Definition
AU-C 230 describes the standard: documentation must let an experienced auditor with no previous link to the engagement understand the nature, timing and extent of procedures, the results and evidence obtained, and significant findings and the judgments made about them. It must also show who performed the work and when, and who reviewed it and when.
Why it matters in an audit or review
Documentation is the main evidence that the audit was done in accordance with GAAS. It supports the report, helps reviewers, and is what a peer reviewer or a regulator examines. When something was done but is not documented, it is hard to prove. Oral explanations alone do not substitute for the file, although they can clarify what is already there.
Example
A significant judgment about the allowance for doubtful accounts needs more than "reviewed, OK." The file records the method used, the inputs and their source, the comparison with prior-year write-offs, the discussion with the controller on January 12 (illustrative) and the reason the estimate of $210,000 was judged reasonable.
Common mistakes
- Documenting the procedure but not the evidence or the conclusion.
- Leaving out significant matters discussed with management or those charged with governance.
- Recording differing views among team members without how they were resolved.
FAQ
How long must documentation be kept?
AU-C 230 sets a minimum of five years from the report release date. Firm policy and state rules can be longer.
Sources
- AICPA, AU-C Section 230, Audit Documentation
- AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error