Audit documentation, also called working papers, is the record of the procedures you performed, the evidence you obtained and the conclusions you reached. SA 230 sets one test: a stranger with audit experience, who has never seen the job, must be able to understand what you did and why. This guide covers what to keep, how to organise it and the rules on closing the file.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on SA 230 and opened an ICAI Peer Review Board training deck hosted by the Eastern India Regional Council (eirc-icai.org), which quotes SA 230 and SQC 1. We did not open the standard's own text on icai.org: the knowledge-base host returned a certificate error and the Western regional council site did not resolve. The seven-year retention figure also matches ICAI's announcement amending the retention period (SQC 1 and SA 230 para A23), seen in search results. The 60-day figure comes from the training deck and secondary sources, which attribute it variously to SA 230 and SQC 1; we did not confirm the exact paragraph. Confirm against the current standards before quoting them in a policy.
The idea first
Think of working papers as your proof of work. If a regulator, peer reviewer, partner or successor auditor asks "how did you reach this opinion?", the file answers without you in the room. An audit that was done well but not recorded is, in practice, very hard to defend.
The ICAI deck defines audit documentation as the records of the procedures auditors performed, the audit evidence they obtained, and the conclusions they reached. It adds that the term is sometimes used interchangeably with working papers.
The "experienced auditor" test
SA 230 requires documentation sufficient to enable an experienced auditor, with no previous connection to the audit, to understand it. The deck defines an experienced auditor as someone with practical audit experience and a reasonable understanding of audit processes, the standards and legal requirements, the entity's business environment, and the financial reporting issues in its industry.
Use that test on every working paper: could that person follow it without asking you anything?
What each working paper should show
The deck summarises the elements you must record:
- The nature, timing and extent of procedures performed. What you did, when, and how much.
- The evidence obtained and the results of testing.
- Significant matters that came up, and the conclusions.
- Professional judgements, especially on testing and sampling.
A practical layout for a single working paper:
| Section | What goes in it |
|---|---|
| Header | Client, period, account or area, working paper reference |
| Objective | What risk or assertion this paper addresses |
| Source | Where the data came from (ledger, bank statement, system report) |
| Work done | The procedure, sample basis and how items were chosen |
| Results | What you found, with exceptions listed |
| Conclusion | Whether the objective is met and what follows |
| Sign-off | Who prepared it, who reviewed it, and the dates |
Tick marks need a legend. Cross-references should let a reviewer jump from the financial statement line to the paper that supports it.
What goes in the audit file
The training deck groups the contents into two files.
| File | What it holds | Examples |
|---|---|---|
| Permanent file | Documents useful across several years | Engagement letter, constitutional documents (Memorandum and Articles), organisation structure, lists of directors, bankers and lawyers, correspondence with previous auditor |
| Current file | Documents for this year's audit | Understanding of the entity, risk assessment, audit programme, sample lists and basis of selection, analyses, confirmations, representation letters, communications with those charged with governance, issues memorandum, completion and reporting papers, quality review evidence |
The deck also lists the audit tools and files obtained from the entity (for example when using software to test journal entries) and any use of other auditors or experts.
Working papers worth special care
- Risk assessment and materiality. Show how these drove the plan. See materiality and the audit risk model.
- Sampling. Record the population, the basis of selection and the results. See SA 530 and sampling with AI.
- Judgement areas. Write the reasoning, not only the answer.
- Discussions with management. Keep dated notes of what was said and what you did with it.
- Evidence. Describe what each document is and how reliable it is. See audit evidence types and reliability.
Closing the file
The deck quotes SA 230 on three points.
- Assemble the final file on a timely basis after the date of the auditor's report. The deck states the maximum prescribed time as not more than 60 days from the report date, citing para 75 of SQC 1.
- Do not delete or discard any audit documentation before the end of its retention period once the file is assembled.
- Document later changes. If you must modify or add documentation after assembly, record the specific reasons and when and by whom the change was made and reviewed.
On retention, the deck says the period is ordinarily no shorter than seven years from the date of the auditor's report. Your firm's policy may be longer.
Late additions are a common inspection finding in practice: papers dated well after the report suggest the work was not done on time. If you add something late, say so openly.
Habits that keep files inspection-ready
- Document as you work, not weeks later.
- Name and reference every paper consistently.
- Review in writing, with notes cleared and signed.
- Keep the file complete: no loose emails, no unexplained attachments.
- Use a standard template so reviewers know where to look.
For a self-check, see is your working paper ICAI inspection-proof and the fuller SA 230 complete guide. For automating repetitive papers, see audit working papers automation.
Frequently Asked Questions
What is the difference between audit documentation and working papers?
None in practice. Working papers is the older term for audit documentation, and ICAI training material uses them interchangeably.
What is the permanent audit file?
It holds documents that stay useful across years, such as the engagement letter, constitutional documents and organisation structure, so you do not recreate them every year.
How long must audit documentation be kept?
ICAI training material quoting SA 230 says ordinarily no shorter than seven years from the date of the auditor's report. Check the current standard and your firm's policy.
Can I add papers after the audit report is signed?
Only with care. After final assembly, any change or addition must record why it was made, when, by whom and who reviewed it.
Do tick marks and checklists count as documentation?
They support it, but a checklist alone rarely shows the evidence and judgement. Pair them with a description of the work and the result.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error