How do I know what to actually test in an audit?

You can follow the program step by step, but the deeper skill, knowing what actually deserves testing and why, still feels out of reach. That is the honest gap between doing an audit and understanding one, and almost everyone passes through it. The program tells you what. It does not teach you why, and the why is what you are missing. Every test exists to answer a question: what could go wrong here, and how would I know if it did? When you just follow steps, you are answering questions someone else asked. The shift is to start asking them yourself. Look at what you are testing and ask what risk it is chasing. Once you see the risk behind the step, what to test stops being a mystery and starts being obvious. So for each major area, before you touch the program, write one sentence: what is the worst thing that could be wrong here? Then check whether your tests would actually catch it. Do this enough and you will stop needing the program to tell you what to test. You will be the one who could have written it.