AU-C section 230, Audit Documentation, sets the rules for the audit file in a GAAS audit of a nonissuer (a private company, not-for-profit or governmental entity). It came out of SAS No. 103 and was redrafted into the clarified AU-C format by SAS No. 122.
This page paraphrases the standard and points to the relevant requirement. The authoritative text is AU-C 230 in AICPA Professional Standards.
What is the objective of AU-C 230?
The auditor's objective is to prepare documentation that gives a sufficient, appropriate record of the basis for the auditor's report, and evidence that the audit was planned and performed in line with GAAS and any applicable legal and regulatory requirements.
Two things follow from that. The file has to support the opinion that was signed, and it has to show that the work required by the standards was actually done.
The experienced auditor test
The core requirement: documentation must let an experienced auditor with no previous connection to the audit understand:
- the nature, timing and extent of the procedures performed
- the results of those procedures and the audit evidence obtained
- the significant findings or issues that arose, the conclusions reached, and the significant professional judgments made in reaching them
"Experienced auditor" means someone with practical audit experience and a reasonable understanding of audit processes, GAAS, the business environment the entity operates in, and the auditing and financial reporting issues relevant to its industry. A workpaper that an experienced reviewer cannot follow without asking the preparer does not meet the test.
What every workpaper must record
When documenting the nature, timing and extent of procedures, AU-C 230 requires the auditor to record:
| Element | What it means in practice |
|---|---|
| Identifying characteristics of items tested | Invoice numbers, check numbers, dates, sample selection basis, so the test can be re-performed |
| Who performed the work and when | Preparer initials and date completed on each workpaper |
| Who reviewed the work, when, and the extent of review | Reviewer sign-off and date; review notes cleared |
The standard also requires documenting discussions of significant findings or issues with management, those charged with governance and others, including what was discussed, when, and with whom.
Significant findings, inconsistencies and departures
Three situations need extra documentation:
- Significant findings or issues. Record the matter, the conclusion and the judgment behind it. Examples: risks of material misstatement and the response to them, results that indicate the financial statements could be materially misstated, circumstances that made it hard to apply necessary procedures, and findings that could lead to a modified opinion.
- Information inconsistent with a final conclusion. If the auditor finds information that contradicts the conclusion on a significant finding or issue, document how the inconsistency was addressed.
- Departures from a relevant requirement. In the rare case the auditor judges it necessary to depart from a relevant requirement, document the justification and how the alternative procedures achieved the aim of that requirement.
Form, content and extent
AU-C 230 does not prescribe a format. Size and complexity of the entity, the nature of procedures, the risks identified and the significance of the evidence all drive how much is needed. The application guidance makes a few points that matter in practice:
- Oral explanations from the auditor do not, on their own, support the work performed or the conclusions reached, but they can clarify information already in the file.
- Superseded drafts of workpapers or financial statements, notes reflecting incomplete or preliminary thinking, and duplicate documents do not need to be kept.
- Audits of smaller, less complex entities usually need less documentation, but the experienced auditor test still applies in full.
The 60-day assembly deadline
After the report release date (the date the auditor grants the entity permission to use the report), the auditor must assemble the final audit file on a timely basis, no later than 60 days after the report release date. That point is the documentation completion date.
Assembly is administrative work: sorting, cross-referencing, deleting superseded drafts, signing off completion checklists. It is not the time to perform new procedures or reach new conclusions.
Changes after the documentation completion date
After the documentation completion date, the auditor must not delete or discard audit documentation of any nature before the end of its retention period.
If documentation has to be added or changed after that date, record:
- the specific reasons for the change
- when it was made and by whom
- when and by whom it was reviewed
The same applies to matters that come up after the report date, such as subsequently discovered facts under AU-C 560: document the circumstances, the new or additional procedures performed, the evidence obtained, the conclusions reached and their effect on the report.
How long must audit documentation be kept?
AU-C 230 sets a retention period of no shorter than five years from the report release date. State boards of accountancy, regulators, grantor agencies and the firm's own policies can require a longer period.
AU-C 230 vs PCAOB AS 1215
Audits of issuers follow PCAOB AS 1215 instead. The two differ on deadlines:
| AU-C 230 (nonissuers) | PCAOB AS 1215 (issuers) | |
|---|---|---|
| Assembly deadline | 60 days after report release date | 45 days after report release date |
| Retention | At least 5 years from report release date | 7 years from report release date |
Documentation gaps to look for
These are practice checks, not requirements:
- Sample selections that cannot be re-performed because the items tested are not identified
- Risk assessment that does not link identified risks to the procedures that respond to them
- No evidence of review, or review sign-offs dated after the report date with no explanation
- Conclusions missing from workpapers, so the reader cannot tell what the test showed
- Files changed after the documentation completion date with no record of why, when or by whom
Quality management context
AU-C 230 sits alongside the firm's system of quality management. Under the AICPA's quality management standards, firms had to design and implement their systems under SQMS No. 1 (with SQMS No. 2 on engagement quality reviews) by December 15, 2025. SAS No. 146, on quality management for an engagement, is effective for audits of periods beginning on or after December 15, 2025. Firm policies on file access, retention, confidentiality and retrieval come from that system.
Related
Sources
- AICPA, AU-C Section 230, Audit Documentation (AICPA Professional Standards), as amended by SAS No. 146 (periods beginning on or after December 15, 2025)
- AICPA, AU-C Section 560, Subsequent Events and Subsequently Discovered Facts
- AICPA, SQMS No. 1 (firm systems designed and implemented by December 15, 2025) and SQMS No. 2
- PCAOB, AS 1215, Audit Documentation, https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
Part of CORAA University · Working papers and documentation: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error