Audit documentation, file assembly and retention (AU-C 230)

• Apply the experienced auditor standard in AU-C 230.08.
• Record the required identifying details for procedures performed.
• Compute the documentation completion date and minimum retention date.
• Handle changes to documentation after the report release date.

The standard: an experienced auditor can follow it

AU-C 230.08 requires documentation sufficient to enable an experienced auditor, with no previous connection to the audit, to understand:

• the nature, timing and extent of procedures performed to comply with GAAS and legal and regulatory requirements;
• the results of procedures and the evidence obtained; and
• significant findings or issues, the conclusions reached, and significant professional judgments made.

AU-C 230.07 requires you to prepare documentation on a timely basis. Documentation written after the report date, from memory, is weaker evidence of what was done.

What each workpaper records

AU-C 230.09 requires that documentation of the nature, timing and extent of procedures records:

• (a) the identifying characteristics of the specific items tested, such as invoice numbers, check numbers, dates or selection criteria;
• (b) who performed the work and the date completed; and
• (c) who reviewed the work and the date and extent of the review.

"Tested 25 invoices, no exceptions" fails (a). A reviewer must be able to pull the same 25 invoices.

Other specific requirements:

• AU-C 230.10: abstracts or copies of significant contracts or agreements inspected.
• AU-C 230.11: discussions of significant findings or issues with management, those charged with governance and others, including when and with whom.
• AU-C 230.12: how you addressed information inconsistent with your final conclusion on a significant matter.
• AU-C 230.13: justification for any departure from a presumptively mandatory requirement and how alternative procedures achieved its intent.

Every other AU-C section has its own documentation paragraph. Our guide to documenting procedures collects them.

Assembly: the 60-day window

AU-C 230.15 requires you to document the report release date. AU-C 230.16 requires you to assemble the final audit file on a timely basis, no later than 60 days following the report release date. The date you finish is the documentation completion date. During assembly you can delete superseded drafts, sort and cross-reference, sign off completion checklists and add evidence obtained before the report date. You cannot perform new procedures or draw new conclusions as an assembly task.

Note the anchor: the report release date, the date you grant the entity permission to use the report, not the report date.

Retention and changes after completion

AU-C 230.17 prohibits deleting or discarding documentation after the documentation completion date before the end of the retention period, which should not be shorter than five years from the report release date. State boards, regulators, Yellow Book requirements or contracts may require longer; the record retention guide lists common ones.

If you need to modify or add documentation after the completion date (AU-C 230.18), document the specific reasons, when and by whom the changes were made and reviewed. If you perform new procedures or draw new conclusions after the report date (AU-C 230.14), document the circumstances, the procedures, evidence and conclusions, and who made and reviewed the changes.

AU-C 230.19 requires reasonable procedures to maintain the confidentiality of client information.

Common findings

• No identifying characteristics for items tested.
• Reviewer sign-offs with no date, or dated after the report.
• Assembly after 60 days, or no documented completion date.
• Files altered after completion with no record of who, when and why.
• Key judgments discussed in emails that never made it into the file.

Computing assembly and retention dates