Audit documentation is judged by one test: could an experienced auditor with no prior link to the engagement understand what was done, what evidence was obtained and what was concluded? Most file review comments are a failure of that test, not a failure of the audit itself. The work was often done. It was not recorded.
Last reviewed: 17 October 2026. Facts checked. We opened search summaries of ICAI-related commentary on SQC 1 and SA 230, including the AASB observations as reported by Taxmann, and an ICAI regional training deck. We could not open the full ICAI text of SA 230 or SQC 1 / SQM 1, and the SQM 1 position on file assembly after its adoption was not checked, so confirm the current time limit in the firm's quality policy and the latest standard. We have not seen any peer review manual here, so the comment list below reflects general practice, not an official list.
The basics, briefly
For what SA 230 asks you to keep, see our SA 230 complete guide and the what to keep and how article. Here we stay on the review comments.
Comment 1: Procedure listed, conclusion missing
A working paper shows a test, a sample and some ticks, then stops. There is no line saying what the result means for the assertion. Fix: end every paper with a one-line conclusion and whether any misstatement was found or the control failed.
Comment 2: Evidence not traceable
"Verified with invoices" does not tell a reviewer which invoices. Fix: record the identifiers: invoice numbers, dates, amounts, who provided them and where the copy is stored. The aim is that someone else could re-select the same items.
Comment 3: Judgement without reasons
Materiality, sample size, risk rating and "no further work needed" are decisions. SA 230 expects significant matters and the judgements on them to be recorded. Fix: a short note on why, in the auditor's own words.
Comment 4: Preparer and reviewer not identifiable
Papers with no initials, no dates or tick marks that no legend explains. Fix: sign and date each paper, and keep one tick-mark legend per file. Review sign-off should be dated after the preparer's.
Comment 5: Late assembly
According to the AASB observations summarised by Taxmann, SQC 1 paragraph 75 says the time limit for completing the final file is ordinarily not more than 60 days after the date of the auditor's report, and where law sets a different limit, that governs. The same sources note many firms had no policy for timely assembly. Fix: put the date in the firm's policy and in the engagement checklist, and track it.
Comment 6: Changes after assembly
If something is added or changed after the file is assembled, per the summaries of paragraph 16 of SA 230, record why, when, by whom and who reviewed it. Fix: a short "post-assembly changes" log in the file.
Comment 7: Client data sitting outside the file
Bank statements, confirmations and management explanations live in email or on WhatsApp. Fix: save them into the file with the date received. Replies to confirmations received after the report date need a note explaining the timing.
Comment 8: Boilerplate across clients
The same text for risk assessment on a trading company and a hospital. A reviewer will notice. Fix: write the entity-specific risks first, then use templates for the format, not the content. See our audit checklist generator post.
Comment 9: Retention and confidentiality
Summaries say SQC 1 ordinarily sets retention at no shorter than seven years from the date of the auditor's report. Check the firm's policy and any longer period in law. Access to files should also be limited to the team.
A quick self-review before sign-off
- Does each area have a conclusion?
- Can every number in the financial statements be traced to a working paper?
- Are open points cleared, with the reviewer's reply?
- Are significant judgements explained?
- Are dates, sign-offs and the assembly date recorded?
Our audit evidence article covers how much evidence is enough.
Frequently Asked Questions
What is audit documentation?
The record of procedures performed, evidence obtained and conclusions reached.
Who owns the working papers?
The audit firm, subject to law and professional confidentiality.
Is a review note a substitute for evidence?
No. A reviewer's note points to evidence; it is not evidence.
Can documentation be done after the report date?
Assembly of the file can, within the time limit; the audit evidence must already exist at the report date.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error