Based on what is in your risk assessment, policies, and monitoring plans, create  your audit checklist. An audit tells you if you did what you said you were going to do. This checklist should include at least 20 items that will be checked during a standard audit. Create a table with four columns. The title for each column should be as follows:

• Audit Item (under this header, list the 20 items that will be checked)
• Item Described
• Source
• Audit Criteria

For the Item Described column, include a sentence or two about the item being audited. The Source should describe where this control came from (such as a policy, monitored control). For the Audit Criteria, include what the auditor should look for, including acceptable ranges.