Paragraph .09 of AU-C 230 asks for three things whenever you document the nature, timing and extent of a procedure: the identifying characteristics of the specific items or matters tested, who performed the work and the date it was completed, and who reviewed it, the date and the extent of the review. A workpaper that says "tested 25 disbursements, no exceptions" fails the first item. A reader cannot tell which 25.
This post shows what counts as an identifying characteristic for each type of test, what the standard says about preparer and reviewer evidence, and a sign-off block you can copy. For the full workpaper format, see how to document audit procedures.
Why does the standard require it?
Paragraph .08 sets the test: documentation must let an experienced auditor with no previous connection to the audit understand the nature, timing and extent of the procedures, the results, and the significant findings. The application material (A14) gives the reasons for identifying characteristics: it improves the ability to supervise and review, it shows the team is accountable for its work, and it makes it possible to investigate exceptions or inconsistencies.
The last reason is the practical one. When a reviewer finds an exception, the first question is which item it was and whether the other items in the selection have the same problem. Without item identification, you cannot answer.
What are the identifying characteristics for each test?
A14 states that the characteristics vary with the procedure and the item. Its examples, with the kind of record that satisfies each:
| Procedure | What to record |
|---|---|
| Detailed test of entity-generated documents (purchase orders) | Dates and unique document numbers of the items selected |
| All items over a specified amount | The scope of the procedure and the population (for example, all journal entries over a specified amount from the journal register for the period audited) |
| Systematic sample | The source, the starting point and the sampling interval |
| Inquiries of entity personnel | The inquiries made, the dates, and the names and job designations of the personnel |
| Observation | The process or matter observed, the relevant individuals and their responsibilities, and where and when the observation took place |
The standard's own systematic sample example is a sample of shipping reports from the shipping log for April 1 to September 30, starting with report number 12345 and selecting every 125th report. That is enough for another auditor to rebuild the selection.
Do I need to list every item in a large sample?
Not when the selection can be reproduced. For a 100 percent test of items over a threshold, record the population and the threshold. For a systematic sample, record the source, start and interval. For a random or haphazard sample, the item identifiers need to be listed, because a reader cannot reconstruct them from a description. The PCAOB's standard for issuer audits (AS 1215.10) takes the same approach: if an audit sample is selected from a population of documents, the documentation includes identifying characteristics such as check numbers.
What about contracts?
Paragraph .10 adds a separate requirement. For procedures that inspect significant contracts or agreements, the audit documentation includes abstracts or copies of them. Identifying the contract is not enough.
Who performed the work and when
Paragraph .09b requires the preparer and the date the work was completed. Two points matter in practice:
- The date is the date the work was completed, not the date the file was assembled. A procedure dated after the report date raises an immediate question, and AU-C 230 addresses the timing in paragraphs .14 to .18.
- Documentation should be prepared on a timely basis (paragraph .07). The application material (A3) notes that documentation prepared when the work is performed, or shortly after, is likely to be more accurate than documentation prepared much later.
When someone else did part of the work, such as a client-prepared schedule or an outside specialist, say so and say how you tested it. See documenting outsourced workpaper review if preparation is done by a team outside the firm.
Who reviewed it, and to what extent
Paragraph .09c requires the reviewer, the date and the extent of the review. A15 clarifies that this does not mean every workpaper must carry a review signature. It does mean the file shows what audit work was reviewed, who reviewed it and when. A common way to meet this is a review sign-off on the section lead sheet or a review index that lists the workpapers covered, with the reviewer's initials and date.
Extent matters because "reviewed" can mean a look at the conclusion or a re-performance of key steps. If the manager reviewed everything on the cash section but the partner reviewed only the conclusion and the exceptions, the file should say that. Review notes and their clearance are a separate record; see review notes writing and clearing.
Worked example: a disbursements test
Here is a documentation block for a test of unrecorded liabilities and disbursement authorization, written to satisfy paragraph .09. The numbers are illustrative.
Population: All checks and ACH payments in the disbursements journal from January 1 to December 31, 2026.
Selection: All 14 payments over the specified amount (listed below by check or ACH number and date), plus a systematic sample of 25 other payments from the journal, starting at payment number 1043 with an interval of every 60th payment.
Items tested: Check 20817 dated 01/14; ACH 4411 dated 02/03; [continue for each item]. The 25 systematic items are listed with number and date on tab 2.
Procedure: Agreed payee, amount and date to the vendor invoice and the approved purchase order; confirmed approval by someone other than the preparer.
Exceptions: Check 20954: no approval signature. Followed up with the controller on 02/18/2027 (name and title recorded); approval was located in the email system and attached.
Prepared by: Initials, completed 02/19/2027. Reviewed by: Initials, 02/24/2027. Extent: All items re-agreed to supporting documents for the 14 largest; remaining items reviewed through the tick marks and exception follow-up.
Common gaps reviewers find
- A sample size with no item list or starting point and interval.
- "Per discussion with client" with no name, title or date.
- A preparer sign-off with no date, or a date that falls after the report date.
- A reviewer initial on the file index but no indication of which workpapers were covered.
- Copies of significant contracts missing; only a note that the contract was "read."
Frequently asked questions
Does every workpaper need a reviewer signature?
No. A15 says the requirement does not imply that each working paper includes evidence of review. The file must show what was reviewed, by whom and when.
Can I rely on oral explanations to fill gaps?
No. A7 states that oral explanations on their own are not adequate support for the work performed or conclusions reached, though they can be used to explain or clarify what is in the documentation.
Is a smaller audit held to a lower standard?
A19 says documentation for a smaller, less complex entity is less extensive, but the overriding requirement in paragraph .08 still applies: an experienced auditor must be able to understand it, because outside parties may review it.
Sources
- AICPA, AU-C Section 230, Audit Documentation (paragraphs .07 to .10, A3, A7, A14, A15, A19): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 1215, Audit Documentation (paragraph .10 and note on identification of items inspected): https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error