Audit Working Papers: Types, Examples and How to Prepare Them

Audit working papers (workpapers) are the record of what the auditor did, what evidence was obtained and what was concluded. In a US audit of a nonissuer, the requirements come from AU-C 230, Audit Documentation: the file must let an experienced auditor with no previous connection to the engagement understand the procedures, the results and the significant judgments behind the opinion.

This guide covers how working papers are organized, the main types you will prepare, what a good workpaper contains, and common mistakes.

What are audit working papers?

Audit working papers are the documents, schedules, analyses and memos an auditor prepares or obtains during an engagement to support the audit opinion. They can be electronic or paper, prepared by the audit team or provided by the client (PBC), and they include correspondence such as confirmations and representation letters.

They do three jobs:

1. Support the opinion. They show the evidence behind the auditor's report.
2. Show compliance with GAAS. They show that the required procedures were planned and performed.
3. Enable review. They let the senior, manager, partner, engagement quality reviewer and peer reviewer see what was done.

Permanent file vs current file

Most firms split working papers into two files.

Keep the permanent file current. A debt agreement amended mid-year that still shows the old covenant terms can carry errors into the debt and going concern workpapers.

Types of audit working papers

Engagement and planning papers

• Engagement letter (AU-C 210): terms of the engagement agreed with management.
• Independence documentation: confirmation that the team and firm are independent under the AICPA Code of Professional Conduct.
• Planning memo and audit strategy (AU-C 300): scope, timing, staffing and direction of the audit.
• Materiality (AU-C 320): overall materiality, performance materiality and the benchmark chosen, with the reasoning. Try the materiality calculator.
• Risk assessment (AU-C 315, as revised by SAS No. 145): understanding of the entity, its environment, the applicable financial reporting framework and its system of internal control, and the assessed risks of material misstatement at the financial statement and assertion levels.
• Fraud risk discussion (AU-C 240): the engagement team's discussion of how and where the financial statements could be susceptible to material misstatement due to fraud.

Lead schedules

A lead schedule summarizes one financial statement area, for example cash, receivables or revenue. It lists each general ledger account in that area with:

• prior-year audited balance
• current-year unadjusted balance
• proposed adjustments and reclassifications
• current-year final balance

Each line ties to the trial balance and cross-references to the supporting schedules beneath it. The lead schedule is where a reviewer starts.

Supporting schedules and testwork

These are the detailed papers that hold the evidence.

• Substantive tests of details: vouching, tracing, recalculation and inspection of individual items, such as a revenue cutoff test or a search for unrecorded liabilities.
• Substantive analytical procedures (AU-C 520): expectation, threshold, comparison and investigation of differences.
• Tests of controls (AU-C 330): only if the audit strategy relies on controls; shows the control tested, the sample, the results and the conclusion on operating effectiveness.
• Sampling papers (AU-C 530): population, sampling unit, sample size and how it was determined, selection method, results and projected misstatement.
• Confirmations (AU-C 505): control log of requests sent and received, alternative procedures for non-responses, and investigation of exceptions.
• Reconciliations: bank reconciliations, subledger-to-GL reconciliations and intercompany reconciliations, with the auditor's testing of reconciling items.

Accounting estimates and judgment areas

Estimates such as the allowance for credit losses, inventory reserves, impairment and fair value measurements need their own papers under AU-C 540: the method, the data, the significant assumptions, how management's point estimate was tested and any auditor's range.

Summary and completion papers

• Summary of misstatements (AU-C 450): every misstatement above the clearly trivial threshold, whether corrected or not, with the evaluation of uncorrected misstatements against materiality.
• Adjusting journal entries: proposed and recorded adjustments with management's approval.
• Subsequent events review (AU-C 560): procedures between the balance sheet date and the report date.
• Going concern evaluation (AU-C 570).
• Communications with those charged with governance (AU-C 260) and of internal control matters (AU-C 265).
• Management representation letter (AU-C 580).
• Completion checklist and disclosure checklist: evidence that required steps and disclosures were addressed.
• Review notes: raised, answered and cleared on or before the date of the auditor's report.

What should every audit working paper include?

A well-prepared workpaper answers four questions without help from the preparer: what was the objective, what was done, what was found and what was concluded.

Include on each paper:

1. Header: client name, period end, workpaper title and index reference.
2. Source: prepared by client (PBC) or by the audit team, and the document or system it came from.
3. Objective: the assertion or risk the procedure addresses, for example "existence of accounts receivable at 12/31".
4. Procedures performed: specific enough to re-perform.
5. Items tested: identifying characteristics such as invoice numbers, dates and amounts, and how the sample was selected (AU-C 230 requires recording the identifying characteristics of the items tested).
6. Tick mark legend: what each symbol means.
7. Results and exceptions: what was found, including how each exception was resolved.
8. Conclusion: a clear statement on the objective.
9. Sign-offs: preparer and date, reviewer and date (AU-C 230 requires recording who performed and who reviewed the work, and when).
10. Cross-references: to the lead schedule, the trial balance and related papers.

How do you prepare an audit working paper step by step?

1. Start from the risk. Pull the assessed risk and planned response from the risk assessment so the paper's objective matches it.
2. Get the population. Obtain the listing or report and tie its total to the trial balance before selecting anything.
3. Set the sample. Determine sample size and selection method and document why.
4. Perform and annotate. Do the procedure and mark each item with tick marks as you go; do not reconstruct afterward.
5. Follow up exceptions. Investigate every difference, quantify it, and decide whether it is a misstatement or a control deviation.
6. Conclude. Write the conclusion against the objective and post any misstatement to the summary of misstatements.
7. Cross-reference and sign off. Reference to the lead schedule and related papers, then initial and date.
8. Clear review notes. Respond to every reviewer comment in the file, not by email.

Indexing and cross-referencing

Firms use one of two indexing schemes:

• Letter-based: A for cash, B for receivables, C for inventory, and so on, with A-1, A-2 for supporting papers.
• Number-based: 100s for planning, 200s for internal control, 300s for current assets, and so on.

Pick one and use it for every engagement. Cross-references should work in both directions: from the lead schedule down to the support and from the support back up.

Audit tick marks

Tick marks are short symbols that show what was done to an item, for example:

Symbols vary by firm. What matters is that every workpaper has a legend and that each mark describes a procedure actually performed.

Common working paper mistakes

• Samples that cannot be re-performed because the items tested are not identified.
• No link from risk to procedure, so a significant risk has no tailored response in the file.
• Missing conclusions, leaving the reader to guess what the test showed.
• Unresolved exceptions: a difference noted but never investigated or posted to the summary of misstatements.
• PBC schedules used without testing their completeness and accuracy.
• Review evidence missing or dated after the date of the auditor's report (AU-C 220 expects the engagement partner's review on or before that date).
• Changes after the documentation completion date with no record of why, when and by whom.

How long do you keep audit working papers?

Under AU-C 230 the documentation completion date is no later than 60 days after the report release date, and the retention period for audit engagements is ordinarily no shorter than five years from the report release date. Some states, regulators and firm policies require longer. Issuer audits are governed by PCAOB AS 1215, which sets its own assembly period and a seven-year retention period. See AU-C 230 explained for the full rules.

Who owns audit working papers?

Working papers belong to the auditor, not the client. State laws and the AICPA Code of Professional Conduct govern confidentiality and when a CPA may share them, for example with a successor auditor or a regulator.

Related

• AU-C 230 audit documentation explained
• Materiality calculator (AU-C 320)

Sources

• AICPA, AU-C Section 230, Audit Documentation
• AICPA, AU-C Section 220, Quality Management for an Engagement Conducted in Accordance With GAAS
• AICPA, AU-C Sections 210, 240, 260, 265, 300, 315, 320, 330, 450, 505, 520, 530, 540, 560, 570 and 580
• AICPA Code of Professional Conduct, Confidential Client Information Rule (ET 1.700.001) and Records Requests (ET 1.400.200)
• PCAOB, AS 1215, Audit Documentation: https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error