Don't fail audits: an audit-ready PMO pack with retention rules, evidence templates and reconciliation checklist

The worst place to discover your records are incomplete is in the middle of an audit walkthrough, when a finance auditor asks for the approval that authorized a $400k spend and the only thing you can find is a Slack thread and a calendar invite. By then you're not managing the audit anymore. You're explaining yourself.

Most PMOs don't fail audits because they did something wrong. They fail because they can't prove they did it right. The decision happened, the money moved, the gate was passed — but the evidence lives in six tools, three mailboxes, and someone's memory. The control existed in practice. It just didn't exist in a form anyone could hand over.

This post is a working pack: which artifacts matter for which audit type, how long to keep them, what the evidence templates should actually contain, and the reconciliation steps that tie finance records back to approvals. The goal is boring in the best way — when the auditor asks, you open a folder and it's all there.

Start with the audit types, because they don't want the same things

One mistake that quietly wrecks audit prep: treating all audits as one generic event and building one giant document dump. A financial auditor and a security auditor are looking for completely different threads of evidence, and when you mix everything into one pile, you make both of their jobs harder — which makes your job harder.

1. 1
   Financial / internal audit — cares about whether spend was authorized, recorded correctly, and reconciled. CapEx vs OpEx classification, approval thresholds, invoice-to-budget matching.
2. 2
   Compliance / regulatory audit — cares about whether required controls ran at required points. Gate approvals, sign-offs, policy adherence, change control.
3. 3
   Operational / SOX-style controls audit — cares about whether the process worked consistently, not just once. Segregation of duties, approval sequencing, repeatability.
4. 4
   Security / vendor audit — cares about access, data handling, and third-party risk tied to specific projects.

Your records need to be routable by audit type. The same gate approval might serve as evidence for three of these, but a financial auditor needs it alongside the invoice and the budget line, while a controls auditor needs it alongside proof that the approver wasn't also the requester.

The artifact map: what to keep, by audit type

Here's the core reference. This isn't exhaustive, but it covers the artifacts that actually get requested in a typical portfolio audit.

Auditors rarely want more documents. They want the right document, dated correctly, tied to the thing it's supposed to prove. A thousand-page export isn't evidence. A clean approval record with a timestamp and a dollar figure is.

If your decision records already trace back cleanly to their inputs, half of this pack builds itself. That lineage discipline — connecting an approval to the assumptions and data behind it — is the backbone of most of these artifacts, and it's worth getting right independently of any audit.

Retention windows: keep too little and you fail, keep everything and you drown

Retention is where two opposite mistakes happen. Some PMOs delete project records within months of closeout because "the project's done." Others keep literally everything forever, which turns the eventual audit into an archaeology dig and creates its own compliance exposure — you're now holding data you have no reason to hold.

1. 1
   Financial records (invoices, PO matches, funding approvals)

   typically 7 years. Tax and audit cycles drive this, and 7 is the common floor in a lot of jurisdictions.

2. 2
   Gate approvals and decision records

   life of the asset plus a few years. If the project produced a system that's still running, the approval that funded it is still relevant.

3. 3
   Change requests and risk snapshots

   usually 3–5 years, or through the next full audit cycle plus one.

4. 4
   Vendor access and security logs

   often 1–3 years for operational logs, longer if tied to a breach investigation or contractual requirement.

5. 5
   Benefit realization tracking

   through the realization period plus one audit cycle — benefits often land 12–24 months after delivery, so premature deletion here is common.

Worth flagging: the record that gets deleted too early is almost always the approval, not the deliverable. Teams keep the finished product and lose the paper trail that authorized it. When the audit asks "who approved the move from pilot to funded roadmap," the deliverable can't answer that. Only the approval can.

Set retention by artifact type, not by project. "Delete everything 90 days after closeout" is how good evidence disappears.

Evidence templates: make the record self-explaining

An evidence template exists so that someone who wasn't in the room can understand what happened without asking you. If an auditor has to interview you to interpret the document, the document isn't doing its job.

1. 1
   What was decided or recorded? (the action)
2. 2
   Who authorized it? (named role, not just a name)
3. 3
   When? (timestamp, not "Q2")
4. 4
   On what basis? (the data or business case referenced)
5. 5
   What did it cost or change? (the dollar figure or scope delta)

Here's a minimal gate-approval evidence template that holds up:

GATE APPROVAL RECORD Project / Program: [ID + name] Gate: [G2 - Funding / G3 - Build / etc.] Decision: [Approved / Conditional / Rejected] Decision date: [YYYY-MM-DD, time] Authorized by: [Name, role — must match decision-rights matrix] Requested by: [Name, role — must differ from approver] Amount authorized: [$ figure + CapEx/OpEx split] Budget line reference: [GL code / cost center] Basis for decision: [Link to business case v#, risk snapshot, data] Conditions: [Any gating conditions + owner + due date] Reconciliation status: [Matched to PO/invoice: Y/N + ref]

Notice the line that separates "authorized by" from "requested by." That single distinction is what a controls auditor checks for first. If the same person appears on both lines, you've documented a segregation-of-duties failure in your own template — which is uncomfortable, but far better to catch internally than to have it found for you.

A well-designed template is a control, not just a record. By forcing fields that must be filled with valid, distinct values, you prevent the gap before it becomes audit evidence of a problem. This is where a clear operational governance framework with decision matrices pays off — the template fields map directly to the decision-rights matrix, so "authorized by" can be validated against who was allowed to authorize it.

The reconciliation steps that actually get tested

Reconciliation is where finance audits live or die. It's the process of proving that the money recorded in the finance system matches the money that was approved and the money that was actually spent. Three records, one truth, and they have to agree.

1. 1
   The approval — what the gate authorized to be spent.
2. 2
   The commitment — what the PO/contract committed.
3. 3
   The actual — what the invoice/finance system recorded as paid.

A typical reconciliation failure looks like this: a gate approved $300k for a vendor engagement. The PO was raised for $300k. But three change requests over the year bumped actual spend to around $380k, and only two of those changes had documented approvals. The $80k overage isn't the problem on its own — overruns happen. The missing approval is. The auditor's finding isn't "you spent too much," it's "you spent money nobody can show was authorized."

1. 1
   Pull the approval chain for the project — original gate approval plus every change approval, with amounts.
2. 2
   Sum the authorized total. Original + all approved changes = the ceiling that was sanctioned.
3. 3
   Pull commitments — all POs/contracts raised against the project.
4. 4
   Pull actuals — all invoices paid, mapped to the correct GL/cost center.
5. 5
   Three-way match

   authorized total ≥ committed ≥ actual (within tolerance). Flag anything that breaks the chain.

6. 6
   Explain every variance with a documented, dated approval — not an email rationalization after the fact.
7. 7
   Confirm CapEx/OpEx classification held consistently across approval, commitment, and actual. Reclassifications mid-stream need their own memo.

The step people skip is #6. They reconcile the numbers, see they roughly match, and move on. But the audit question is never just "do the totals match." It's "is every variance authorized." A project that's perfectly on budget can still fail if a $50k reallocation happened without a paper trail — because now you've proven money moves without approval, which is a controls finding regardless of the total.

Reconciliation also ties directly into whether the spend delivered what it was supposed to. Linking authorized spend back to expected outcomes — the kind of thread covered in outcome-tracking from intake hypothesis to finance reconciliation — turns reconciliation from a defensive exercise into something that actually tells you whether funding worked.

Visualize the reconciliation workflow:

This shows the flow auditors check.

The gate-alignment checklist matrix

Run this per project before the audit starts, not during. Each item is an artifact you need to be able to produce. The point is to find the gaps before someone external does.

1. 1
   Gate approval record exists for every gate passed (G0 through close)
2. 2
   Each approval names an authorizer who matches the decision-rights matrix
3. 3
   Requester and approver are different people on every approval
4. 4
   Business case / funding request linked to the funding gate
5. 5
   CapEx/OpEx classification documented and consistent across records
6. 6
   Every change request has a dated approval and an amount
7. 7
   Risk register snapshot captured at each decision gate
8. 8
   Three-way reconciliation complete (authorized ≥ committed ≥ actual)
9. 9
   Every variance has a documented, dated authorization
10. 10
    Vendor access grants have matching revocation records at project close
11. 11
    Decision basis (data/assumptions) is linked, not just referenced verbally
12. 12
    Retention window assigned per artifact, not per project
13. 13
    Benefit baseline captured for outcome-driven reconciliation

If more than two or three boxes are unchecked across a sample of projects, you don't have an evidence problem on one project — you have a process gap that'll show up portfolio-wide. That distinction matters, because the fix isn't "go find the missing doc." It's "fix the gate workflow so the doc gets created automatically."

Where this quietly breaks — and how to keep it from happening

The honest reason most PMOs struggle here isn't laziness. It's that evidence creation is a separate step from doing the work. The project manager makes the decision in a meeting, the money moves in the finance system, the approval happens over email — and nobody's job is specifically "capture that as an audit artifact in the right format." So it doesn't happen, or it happens inconsistently.

Teams that stay audit-ready without a scramble share one trait: evidence is a byproduct of the workflow, not an extra task. When a gate gets passed inside the system that tracks gates, the approval record is created at that moment — with the authorizer's identity, the timestamp, the amount, and the link to the business case already attached. No separate "write up the evidence" step, because the system captured it when the decision was recorded.

“

Configure your gate system to auto-capture approver, timestamp, amount, and linked business case when a decision is recorded.

This is where platforms that centralize portfolio records earn their keep. When approvals, change requests, financial actuals, and risk snapshots live in one connected system rather than scattered across tools, reconciliation stops being a manual hunt. The three-way match can be checked on a rolling basis instead of once a year under pressure, and missing-approval gaps surface the week they happen — not twelve months later in front of an auditor. The same logic applies to retention: rules applied by artifact type and enforced automatically beat anyone trying to remember what to keep.

The tooling only helps if the underlying discipline is there, though. A system can enforce that approver ≠ requester, but only if you've actually defined who's allowed to approve what. Record quality follows process quality.

When this level of rigor makes sense — and when it's overkill

Not every PMO needs the full pack. If you're running a handful of small internal projects with no regulatory exposure and no external funding, building a seven-year retention schedule and three-way reconciliation on every variance is probably more ceremony than the risk justifies.

1. 1
   You're subject to financial audit, SOX-style controls, or regulatory review.
2. 2
   Projects involve meaningful CapEx that affects how the company books assets.
3. 3
   You work with external vendors whose access and spend need to be accountable.
4. 4
   Funding decisions cross approval thresholds that someone will eventually question.
5. 5
   You've already been flagged in a prior audit for missing authorization trails.

Bolting all of this on at once in a small, informal PMO that isn't ready for it is a bad idea — you'll create process the team routes around, which is worse than no process because now you have gaps and documentation suggesting you shouldn't have them. Start with the two artifacts that fail audits most often: gate approvals and three-way reconciliation. Get those clean and consistent before expanding the pack.

A short real scenario

A mid-sized PMO running around 40 active projects — infrastructure and internal software — got flagged in an internal audit for "inadequate authorization trails" on roughly a quarter of their project spend. Nothing fraudulent. The money was spent on real work. But a meaningful chunk of change-driven overruns, somewhere around $600k across the portfolio, couldn't be matched to documented, dated approvals.

The audit finding forced a retroactive reconstruction that ate about three weeks of the PMO lead's time, piecing together approvals from email threads and meeting notes. Painful — and not even fully successful, since some records simply didn't exist in a usable form. The fix wasn't dramatic. They standardized a gate-approval evidence template with mandatory requester/approver separation, assigned retention by artifact type, and ran the reconciliation three-way match quarterly instead of annually. By the next audit cycle, the finding count dropped to a couple of minor items, and the pre-audit prep went from weeks of scrambling to roughly a day of running the checklist. The money hadn't changed. The proof had.

Audit failures in a PMO are almost never about doing the wrong thing — they're about not being able to show you did the right thing. The decision happened, the approval existed, the money reconciled. It just wasn't captured in a form anyone could hand over.

Build the pack so evidence is a byproduct of the work, not a last-minute reconstruction. Keep records by artifact type, not by project. Make reconciliation about authorized variances, not just matching totals. Run the gate-alignment checklist before the auditor shows up, not during. Do that, and audits stop being an event you survive and start being something you barely notice.