For an audit of an issuer, PCAOB AS 1215 requires the audit file to be assembled no more than 45 days after the report release date and retained for seven years from that date. For a GAAS audit of a nonissuer, AU-C 230 allows up to 60 days and requires retention of not less than five years. Firms that do both kinds of work need two clocks.
This post covers the AS 1215 rules, how the start dates change when no report is issued, what you can and cannot do after the completion date, and the SEC rule that sets the same seven years for the accountant's records. For the AU-C side, see documentation completion date and post-release file changes and audit record retention.
What are the AS 1215 dates?
Paragraph .15 sets the documentation completion date. Before the report release date, the auditor must have completed all necessary auditing procedures and obtained sufficient evidence to support the report. A complete and final set of documentation should then be assembled for retention as of a date not more than 45 days after the report release date.
Paragraph .14 sets retention: seven years from the date the auditor grants permission to use the auditor's report in connection with the issuance of the company's financial statements (the report release date), unless a longer period is required by law.
The start date changes in two situations:
| Situation | Documentation completion date | Retention starts from |
|---|---|---|
| Report issued | 45 days after report release date | Report release date |
| No report issued | 45 days after fieldwork was substantially completed | Date fieldwork was substantially completed |
| Auditor unable to complete the engagement | 45 days after the engagement ceased | Date the engagement ceased |
The second and third rows apply when no report is issued or the engagement ends before completion.
Worked example with dates
An issuer audit report is released on March 15, 2027.
- Documentation completion date: 45 days later is April 29, 2027.
- Retention period ends: seven years from March 15, 2027 is March 15, 2034.
If the same firm audited a nonissuer and released that report on March 15, 2027, AU-C 230 allows 60 days, which is May 14, 2027, and a minimum retention of five years, which is March 15, 2032. A firm that files both on one calendar should set its issuer deadline from the 45-day rule and keep the nonissuer deadline separate.
What can change after the completion date?
Paragraph .16 is short: audit documentation must not be deleted or discarded after the documentation completion date, however, information may be added. Anything added must show the date it was added, the name of the person who prepared it, and the reason for adding it.
That matches the AU-C 230 approach, with one difference in wording. The AU-C requirement applies the same three facts (reasons, when and by whom) and adds a review element: the AU-C 230 paragraph .18 asks for when and by whom the changes were made and reviewed. AS 1215.16 does not state the review element in that paragraph.
Paragraph .17 covers a common issuer scenario. Other standards require procedures after the report release date. The example in the standard is AS 4101, which requires certain procedures up to the effective date of a registration statement. The additions from those procedures are identified and documented the same way as in paragraph .16.
What if you find a documentation gap later?
Paragraph .09 covers a gap found later. If, after the documentation completion date, the auditor becomes aware, because of a lack of documentation or otherwise, that procedures may not have been performed, evidence may not have been obtained or conclusions may not have been reached, the auditor must determine and demonstrate that sufficient procedures were performed, evidence obtained and conclusions reached. To do that, the auditor must have persuasive other evidence. Oral explanation alone does not qualify, though it can be used to clarify other written evidence.
Two outcomes follow:
- Demonstrated, but the documentation is not adequate: consider what additional documentation is needed, and prepare it in line with paragraph .16.
- Not demonstrated: comply with AS 2901, Consideration of Omitted Procedures After the Report Date.
What is the engagement completion document?
Paragraph .13 requires the auditor to identify all significant findings or issues in an engagement completion document. It may hold the information itself or cross-reference supporting documentation, and the document with its cross-references should be as specific as necessary for a reviewer to gain a thorough understanding of the significant findings.
Paragraph .12 lists what counts as significant, including:
- Significant matters on the selection, application and consistency of accounting principles.
- Results that indicate a need for significant modification of planned procedures, material misstatements, significant deficiencies or material weaknesses.
- Accumulated misstatements and the evaluation of uncorrected misstatements, with quantitative and qualitative factors.
- Disagreements among team members or with others consulted, including the basis for resolution. A team member who disagrees with the final conclusion should document that disagreement.
- Circumstances causing significant difficulty applying procedures.
- Significant changes in risk assessments.
- Significant risks and the results of the procedures performed in response.
- Any matters that could result in modification of the auditor's report.
Compare the AU-C 230 position, where a completion memorandum is described as something the auditor may find helpful (A13). Under AS 1215.13 it is required. For content, see audit completion memo contents.
How does this relate to the SEC records rule?
SEC Regulation S-X Rule 2-06 (17 CFR 210.2-06) is titled "Retention of audit and review records." Paragraph (a) requires the accountant to retain records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications and other documents and records (including electronic records), for a period of seven years after the accountant concludes an audit or review of an issuer's financial statements. Paragraph (b) defines workpapers as documentation of procedures applied, evidence obtained and conclusions reached, as required by the standards of the SEC or the PCAOB.
The two rules reach the same seven years but start the clock differently in wording: AS 1215 counts from the report release date, and Rule 2-06 counts from when the accountant concludes the audit or review. Retain to the later of the two.
Frequently asked questions
Is 45 days a maximum or a target?
Paragraph .15 says the final set should be assembled as of a date not more than 45 days after the report release date, so it is the outer limit. Set the firm's internal target earlier.
Do the 45 days apply to review engagements of interim information?
AS 1215 applies to audits of financial statements, audits of internal control over financial reporting, and reviews of interim financial information (paragraph .01). Significant findings from interim reviews also feed the annual engagement completion document.
Who is responsible for another office's or auditor's documentation?
The office issuing the report is responsible (paragraph .18) and must obtain, review and retain certain items from other offices and other auditors before the report release date (paragraph .19), including the engagement completion document, a list of significant risks and responses, a schedule of accumulated misstatements, and all matters to be communicated to the audit committee.
Sources
- PCAOB, AS 1215, Audit Documentation (paragraphs .01, .09, .12 to .19): https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
- SEC, 17 CFR 210.2-06, Retention of audit and review records: https://www.law.cornell.edu/cfr/text/17/210.2-06
- AICPA, AU-C Section 230, Audit Documentation (paragraphs .06, .16 to .18, A13), for the nonissuer comparison: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error