Audit documentation: ISA 230

If it is not written down, the auditor cannot prove it was done. Audit documentation is the record of the work, the evidence and the conclusions. It is what the firm’s reviewers, the regulator and, in a dispute, a court will look at.

This topic covers what International Standard on Auditing (ISA) 230 requires, why documentation matters, what goes into an audit file, how the file is closed and who owns it.

No written question in the two diets tests this topic on its own. It still matters, because documentation appears inside partner duties, quality management and the use of technology, and it is an easy topic in which to score marks. Learn the experienced auditor test, the layout of a working paper and the rules after the report date.

What audit documentation is

All audit work must be documented and held in the audit file, also called the audit working papers. The documentation records:

• the audit procedures performed;
• the audit evidence obtained; and
• the conclusions reached.

It must provide a sufficient and appropriate record of the basis for the audit report. Evidence that the audit was planned and performed in line with the ISAs and with applicable legal and regulatory requirements.

What ISA 230 requires

The auditor must prepare documentation on a timely basis. It must be enough for an experienced auditor with no previous connection with the audit to understand:

1. the nature, timing and extent of the audit procedures performed;
2. the results of those procedures and the audit evidence obtained; and
3. the significant matters that arose during the audit and the conclusions reached on them.

The auditor must also document:

• discussions of all significant matters;
• how any inconsistencies with the final conclusion on significant matters were resolved; and
• the justification for any departure from a basic principle or relevant procedure in an ISA.

Background: ISA 230 also requires the auditor to record the identifying characteristics of the specific items tested, such as the invoice number or date, who performed the work and when, and who reviewed it and when. This is what lets a later reviewer re-select the same items.

Why documentation matters

Timely, sufficient and appropriate documentation improves the quality of the audit and makes it possible to review and evaluate the evidence and conclusions before the report is finalised. Documentation prepared as the work is done is likely to be more accurate than documentation written later.

Other purposes are to:

• help the team plan and perform the audit;
• help supervisors direct and supervise the work;
• make members of the team accountable for their work;
• keep a record of matters of continuing significance for future audits; and
• let an experienced auditor with no link to the audit carry out quality control reviews or inspections by understanding the work and the conclusions.

Form, content and extent

Documentation may be on paper, or on electronic or other media. For each engagement it is assembled in an audit file. The contents vary with the size of the client and the complexity of the audit, but include:

• audit programmes;
• analyses;
• summaries of significant matters;
• letters of confirmation and representation;
• checklists; and
• correspondence.

The permanent file and the current file

What each working paper should show

Where relevant, and for each audit area, a working paper should show:

1. the name of the client;
2. the accounting date;
3. a file reference;
4. the name of the person who prepared it;
5. the date it was prepared;
6. the name of any reviewer and the extent of the review;
7. the date of the review;
8. a key to the audit ticks or symbols used;
9. a list of any errors or omissions found; and
10. the auditor’s conclusion on the area.

Assembling and changing the file

ISA 230 requires the auditor to assemble the final audit file on a timely basis after the date of the audit report, ordinarily not more than 60 days. This usually leaves out drafts of working papers or financial statements and notes that reflect incomplete or preliminary thinking. Once the file is assembled, the auditor must not delete or discard documentation before the end of its retention period.

If it becomes necessary to modify existing documentation or add new documentation after assembly, the auditor must record:

• when and by whom the changes were made; and
• the reasons for them.

If exceptional circumstances arise after the date of the report, so that the auditor has to perform new or additional procedures or reaches new conclusions, the auditor must document:

• the circumstances;
• the new or additional procedures performed, evidence obtained and conclusions reached, and their effect on the report; and
• when and by whom the resulting changes to the documentation were made and who reviewed them.

Computer-generated working papers

Auditors often use software on laptops to prepare working papers. It can help prepare analysis schedules, particularly where the firm uses standard working papers, lead schedules and draft financial statements. These can usually be cross-referenced and updated automatically as adjustments are made.

The advantages are:

• papers are neat, easy to read and in a standard format;
• there is a lower risk of error when processing adjustments; and
• managers and partners can review remotely without visiting the client.

Automatic processing of adjustments can save significant time and cost.

Background: The May 2026 model solution on tools and techniques adds electronic working paper systems, which store evidence, track the progress of the audit, make supervision and review easier and improve quality. Access controls and back-up apply, because client data is confidential.

Ownership, custody, confidentiality and retention

• Ownership. The audit firm owns the working papers. They are not part of the client’s accounting records and do not belong to the client.
• Retention. The syllabus says ISQM 1 requires a minimum of five years from the date of the audit report, or the group audit report if later and relevant. In Nigeria, Regulation 13(2)(b) of the Financial Reporting Council of Nigeria (FRC) Audit Regulations 2020 requires working papers that support the conclusions in an audit report to be kept for at least six years, so a Nigerian firm applies the longer period. Regulation 10(4)(c) also requires the audit file to be closed within 60 days of signing the report.
• Custody and confidentiality. Working papers must be kept safe and their contents confidential. Confidential information may be given to third parties only as the ethical rules allow.

The five-year figure is the ISQM 1 minimum quoted in the syllabus. The gazetted FRC Audit Regulations 2020 set a longer minimum of six years for Nigerian auditors. In an exam, give the syllabus figure and add the Nigerian rule if the question is about Nigeria.

The rules in more depth

Why the experienced auditor test is used

The test is designed to make the file stand on its own. A reviewer, an inspector or a court cannot ask the team what it meant. If a stranger with audit experience can follow what was done, found and concluded, the file is enough. If it only makes sense to the people who did the work, it fails.

Why timing matters

Work written up weeks later is shaped by memory and by what the auditor now knows. Records made at the time are more accurate. They also let the reviewer check the evidence before the report is signed, when problems can still be fixed.

Why the file is closed

A closed file cannot be tidied up to hide weaknesses. Once the 60 days have passed, any addition must show when, by whom and why. This protects the integrity of the record in a later inspection or claim.

Why drafts are left out

Drafts and notes of incomplete thinking are not the final record of the basis for the opinion. Keeping them out of the final file keeps it focused on evidence and conclusions. This does not allow the auditor to destroy documents that show a significant matter or a changed view that mattered to the opinion.

Why the firm owns the papers

The papers are the firm’s evidence of its own work. If they belonged to the client, the firm could not rely on them to defend itself. The auditor may give the client extracts, at its discretion, but the papers remain confidential and in the firm’s custody.

Worked example: reviewing a working paper

1. Missing identifiers. The client name and year end may be on the file cover, but there is no file reference, no preparer and date, and no reviewer and date.
2. No key. The green tick has no explanation, so nobody can tell what procedure it stands for.
3. No link to evidence. The paper does not say how items were selected, which items were confirmed or what replies were received. An experienced auditor could not tell the nature, timing or extent of the work.
4. No errors listed, no conclusion. “OK” is not a conclusion on the area. The paper should say what was concluded and why.
5. Changes after assembly. A page added three months after the report, and a schedule removed, must be handled under ISA 230. Adding the page requires recording when, by whom and why it was added. Deleting documents after the file is assembled is not allowed before the end of retention. If the dispute is new information that changes the conclusions, the circumstances, new procedures and the effect on the report must be documented and reviewed.

Conclusion. Rework the paper so that a stranger could follow it, and record the later changes properly. Restore anything wrongly removed.

How to score full marks

• Start with the purpose: a record of procedures, evidence and conclusions.
• Quote the experienced auditor test and its three parts.
• For “what should a working paper show”, give the ten items in order and keep each to a few words.
• For the permanent and current file, give the purpose of each with two examples.
• For after the report date, give the 60 days, the ban on deletion and the three things to record when changes are made.
• For electronic papers, give advantages and add the point about access and back-up.
• Time. Spend time in proportion to marks.

Common mistakes in the exam

• Saying the working papers belong to the client.
• Giving the 60 days as the time to finish the audit and not the time to assemble the file.
• Leaving out the experienced auditor test.
• Mixing up the permanent file and the current file.
• Forgetting the date and the initials of the preparer and the reviewer.
• Saying that documents may be deleted once the report is signed.
• Forgetting that confidentiality applies to electronic papers.

Quick revision

• Records procedures, evidence and conclusions. Basis for the report. Shows compliance with ISAs and law.
• Test: an experienced auditor with no previous connection can understand nature, timing, extent, results, significant matters and conclusions.
• Also document: significant discussions, resolved inconsistencies, departures from ISAs.
• Permanent file: constitution, legal documents, history, systems, prior statements. Current file: statements, adjustments, planning, control material, area files, lead schedules.
• Assemble the file ordinarily within 60 days. No deletion during retention. Record when, by whom and why for changes.
• The firm owns the papers. Retention at least five years under ISQM 1, six under the Nigerian Audit Regulations. Keep them safe and confidential.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.