Documenting Outsourced Workpaper Review: What AU-C 230 and SAS 146 Require the File to Show

A file prepared in part by someone outside the firm has to answer four questions on its face: who did the work, when they finished it, who in the firm reviewed it, and when. AU-C 230, Audit Documentation, requires those answers. SAS 146 adds the engagement partner's evidence of direction, supervision and review. Outsourcing changes who the preparer is. It does not change what the file must show.

The AU-C 230 requirement

AU-C 230.09 requires the auditor to document who performed the audit work and the date the work was completed (paragraph .09b), and who reviewed the audit work performed and the date and extent of the review (paragraph .09c). The CPA Journal (April 2019) summarizes it the same way.

AU-C 230 application paragraph .A15 limits the scope: the requirement to document who reviewed the work and the extent of the review does not imply that each specific working paper must carry evidence of review. It does mean documenting what audit work was reviewed, who reviewed it and when. Where one sign-off covers a group of workpapers, the documentation has to state clearly which workpapers it covers (CPA Journal).

Three rules follow for any file, outsourced or not.

1. Name the individual. A role or a vendor name does not identify who performed the work. Initials or a user ID that maps to a named person do.
2. Date completion. The date shows when the work was completed, which is distinct from the date the schedule was delivered.
3. Record review and its extent. The reviewer's sign-off and date answer who and when. The extent answers how far the review went: full re-performance, agreement of selected items to source, or reasonableness only.

What changes when the preparer is outside the firm

The SAS 146 definition of engagement team focuses on individuals who perform audit procedures on the engagement. A provider's preparer who performs audit procedures is therefore documented like any staff member, with the name in the preparer field. Add two items the firm's own staff do not need:

• The organization. Record the provider and the individual, so the file identifies the person and the entity.
• A roster. Keep a roster in the file mapping each initial set or user ID to a named individual, their organization and the periods they worked on the engagement.

The sign-off mechanism holds up only if the roster exists. A reviewer in five years reading the initials "RK" needs to find the person behind them.

Evidence of the partner's involvement

AU-C 220 as revised by SAS 146 makes the engagement partner responsible for the direction, supervision and review of the work of the engagement team, which includes work done by outside personnel who perform audit procedures. The file shows that responsibility through the partner's own sign-offs on the audit plan and on the review of significant matters, and through written direction to the provider.

There is a limit. AU-C 230 application paragraph .A9 states that it is neither necessary nor practicable to document every matter considered or judgment made, and that it is unnecessary to document separately, for example in a checklist, compliance with matters already demonstrated by documents in the file.

The outsourced-prep file checklist

For each engagement with outsourced preparation, the file contains:

The last row is firm-level evidence. Many firms keep it in the client acceptance file and cross-reference it from the engagement file.

Review notes

A review that finds nothing leaves no trace except the sign-off. A review that finds something leaves notes. Keep the notes, the preparer's response and the clearing sign-off. A cleared note shows the reviewer examined the specific schedule and that the preparer addressed the point.

Sign-off design that works for provider-prepared schedules

• Separate preparer and reviewer fields. Print them on the tick mark legend or the workpaper header, not in a free-text comment.
• One extent code set. Define codes such as full re-performance, selected items agreed to source and analytical review, and use them on every reviewed schedule. See audit tick marks.
• Group sign-offs with a list. If a senior signs off a folder, list the schedules covered in the sign-off. The file must state clearly which workpapers a group sign-off encompasses.
• Sign when done. Dates entered after the fact, or all on one day at report release, do not show when the review took place. Sign as each review completes.

Retention

Provider-prepared schedules become firm workpapers once they enter the file and follow the firm's retention policy. See audit record retention. The provider agreement states what the provider returns or destroys, so the firm's file is the record.

Related guidance

The documentation mechanics for every procedure are in how to document audit procedures and audit working papers. The partner's duties are in supervision and review of outsourced work under AU-C 220. How reviewers read the file is in peer review of firms that outsource audit prep.

Sources

• AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With GAAS (public PDF; AU-C 220 and conforming amendments to AU-C 230): https://a-us.storyblok.com/f/1015104/x/32853782b6/aicpa-sas-146.pdf
• Howard B. Levy, "The Truth about Workpaper Sign-offs," The CPA Journal (April 2019), on AU-C 230.09b-c and .A15 (preparer, reviewer, dates; group sign-offs): https://www.cpajournal.com/?p=8763

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error