A procedure that was performed but not documented is, for practical purposes, a procedure that was not performed. The documentation is what a reviewer, a peer reviewer or a successor auditor sees. AU-C 230 states the test: the file must let an experienced auditor with no previous connection to the engagement understand what was done, what was found and what was concluded.
This guide gives a repeatable structure for a single workpaper, shows the difference between a weak and a strong version of the same test, and lists what the standard requires beyond the narrative.
What does AU-C 230 require in a workpaper?
AU-C 230 requires the auditor to prepare documentation in time and in enough detail that an experienced auditor can understand:
- the nature, timing and extent of the procedures performed
- the results of the procedures and the audit evidence obtained
- the significant findings or issues that arose, the conclusions reached on them and the significant professional judgments made
When documenting the nature, timing and extent of procedures, the auditor records three things:
- the identifying characteristics of the specific items or matters tested
- who performed the work and the date it was completed
- who reviewed the work, the date of the review and the extent of the review
The standard also asks for documentation of discussions of significant findings with management and others, of information found that is inconsistent with a final conclusion and how that inconsistency was resolved, and of any departure from a relevant requirement. Application guidance adds that it is neither necessary nor practicable to document every matter considered, and that a separate checklist is unnecessary where the file itself shows compliance. An oral explanation on its own does not support the work.
The five-part workpaper
Most procedure workpapers can be written as five short blocks. The labels are a convention, not a requirement of the standard, but each block answers a question a reviewer will ask.
| Block | Question it answers | What to write |
|---|---|---|
| Purpose | Why was this done? | The account or class, the assertion, and the risk the procedure responds to. Reference the risk assessment or audit program step. |
| Source | Where did the population or data come from? | System, report name, date and parameters; how completeness and accuracy of the report were checked; the tie-out to the trial balance. |
| Procedure | What exactly was done? | The sample basis and size, the items tested, the attributes checked, and the evidence examined. Specific enough to re-perform. |
| Results | What was found? | Each item's outcome, exceptions with amounts, and how each exception was followed up. |
| Conclusion | What does it mean? | Whether the objective was met, the effect on the assertion, and any misstatement carried to the summary of uncorrected misstatements. |
Add the preparer's initials and date, the reviewer's initials and date, the index reference and the tick mark legend. The guide to audit tick marks covers the legend in detail, and the audit working papers guide covers indexing and cross-referencing.
Purpose: tie the work to a risk and an assertion
A purpose block that says "test revenue" does not help a reviewer. State the assertion and the risk: "Occurrence of revenue recognized in December; response to the presumed fraud risk in revenue recognition and to the cutoff risk at the year end." The reviewer can then judge whether the procedure fits the risk. The audit assertions guide lists the assertions, and the audit risk assessment worksheet shows where the link is recorded.
Source: record where the data came from
Data produced by the entity needs a short note on how its completeness and accuracy were addressed. If the sample was drawn from an accounts receivable aging, say which report, as of what date, and that the total agrees to the general ledger balance. See information produced by the entity and the IPE testing worksheet.
Procedure: make it re-performable
Identify the sample so someone else can find the items again: invoice numbers, check numbers, dates and amounts. State how the items were selected. If every item over a dollar threshold was examined and the rest sampled, say so and give the threshold. State what evidence was examined for each attribute. Sampling approaches are covered in the audit sampling methods guide.
Results and conclusion: do not leave the reader to infer
Write the result in words as well as marks. "No exceptions noted in 25 items" is a result. A column of check marks is only a record of work. Then write the conclusion plainly: "The sales recorded in the last 5 days of December were shipped before year end. No cutoff misstatement." If exceptions were found, quantify them, state whether they are isolated or indicate a pattern, and say what was done about it.
Worked example (illustrative): same test, weak and strong
A staff auditor tests December sales cutoff for a distributor.
Weak version
Reviewed sales near year end. Tested several items. All good. See tick marks.
The reviewer cannot tell which sales, how many, what evidence, or what the risk was.
Strong version
Purpose: Test cutoff of revenue (assertion: cutoff, occurrence). Responds to risk R-4 (revenue recognized before delivery) in the risk assessment, W/P B-2.
Source: Sales journal for December 22 to January 8, run from the client's ERP on January 29, 2027. Total December sales on the report of $4,812,300 agrees to the trial balance (tick F/TB).
Procedure: Selected the 15 largest December invoices dated December 22 to 31 and the 10 largest January invoices dated January 2 to 8 (25 items). For each, agreed the invoice to the bill of lading date and the customer's signed delivery receipt.
Results: 24 of 25 items agreed. Invoice 40871, $38,400, dated December 30, shipped January 3 per the bill of lading. This is a cutoff error that overstates December revenue and receivables by $38,400. Extending to the remaining December 28 to 31 invoices over $5,000 (7 more items) found no further errors.
Conclusion: Revenue was overstated by a known misstatement of $38,400 (gross margin effect to be computed on W/P B-5). Carried to the summary of uncorrected misstatements. Management was asked to record the entry; see W/P A-9.
Prepared: AB 1/30/2027. Reviewed: CD 2/3/2027.
All figures and references are illustrative. The strong version takes six short paragraphs and answers every question the weak version leaves open.
Mistakes reviewers flag
- No identifying characteristics for items tested, so the test cannot be re-performed.
- Preparer or reviewer sign-off missing, or dated after the report with no explanation.
- A conclusion that restates the procedure instead of saying whether the objective was met.
- Exceptions noted in the body but not carried to the summary of misstatements.
- Procedures documented in the audit program but no evidence of the work in the file.
- Evidence of review missing for significant judgment areas such as estimates and going concern.
A reviewer who has to ask what a mark means or why a sample was chosen will write a review note. The audit review notes log is where those notes are tracked and cleared.
A short checklist before sign-off
- Does the purpose name the assertion and risk?
- Is the source of the data stated and agreed to the trial balance?
- Could another auditor find the same items and repeat the test?
- Is every exception quantified and followed up?
- Does the conclusion say whether the objective was met?
- Are the preparer, reviewer and dates complete?
Frequently asked questions
What is the minimum documentation for an audit procedure?
Enough for an experienced auditor with no prior connection to the audit to understand the nature, timing and extent of the work, the results and the conclusion, including identifying characteristics of items tested and who performed and reviewed the work with dates.
Do I need a checklist to prove I complied with a standard?
No. AU-C 230 application guidance says it is unnecessary to document compliance separately where the file already demonstrates it, for example a signed engagement letter or a documented audit plan.
Is a tick mark enough documentation?
A tick mark records that a step was done. It needs a legend that describes the step and the workpaper still needs the purpose, source, results and conclusion.
Can I rely on notes of a conversation with the client?
Oral explanations alone do not support the work, but a written record of an inquiry, with who said what and when, can be part of the evidence alongside other corroborating evidence.
Sources
- AICPA, AU-C Section 230, Audit Documentation, paragraphs .08 to .12 and application material
- AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With GAAS (conforming amendments to AU-C 230)
- AICPA, AU-C Section 500, Audit Evidence, on information produced by the entity
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Working papers and documentation: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error