Documentation Completion Date and Post-Release File Changes: What You May Add, What You May Not Touch

The audit file has a clock. The report is released, and a window opens in which the firm assembles the final file. When the window ends, the file is locked. Anything that happens afterward is an addition with a record, never a revision of what was there. This post sets out the rules for each phase and the procedure for the awkward cases. The general standard is in AU-C 230, and retention periods are in audit record retention.

The window

For a GAAS audit of a nonissuer, the auditor assembles the audit documentation in an audit file and completes the administrative process of assembling the final file on a timely basis after the date of the auditor's report. The date by which the firm completes assembly is the documentation completion date, and it is no later than 60 days after the report release date. A statute, regulation or firm policy can require a shorter window.

The firm should set an internal target well inside 60 days. A 30-day target leaves a buffer for the final exceptions.

What is assembly

Assembly is administrative. Before the completion date, the firm can:

• Delete or discard superseded documentation.
• Sort, collate and cross-reference working papers.
• Sign off on completion checklists.
• Document that audit evidence was obtained, discussed and reviewed with the engagement team before the date of the auditor's report.
• File items that existed before the report date but were misfiled or left out, showing the date they were filed.

Assembly is not performing new audit procedures. It is not a license to fill gaps in the audit with new work and date it before the report. If a procedure was not performed before the report date, assembly does not cure that.

What happens after the completion date

After the documentation completion date, the firm may not delete or discard audit documentation before the end of the retention period, which for a nonissuer audit is not shorter than five years from the report release date. The firm may add. Circumstances that call for additions include:

• Exceptional circumstances after the report release, such as learning of facts that existed at the report date and might have caused the statements to be revised or the opinion modified, or concluding that a necessary procedure was omitted from the audit. See subsequently discovered facts.
• Comments from a peer review or other inspection that call for clarifying existing documentation.
• A clerical correction, such as a missing initial, made as a dated addition rather than an overwrite.

For an exceptional circumstance, the file records:

1. The circumstances encountered.
2. The new or additional procedures performed, the evidence obtained and the conclusions reached, and their effect on the auditor's report.
3. When and by whom the changes to the documentation were made and reviewed.

For any other change, the file records the specific reasons for the change and when and by whom it was made and reviewed.

The addition is dated when it was made, not backdated. The original workpaper is left as it was, and the new material is added with a cross-reference.

Why backdating is the one thing that cannot happen

A workpaper signed with a date before the report that was actually completed afterward misrepresents when the work was done. In a peer review or an enforcement matter, the file's metadata, the document history and the email trail show the actual dates. The cost is far higher than the cost of a late workpaper honestly dated. The rule is: if the work was done after the report date, it carries the date it was done, with an explanation.

Example of a legitimate addition

A firm releases its report on April 15. On May 10, during assembly, the senior discovers that the second page of a confirmation reply was never filed. The page arrived with the original email on February 12, and the confirmation conclusion in the workpaper already relied on it.

• The page is added to the file with a note: "Page 2 of confirmation reply, received February 12, filed May 10 during assembly. No change to conclusion."
• It is within the 60-day window, so it is assembly. A reviewer initials the note.

A different case: on June 20, after the completion date of June 14, the firm learns of a lawsuit filed in March that was not in the legal letter. The firm:

• Follows the subsequently discovered facts process.
• Documents in a memo dated June 20 the fact, the discussions, the procedures and the conclusion.
• Does not touch the existing legal letter workpaper. The memo is added with a cross-reference.

Issuer audits are different

For audits of SEC issuers, the standards of the PCAOB and the SEC rules govern. SEC Rule 2-06 of Regulation S-X (17 CFR 210.2-06) requires an accountant who audits or reviews the financial statements of an issuer to retain, for seven years after the accountant concludes the audit or review, the records relevant to it. The records covered include workpapers and other documents that form the basis of the audit, and memoranda, correspondence, communications and electronic records that are created, sent or received in connection with the audit and contain conclusions, opinions, analyses or financial data related to it. The rule also requires retention of records that contain information inconsistent with the auditor's final conclusions on significant matters, and of consultations and resolutions of differences in professional judgment.

PCAOB AS 1215 sets its own assembly deadline, separate from the AICPA 60 days. The PCAOB's amendments, adopted with AS 1000 and approved by the SEC on August 20, 2024, move the date by which the auditor assembles a complete and final set of audit documentation for retention from 45 days to 14 days after the report release date (AS 1215.15). The 14-day requirement applies to audits for fiscal years beginning on or after December 15, 2024 for firms that issued audit reports for more than 100 issuers in calendar 2024, and on or after December 15, 2025 for all other registered firms. The PCAOB's September 2025 postponement to December 15, 2026 covers the QC 1000 package, including conforming amendments to AS 1215 adopted alongside QC 1000. The postponement notice does not list AS 1000 or the 14-day requirement, which come from the separate AS 1000 package. Confirm the applicable date for any given audit. If the firm audits both issuers and nonissuers, the firm's policy needs two clocks, and staff must know which applies.

Setting up the firm's process

These controls support the firm's quality management responsibilities for documentation and retention. See SQMS 1 quality management guide.

Outsourced and offshore preparation

If part of the file is prepared by a team outside the firm, the firm still owns the file and the deadline. The assembly instructions, the lock and the addition rules apply to the outsourced team's output as well. Make the delivery deadline in the engagement with the provider earlier than the firm's own completion target. See documenting outsourced workpaper review.

Checklist

• Report release date recorded.
• Completion date calculated, with a firm target.
• Assembly steps done and signed.
• File locked on the completion date.
• Post-lock changes documented with reason, date, person and effect on conclusions.
• No deletion during retention.
• No backdating.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 230, Audit Documentation (assembly of the final audit file and changes to documentation after the documentation completion date)
• U.S. Securities and Exchange Commission, 17 CFR 210.2-06, Retention of audit and review records: ecfr.gov
• SEC and PCAOB, notice of filing of AS 1000 and related amendments, including the 14-day documentation completion date and its phased effective dates: Federal Register, June 11, 2024; SEC Release No. 34-100773 (August 20, 2024) approving AS 1000: sec.gov
• SEC, Release No. 34-103803 (September 3, 2025 notice), postponement of QC 1000 and related amendments: Federal Register
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error