Definition
Records retention covers how long a firm keeps its engagement files. AU-C 230 requires the final audit file to be assembled within 60 days after the report release date, the date the auditor gives the entity permission to use the report, and retained for no less than five years from that date. For audits of issuers, PCAOB Auditing Standard 1215 sets seven years from the report release date. For tax, section 6107(b) requires a return preparer to keep a copy of each return or a list of taxpayers for three years after the close of the return period. State boards, regulators, grant agreements and firm policy can require longer.
Why it matters in an audit or review
Peer reviewers and regulators ask for files years after the report. Missing documentation can mean the work is treated as not performed. Litigation or an investigation may also require suspending routine disposal.
Example
Illustrative: a nonissuer report release date is March 15, 2027. The file must be assembled by May 14, 2027, which is 60 days later, and kept at least through March 15, 2032. A state requirement of seven years would extend that to March 15, 2034.
Common mistakes
- Counting retention from the report date instead of the release date.
- Destroying files while a dispute or inquiry is pending.
Sources
- AICPA, AU-C section 230, Audit Documentation
- PCAOB, AS 1215, Audit Documentation: https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
- Internal Revenue Code section 6107(b): https://www.law.cornell.edu/uscode/text/26/6107
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error