has to be the file as it was, with nothing editable after the fact, or the audit trail stops being evidence.

What they should see is the awkward parts too. The factor that was proposed and rejected. The difference in the bridge that is explained rather than absorbed. The check that failed and what was done about it. A file that only contains the tidy version invites the question of what was left out, and that question is more expensive than any of the answers would have been.

In the sample bank the external auditor's access opens when the committee approves, the binder is indexed to the memo, and each open request is answered by the item that supports it. Behind that sits the discipline that produced it — the chain of who proposed, who decided and who approved, set out in who proposes, who decides, who approves.

Twelve dated steps, with the auditor's review as the last one

To see the binder, the factor support and the audit trail behind one quarter, start from CECL Allowance Management.

Questions people ask

How far in advance should you prepare for a CECL audit?

The honest answer is that preparation is the close, not a phase after it. Evidence costs almost nothing to capture at the moment a decision is taken and a great deal to reconstruct a quarter later. If a file has to be assembled retrospectively, start at least a month before fieldwork and work from the request list of the previous year, since the programme rarely changes much.

Does the auditor test every qualitative factor or a sample?

It depends on the risk assessment and on whether controls can be relied on, but the overlay attracts more attention than most balances because it is where management judgement concentrates — the OCC's handbook lists elements susceptible to management's bias among the areas an auditor may assess, and the overlay is the plainest example. A file with current, dated support behind every cell makes either approach cheap; a file with support behind some cells makes both expensive.

What is the difference between internal audit and external audit of the allowance?

Internal audit assesses the risks of material misstatement in the estimate and evaluates whether the controls over it are effective, quarter after quarter. The external auditor forms an opinion on the financial statements, testing whether the allowance is materially correct and supported. They overlap at the controls, which is where the external team decides how much of internal audit's work it can rely on.

Why do auditors ask for committee minutes so early?

Because the review-and-challenge control is one of the first things they have to evaluate, and the minutes are the evidence that it operated. The PCAOB has reported engagement teams whose review of minutes did not give them enough detail to evaluate the design and operating effectiveness of the control — which is as much a problem for the bank that wrote the minutes as for the auditor who read them.

What happens if the tape does not tie to the general ledger?

The difference has to be identified, explained and documented before the estimate is relied on, because every test above it inherits the weakness. Inspection findings have included teams not evaluating the accuracy and completeness of underlying data, including data handed to an engaged specialist, so extracts sent outside the bank need the same reconciliation as the tape itself.

Can software answer the auditor's requests?

It can answer the lookup half: indexing evidence to the memo, keeping each source with its date, and holding the audit trail of every decision so a request resolves to an item. It cannot perform the auditor's test, and it does not make a file compliant with any audit standard — what it produces is evidence the auditor tests, which is the only thing a preparer can usefully control.