16.2 Linking Workpapers to Results; Retention, Regulation, and Policy

16.2 Linking Workpapers to Results; Retention, Regulation, and Policy

Quick Answer: CIA Part 2 B7c–d tests two related skills: analyze the link between workpapers and the engagement results, and determine factors when organizing and retaining engagement documentation, including regulatory requirements and internal policies. Every finding and conclusion must trace to indexed workpapers. Retention follows the CAE's methodologies, the organization's rules, and the stricter applicable law — with legal hold suspending ordinary destruction. GIAS Standard 14.6 is the documentation spine; Standard 5.2 covers protection of information. The trap is a conclusion that outruns the file.

B7a–b (section 16.1) asked whether the papers are complete. B7c asks whether engagement results — findings, ratings if used, and the engagement conclusion — are supported by those papers. B7d asks what you consider when you keep the file: law, regulation, policy, confidentiality, and holds. Together they are one idea: the file is both the proof of the results and a record the organization must protect and retain.

Every conclusion and finding traces to a workpaper

The link is reconstructable, not implied. A reviewer should be able to take a sentence in a finding or in the engagement conclusion and land on the workpaper that contains the evidence for that sentence. If the sentence cannot be landed, it is not yet an engagement result — it is a claim.

Practical bridges you will see in a well-organized file:

• Finding sheets carry criteria, condition, cause, and effect (Chapter 15) plus the index of the tests that produced the condition.
• Lead sheets map each engagement objective to the workpapers that support the conclusion on that objective.
• The engagement conclusion (section 16.3) cites the lead sheets or finding summary, not a new fact invented at wrap-up.
• Cross-references run both ways so the test paper knows it supports a finding and the finding knows which test produced it.

If the results say twelve unmatched invoices totaling $186,400 were paid, workpaper C-3 must list those twelve, and F-1 must cite C-3. If the results say management lacks a three-way match, but the file only tested whether a match report existed, the result is not linked — the conclusion outran the procedure. Oral wrap-up meetings can preview results; they cannot be the only place the numbers live. Chapter 18 will cover communication during the engagement. Communication does not replace the file.

The trap: conclusions that outrun the file

A conclusion outruns the file when it is broader, harsher, more quantitative, or more certain than the evidence the workpapers actually contain. This is the B7c favorite. The auditor may be personally convinced. GIAS 14.6 still supports engagement results, not results that exist only in the auditor's head.

The fix is not to hide a real finding. The fix is to narrow the result to the file, or to do the additional work, put it in the file, and then conclude. B7c items often offer a tempting write the stronger sentence anyway because you know the culture. That option fails. Scope limitations you already documented in planning (Chapter 2) also cap what the results may say: you cannot conclude on the portion you did not examine.

Retention: policy, regulation, and the CAE's methodologies

GIAS 14.6 requires documentation sufficient to reperform the work and to support results. The CAE must establish methodologies for documenting, retaining, and releasing engagement records, considering organizational guidelines and regulatory and other requirements. GIAS does not publish a single worldwide number of years. Teach the factors, not an invented IIA retention period.

Internal policies. The organization's records-retention schedule and the internal audit methodology state how long engagement records are kept, in what medium, who may destroy them, and how destruction is documented. Follow the methodology. Do not invent a personal I keep everything forever rule, and do not delete the file when you leave the team.

Regulatory requirements. The applicable rule depends on the industry, jurisdiction, and record type. Public-company environments often align internal audit retention with the longer financial-reporting and SOX-related record rules used in that organization. Seven years is a common policy choice in that setting because it mirrors external-documentation norms — it is not a GIAS-mandated constant you should recite as law. Banks, insurers, healthcare providers, government entities, and listed companies outside the United States may face longer or different schedules. When policy and regulation differ, retain for the longer required period.

Other professional and operational factors. External quality assessments, external-auditor reliance, insurance claims, and contractual audit rights can justify keeping a file longer than the minimum. Medium does not matter: email archives, laptops, chat exports, and the official system are all records if they contain engagement evidence. Shadow copies on personal drives create both a retention failure (they may be destroyed too soon or kept too long off-schedule) and a confidentiality failure.

Legal hold

A legal hold (preservation notice) is triggered when litigation, a government investigation, or a comparable proceeding is pending or reasonably anticipated. It suspends the ordinary destruction schedule for potentially relevant records — including internal audit workpapers, drafts, and related email. You do not destroy a file because the seven-year clock ran if a hold is in force. You also do not wait for a lawsuit to be filed if counsel has issued a hold. Coordination with legal counsel is the operational step; the exam point is that retention policy yields to the hold.

Holds are scoped. Not every engagement file in the shop is frozen — the hold identifies the matter, custodians, and record types. When in doubt, preserve and ask counsel; do not quietly delete. Creating new workpapers after a hold is announced still happens (you may be auditing related processes); destroying old ones that match the hold does not.

Confidentiality and access

GIAS Principle 5, Maintain Confidentiality, and Standard 5.2, Protection of Information, require methodologies to safeguard information. Engagement workpapers often contain employee data, pricing, investigation facts, and control weaknesses that could be exploited. Organize and store them so access is need-to-know inside internal audit and other authorized reviewers (the engagement supervisor, the CAE, a quality assessor, an external auditor under a documented reliance arrangement).

Releasing engagement records to external parties is not a staff-auditor decision. The CAE's methodology typically requires senior management and/or legal counsel approval before release — the idea legacy IPPF 2330.A1 stated, now housed in GIAS 5.2 and 14.6. Process owners receive communications of results (Chapter 18 during the engagement; final communication is primarily Part 3). They do not get unsupervised custody of the evidence file because they are the client. Confidentiality continues after the engagement closes. Retention is not an excuse to park the file in an open shared drive.

Compulsory process (a regulator's lawful demand, a subpoena) is different from a casual request. Follow the CAE and legal protocol; do not freelance a dump to be helpful.

Exam traps

• A polished final communication treated as sufficient documentation by itself.
• Only high findings get workpaper references; moderate findings are left as narrative.
• A universal seven-year GIAS rule (there is not one).
• Destroying papers on the original schedule during a legal hold.
• Emailing the whole file to the client for transparency without the CAE's release protocol.