# Audit module — what's built, and what's left

## Shipped — Phase 1

- **`internal_audit` module** — entity-type-driven checklist (16 built-in types + user-extensible, "Other" always present and undeletable), walked area by area (12 built-in areas, 102 starting criteria — generic plus entity-specific addenda for Bank/FI, NGO, Manufacturing, Hotel, Hospital, Construction, IT, Microfinance), a findings register (risk-rated, open/closed tracked), a conclusion, and a signatory block. Both the entity-type catalog (`audit_entity_type`) and the criterion bank (`audit_criterion`) are firm-editable from the module screen itself — the same "add via the screen, never a rebuild" discipline as Rate Master — via `POST/DELETE /api/audit/entity-types` and `/api/audit/criteria`.
- **`audit_report` module** — a standalone Independent Auditor's Report generator, not gated behind any engagement workflow. Any of the four NSA 700/705 opinion types × optional Key Audit Matters × optional Emphasis of Matter × optional Other Matter, assembled in the correct order, with the signatory block (name, CA/RA designation, membership no., firm name, place, date, UDIN, and reserved space for signature/stamp). Paragraph *wording* for the opinion and basis is never fabricated — those are the user's own input; only the responsibilities paragraphs carry a standard NSA 700 default (clearly editable).

## Shipped — Phase 2

- **`stat_audit` module** — wraps `internal_audit()` as its base (same criterion bank, same findings register, same signatory block — zero duplication of that logic) and layers on:
  - **Materiality** — benchmark/value/%, performance materiality (% of overall), clearly trivial threshold (% of performance materiality). Percentages are the auditor's own judgment call, not a Finance-Act figure, so — like Valuation and the loan/lease mechanics — there's deliberately no rate_master dependency.
  - **Sample size** — a judgmental monetary-unit-style planning estimate (population value/count, tolerable/expected misstatement, a risk-level multiplier), explicitly labelled as a planning aid, not a statistical-sampling-standard substitute.
  - **Risk assessment by area** — inherent × control risk per area (reusing the criterion bank's own area list) through a simple risk matrix, producing a combined risk rating and the detection-risk tolerance that follows from it (higher combined risk → lower detection risk tolerance → more extensive procedures needed).
  - **Audit program view** — the same criteria as Internal Audit, but each row now also carries procedure, sample basis, W/P reference, performed-by and result — a genuine audit program, not just a pass/fail checklist.
- `docx_stat_audit`/`xlsx_stat_audit` report the materiality/sample-size/risk sections plus the full program and findings register; cross-verified Python (`statutory_audit`) vs JS (`statutoryAudit`) numerically identical, same as every other engine pair in this app.
- Issuing the opinion once fieldwork concludes still goes through the separate `audit_report` module (unchanged) — a statutory engagement doesn't get a second, parallel report generator.

## Shipped — closing the loop

- **Client Directory roll-up** — `GET /api/client-directory` now finds every `internal_audit`/`stat_audit` workfile per client, re-derives its summary/materiality/risk by running the saved payload back through the exact same engine the module itself uses (never a second, possibly-stale copy of the numbers), and surfaces it: a red "N audit findings open" / "High audit risk" badge on the client's row, plus a full Audit engagements table (workfile, type, completion, findings open, materiality, highest risk) inside the expanded card.
- **`stat_audit` → `audit_report` hand-off** — a "Generate opinion report for this entity" button on the Conclusion section creates (or updates) that client's Auditor's Report workfile with the entity name and signatory carried over, and a suggested opinion type derived from the overall rating (Unsatisfactory → adverse, Needs improvement → qualified, Satisfactory → unqualified), then opens it — still a draft to review, never auto-issued.

Both items from the "still open" list are done. The audit module (Internal Audit, Statutory Audit, Auditor's Report, and the Client Directory integration) is feature-complete for this pass.
