13.4 Audit Documentation, Assembly & Retention (AU-C 230)
Key Takeaways
- Under AU-C 230 and PCAOB AS 1215, audit documentation must satisfy the 'experienced auditor standard,' enabling an experienced auditor with no previous connection to understand the nature, timing, extent, evidence, and conclusions of the audit.
- Audit documentation is divided into the Permanent File (documents of ongoing multi-year significance like bylaws, bond indentures, and lease contracts) and the Current File (working papers supporting the specific audit period).
- Documentation must be complete within 60 days after the report release date under AU-C 230; amended PCAOB AS 1215 requires 14 days for issuer audits.
- The mandatory document retention period is at least 5 years from the report release date for non-issuers (AICPA) and at least 7 years for public company issuers (PCAOB / Sarbanes-Oxley).
- After the document assembly completion date, documentation may never be deleted or discarded; later additions must document the specific reasons and when and by whom they were made and reviewed.
13.4 Audit Documentation, Assembly & Retention (AU-C 230)
Core Principle: Audit documentation—traditionally termed working papers or workpapers—is the written record of the basis for the auditor's conclusions that provides the support for the auditor's representations. Under AU-C 230 (Audit Documentation) and PCAOB AS 1215, documentation must be prepared on a timely basis and must satisfy the rigorous Experienced Auditor Standard. The adage of professional auditing applies: "If it was not documented, it was not done."
1. Purpose and Objectives of Audit Documentation
Audit documentation serves two primary functions and several secondary functions:
+-------------------------------------------------------------------------------------------------------+
| FUNCTIONS OF AUDIT DOCUMENTATION |
| |
| PRIMARY PURPOSES SECONDARY PURPOSES |
| 1. Provide a sufficient and appropriate record 1. Assists the audit team in planning and |
| of the basis for the auditor's report. performing the audit. |
| 2. Provide evidence that the audit was planned 2. Facilitates direction, supervision, and review |
| and executed in accordance with GAAS and of audit work (AU-C 220). |
| applicable legal/regulatory requirements. 3. Enables engagement quality control reviews and |
| external inspections (peer review, PCAOB). |
| 4. Retains historical record of recurring matters. |
+-------------------------------------------------------------------------------------------------------+
2. The "Experienced Auditor" Standard
AU-C 230.08 and PCAOB AS 1215 establish an objective benchmark for documentation sufficiency known as the Experienced Auditor Standard:
THE EXPERIENCED AUDITOR BENCHMARK
|
Audit documentation must enable an EXPERIENCED AUDITOR having NO PREVIOUS
CONNECTION with the audit to understand the complete audit workflow:
|
+-----------------------------------------+-----------------------------------------+
| | |
NATURE, TIMING, & EXTENT RESULTS & EVIDENCE SIGNIFICANT FINDINGS
- Specific procedures performed - Evidence obtained from testing - Significant issues arising
- Items tested (identifying traits) - Reconciliation to general ledger - Conclusions reached thereon
- Who performed work and date - Verification of assertion validity - Significant professional
- Who reviewed work and date judgments exercised
Who is an "Experienced Auditor"?
An experienced auditor is defined as an individual (whether internal to the firm or an external peer reviewer/regulator) who possesses:
- Practical audit experience, and
- A reasonable understanding of audit processes, auditing standards (GAAS/PCAOB), the relevant business environment, and industry accounting and financial reporting standards.
Documenting Significant Audit Findings
Audit documentation must explicitly capture significant audit findings or issues, which include:
- Significant risks identified and the results of audit procedures addressing them.
- Results indicating that the financial statements could be materially misstated or the need to revise previous risk assessments.
- Circumstances causing significant difficulty in applying necessary audit procedures.
- Findings that could result in a modification of the audit opinion or the inclusion of an Emphasis-of-Matter/Going Concern section.
- Disagreements among team members or with management regarding accounting treatments, including how those disagreements were resolved.
3. Permanent File vs. Current File Taxonomy
Audit workpapers are systematically organized into two primary archives based on their temporal relevance:
+-------------------------------------------------------------------------------------------------------+
| PERMANENT FILE VS. CURRENT FILE TAXONOMY |
| |
| PERMANENT FILE (Continuing Significance) CURRENT FILE (Applicable to Current Year Only) |
| - Articles of Incorporation and Bylaws - Audit Engagement Letter |
| - Corporate Charter and Partnership Agreements - Overall Audit Strategy and Audit Plan |
| - Long-Term Bond Indentures and Mortgages - Working Trial Balance |
| - Long-Term Operating Leases and Union Contracts - Lead Schedules supporting F/S accounts |
| - Internal Control Flowcharts and System Manuals - Bank Confirmations and Bank Reconciliations |
| - Historical Analyses of Capital Stock & Equity - Accounts Receivable Confirmation Schedules |
| - Prior Years' Tax Returns & Depreciation Logs - Inventory Count Observation Test Sheets |
| - Pension and Post-Retirement Benefit Plans - Search for Unrecorded Liabilities Workpapers |
| - Historical Schedule of Unadjusted Differences - Legal Inquiry Letter and Attorney Responses |
| - Management Representation Letter (AU-C 580) |
| - Summary of Unadjusted Audit Differences (SUAD) |
+-------------------------------------------------------------------------------------------------------+
Ownership and Confidentiality of Working Papers
- Auditor Ownership: Audit documentation is the exclusive property of the independent auditor, not the client. The client has no legal right to demand the auditor's workpapers.
- Confidentiality (AICPA Code of Professional Conduct): The auditor must maintain strict confidentiality and cannot disclose workpapers without client consent, except in situations the Code permits, such as:
- In response to a valid court subpoena or summons.
- As part of an authorized AICPA or State Board of Accountancy peer review or quality review.
- During an official professional ethics investigation or trial.
- In connection with the sale or merger of the CPA firm's practice (with appropriate confidentiality safeguards).
4. Document Assembly Deadlines & Retention Periods: AICPA vs. PCAOB
The statutory deadlines for assembling the final audit file and the required retention periods are heavily tested on the CPA exam. The rules differ significantly between non-issuers (AICPA) and public company issuers (PCAOB / Sarbanes-Oxley):
+-------------------------------------------------------------------------------------------------------+
| STATUTORY DOCUMENTATION DEADLINES |
| |
| REGULATORY STANDARD DOCUMENT ASSEMBLY DEADLINE MANDATORY RETENTION PERIOD |
| Non-Issuers (Private) 60 CALENDAR DAYS AT LEAST 5 YEARS |
| AICPA AU-C 230 from the Report Release Date from the Report Release Date |
| |
| Issuers (Public / SEC) 14 CALENDAR DAYS* AT LEAST 7 YEARS |
| PCAOB AS 1215 / SOX from the Report Release Date from the Report Release Date |
+-------------------------------------------------------------------------------------------------------+
*PCAOB amendments to AS 1215 cut the issuer documentation completion window from 45 to 14 days, effective for audits of fiscal years beginning on or after December 15, 2024 for firms that issued audit reports for more than 100 issuers in 2024, and one year later for all other firms. Older materials still show 45 days.
The Report Release Date Defined
Both deadlines run from the Report Release Date, defined as:
The date on which the auditor grants the entity permission to use the auditor's report in connection with the financial statements (typically the date the audit report is physically or electronically delivered to the client).
Permissible Activities During the Assembly Period
The assembly window (60 days for AICPA; 14 days for PCAOB) is an administrative coordination phase. Permissible actions are strictly administrative:
- Deleting or discarding superseded drafts and preliminary notes.
- Sorting, collating, and cross-referencing final working papers.
- Signing off on completed audit program review checklists.
- Adding documentation of evidence previously gathered, discussed, and agreed upon with the audit team prior to the report date.
- PROHIBITED: Performing new substantive audit procedures or reaching new audit conclusions during the assembly period without documenting subsequent events.
5. Post-Assembly Documentation Changes and Additions
Once the document assembly completion date has passed (Day 61 for AICPA; Day 15 for PCAOB), the audit file is permanently closed.
POST-ASSEMBLY MODIFICATION PROTOCOL
|
+------------------------------+------------------------------+
| |
DELETIONS / DISCARDS ADDITIONS / MODIFICATIONS
STRICTLY PROHIBITED! PERMISSIBLE WITH STRICT CONDITIONS
No documentation of any nature may be Auditor MUST document (AU-C 230):
deleted, purged, or discarded after the reasons, and when/by whom made & reviewed
assembly completion date. 1. Specific reasons for modification.
2. When changes were made.
3. By whom changes were made.
4. Who reviewed changes & review date.
5. (Good practice) effect on conclusions.
Post-Assembly Documentation Rules
If the auditor discovers subsequent facts or omissions that necessitate adding or modifying documentation after the assembly period, the auditor must never overwrite or delete existing documentation. The auditor must add new documentation that explicitly details:
- The Specific Reasons: The exact circumstances necessitating the addition (e.g., receipt of a delayed confirmation or response to a regulatory inquiry).
- Who and When (Author): The identity of the individual who prepared the new documentation and the exact date it was added.
- Who and When (Reviewer): The identity of the supervisor or partner who reviewed the new documentation and the review date.
- Audit Conclusion Impact: A statement of the effect, if any, on conclusions and the report. This is good practice, and it is required when new procedures are performed after the report date.
An independent audit firm completes the audit of a non-issuer client and delivers the audit report to the client on March 1, 2026 (the report release date). Under AICPA AU-C 230, what is the maximum deadline for assembling the final audit documentation file, and what is the minimum required retention period for that documentation?
An auditor is organizing the audit documentation files for a multi-year manufacturing client. Which of the following documents should be classified within the permanent (continuing) audit file rather than the current audit file?
Ninety days after releasing an unmodified audit report on a non-issuer's financial statements, the audit partner receives a delayed confirmation from a major customer verifying an accounts receivable balance tested during fieldwork. The document assembly completion date was 30 days ago. Under AU-C 230, how must the audit firm handle this new documentation?