How Long to Keep Audit Workpapers and Client Records

There is no single retention period for a CPA firm. The period depends on the type of engagement, the standards that govern it, the regulators and funding agencies involved, and the firm's own policy. The safe approach is to apply the longest period that touches the engagement, and to write that rule into the firm's quality management policies.

This guide sets out the periods that come from primary sources, how they interact, and the procedural points that matter: assembling the file, changing it afterwards, and returning client records.

What does AU-C 230 require for a GAAS audit?

For audits of nonissuers performed under GAAS, AU-C 230 covers assembly and retention in paragraphs .16 to .18.

• Assembly. The auditor assembles the final audit file on a timely basis after the report date, no later than 60 days after the report release date. That date is the documentation completion date.
• Retention. The retention period for audit engagements is ordinarily no shorter than five years from the report release date.
• No deletion. After the documentation completion date, the auditor does not delete or discard audit documentation of any nature before the end of the retention period.
• Changes after assembly. If documentation has to be modified or added after assembly, the auditor records the specific reasons, when and by whom the changes were made, and when and by whom they were reviewed.

The application material adds two points. Statutes, regulations or the firm's own policies may require a period shorter than 60 days for assembly, and they may require a retention period longer than five years. The firm's system of quality management must include policies on retaining engagement documentation. AU-C 230 is the floor.

Assembly is administrative: sorting, cross-referencing, removing superseded drafts, signing off a completion checklist. New procedures and new conclusions do not belong in the assembly window. The audit completion checklist and the data retention checklist cover the mechanics.

What changes for audits of issuers?

Audits of public companies fall under PCAOB standards and SEC rules instead. PCAOB AS 1215 sets its own deadline for assembling the file after the report release date, which is shorter than the 60 days in AU-C 230, and a retention period of seven years.

The SEC rule that backs the seven years is 17 CFR 210.2-06. It requires an accountant to retain, for seven years after concluding an audit or review of an issuer's financial statements, the records relevant to the audit or review. That covers workpapers and other documents that form the basis of the audit, plus memoranda, correspondence and electronic records that contain conclusions, opinions, analyses or financial data related to the work. The rule applies whether the records support the final conclusion or contain information inconsistent with it.

How long for a single audit or other federal award audit?

For an audit under the Uniform Guidance, 2 CFR 200.517(a) requires the auditor to retain audit documentation and reports for a minimum of three years after the date the auditor issues the report to the auditee. The cognizant or oversight agency, or the pass-through entity, can extend that period by written notice. If the auditor knows that a federal agency, pass-through entity or the auditee is contesting a finding, the auditor must contact the parties for guidance before destroying the documentation. Under 200.517(b), documentation must be made available on request to the cognizant or oversight agency, a federal agency or GAO.

A three-year federal minimum does not shorten the five-year AU-C 230 period. A single audit is a GAAS audit and a GAGAS audit, so the longer period governs unless a rule requires more. See the single audit walkthrough and the Yellow Book guide for the wider requirements.

What about employee benefit plan audits?

Section 107 of ERISA requires plan administrators to keep records that support the information in plan filings, such as the Form 5500, for at least six years after the filing date. The plan, not the auditor, owns that obligation. The plan auditor's own file is still governed by AU-C 230, but a plan audit file that will be needed to support a later DOL inquiry is a reason to hold it longer. See the 401(k) audit requirements guide.

What about tax returns and client records?

Tax work has its own rules, separate from the attest file:

• Return copies. A signing tax return preparer must keep a completed copy of each return, or a record of the taxpayer's name, taxpayer identification number, tax year and return type, for three years after the close of the return period. This is in 26 CFR 1.6107-1(b).
• Return of client records. Under Circular 230, 31 CFR 10.28, a practitioner must promptly return client records the client needs to comply with federal tax obligations when the client asks. A fee dispute generally does not excuse the obligation, subject to state-law exceptions described in the section. The practitioner may keep copies.

Client-provided records are the client's, and the firm's own analyses and workpapers are treated differently from them. The retention policy should separate the two and say who may receive what on request.

Summary of periods

Use the longest applicable period. Statutes of limitation for professional liability claims, state board rules and insurer requirements can all be longer, and the firm should take legal advice on those.

Worked example (illustrative dates)

A firm issues an audit report on a December 31, 2026 nonprofit with a single audit. The report release date is April 15, 2027.

• Assembly deadline under AU-C 230: 60 days after April 15, 2027, which is June 14, 2027.
• Five-year minimum from the release date: April 15, 2032.
• Federal minimum: three years from the date the report is issued, or April 2030, unless an agency extends it.
• The firm's policy says seven years for all audit files, so the file is retained until April 2034.

The firm sets one destruction date, April 2034, and calendars an agency-extension check in April 2030. If a pass-through entity writes to say it is contesting a finding, the file is held until the matter closes.

Mistakes to avoid

• Treating the three-year federal period as the rule for single audits. The five-year GAAS minimum still applies.
• Changing workpapers after the documentation completion date without a record. The reason, who, when and review are required.
• Keeping only the signed workpapers on an issuer audit. Under 17 CFR 210.2-06, documents containing information on a significant matter that is inconsistent with the final conclusion must be retained, including records of consulting on or resolving differences in professional judgment.
• No policy for electronic files. Email, shared-drive copies and client portals are part of the record. The policy should say where the master file is and how it is locked.
• Destroying files during a dispute or inquiry. Hold a file when a claim, regulator request or peer review question is pending.

Frequently asked questions

How long must an audit file be kept under AU-C 230?

For a GAAS audit, the retention period is ordinarily no shorter than five years from the report release date. Statutes, regulations or the firm's policy can set a longer period.

When must the audit file be assembled?

Within 60 days after the report release date for a GAAS audit of a nonissuer. A statute, regulation or firm policy can require a shorter period.

Can I delete drafts after the file is assembled?

AU-C 230 allows superseded drafts and duplicates to be removed during assembly, before the documentation completion date. After that date, no documentation can be deleted or discarded until the retention period ends.

Do I have to give a client my workpapers?

Client-provided records must be returned on request, and for tax work Circular 230 requires prompt return of records the client needs to meet federal tax obligations. State law and the AICPA Code also address record return, so the firm needs a written policy on what it hands over and when.

Sources

• AICPA, AU-C Section 230, Audit Documentation, paragraphs .16 to .18 and application material, as amended by SAS No. 146
• SEC, 17 CFR 210.2-06, Retention of audit and review records: https://www.ecfr.gov/current/title-17/section-210.2-06
• PCAOB, AS 1215, Audit Documentation
• OMB, 2 CFR 200.517, Audit documentation: https://www.ecfr.gov/current/title-2/section-200.517
• Treasury, 26 CFR 1.6107-1, Tax return preparer must furnish copy of return and must retain a copy or record: https://www.ecfr.gov/current/title-26/section-1.6107-1
• Treasury, 31 CFR 10.28, Return of client's records (Circular 230): https://www.ecfr.gov/current/title-31/section-10.28
• ERISA section 107 (29 U.S.C. 1027), Retention of records

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error