Common First-Year Auditor Mistakes and How to Avoid Them

Documentation mistakes: why your working papers get sent back

The single most common review comment on first-year working papers is some version of "conclusion not supported by the work performed." You selected a sample, tested it, found no exceptions, and wrote "no issues noted." The reviewer sent it back because "no issues noted" is not a conclusion. It's a status update.

A working paper conclusion under ISA 230.8 must state what you tested, what assertion the test addressed, what result you obtained, and what that result means for the account balance or disclosure. "No issues noted" covers point three and nothing else. A complete conclusion reads more like: "Tested a sample of 25 sales invoices for occurrence and accuracy (ISA 315.A190). All 25 agreed to delivery documentation and matched the recorded amount within a €50 tolerance. No misstatements identified. Revenue occurrence and accuracy are supported for the population tested."

That takes 40 seconds longer to write. It eliminates the review comment entirely.

The second documentation error is the missing link between the risk assessment and the test. ISA 330.6 requires your audit procedures to respond to assessed risks at the assertion level. If the risk assessment identifies a significant risk of revenue overstatement due to manual journal entries near period-end, your revenue testing needs to address that specific risk. A first-year who tests a standard sample of sales invoices for the year (without focusing on the period-end population where the risk was identified) has performed a procedure, but not a response to the assessed risk. The test doesn't connect to the plan.

A third pattern: copy-pasting prior year working papers without updating the details. Last year's working paper said the client had 14 bank accounts. This year they have 16. If your confirmation letter went to 14 banks because you copied last year's list, you've missed two accounts. Always reconcile prior year details against the current year client-provided information before you rely on any carried-forward working paper. ISA 230.A8 is explicit that audit documentation must reflect the work actually performed in the current period.

Testing mistakes: following the programme is not the same as auditing

Your audit programme says: "Select a sample of 25 purchase invoices and agree to supporting documentation." You select 25 invoices, match them to purchase orders and goods received notes, tick the boxes, and move on. You've followed the programme. You may not have audited anything.

The question the programme can't ask for you is: what am I looking for? If the assertion is occurrence (did this transaction actually happen?), matching an invoice to a purchase order proves nothing if the purchase order was generated by the same person who processed the invoice. You need to see evidence that goods or services were actually received by someone independent of the purchasing function. A goods received note signed by warehouse staff, a delivery confirmation from the carrier, a service completion report signed by the end user.

First-year auditors treat the audit programme as a checklist. It's not. It's a set of instructions that assume you understand the underlying assertion and will apply judgment about what constitutes sufficient appropriate evidence under ISA 500. The programme tells you what to do. You decide whether the evidence you found actually answers the question.

A related error: stopping at the first piece of evidence. Your programme says "agree to supporting documentation." You find one document that matches and move on. But ISA 500.6 requires evidence that is both sufficient (enough of it) and appropriate (relevant and reliable). One matching document might satisfy the relevance criterion, but if the document is internally generated with no external corroboration, the reliability is weak. For high-risk areas or significant transactions, one document is rarely enough.

The fix is straightforward. Before you test each item in your sample, ask yourself two questions: what am I trying to prove, and what would convince a sceptical reviewer that I proved it? If the answer is "one internally generated document," you probably need more.

Client communication mistakes that are easy to prevent

First-year auditors send their first PBC (prepared by client) request list and learn something nobody warned them about: clients don't read the list the way you wrote it. You asked for "the bank reconciliation as at 31 December." The client sent you the bank reconciliation as at 30 November because that's what they had ready. You asked for "a list of related parties." The client sent you a list of subsidiaries, which is not the same thing.

The problem is ambiguity, and the fix is specificity. Instead of "bank reconciliation as at 31 December," write "the reconciliation between each bank account (per the bank statement balance) and the corresponding general ledger balance as at 31 December 2025, including a list of all reconciling items." Longer, yes. But the client sends the right document the first time, which saves both of you a follow-up.

Never email a client contact directly on your first engagement without checking with your senior first. This rule feels excessive until you send a question that contradicts something the manager already discussed with the CFO, or you request a document the client already provided to a different team member last week. The senior has context you don't. Use it.

A subtler mistake: asking the client to explain something you could have figured out from the file. If the trial balance shows a €180,000 entry in "Other operating expenses" and you email the client asking what it is, you've revealed that you didn't read the nominal ledger detail (which was already in the PBC folder) before asking. Clients notice. They form opinions about your firm's efficiency based on the quality of your questions. Read what you've been given before you ask for more.

The one exception: if you genuinely don't understand a transaction after reviewing the available documentation, ask. Asking a good question after doing your homework is a sign of diligence. Asking a lazy question before checking your own files is a sign of something else.

Time management when everything takes longer than you expect

Your senior told you the bank and cash section should take six hours. You're at hour nine and you haven't started the conclusion. This is normal for a first-year. It does not mean you're slow. It means you don't yet know where the time goes, and you haven't built the pattern recognition that lets experienced auditors work faster.

Track your time by task, not by section. Don't log "Bank and cash: 9 hours." Log "Bank confirmations: 2 hours. Reconciliation testing: 3 hours. Cut-off testing: 2.5 hours. Conclusion drafting: 1.5 hours." At the end of the engagement, you'll know where your time actually went. On your second engagement, you estimate with data instead of guessing.

That data is worth more than any study guide chapter on audit efficiency.

The biggest first-year time sink is rework caused by not reading the brief. Your senior gave you instructions at the start of the section. You skimmed them, started testing, and discovered halfway through that you used the wrong sample selection method, or tested the wrong population, or documented in the wrong template. Now you restart. That two-hour mistake was avoidable.

Read the brief in full. If anything is unclear, ask before you start. If you think the instructions contain an error (they sometimes do, seniors are human), raise it. Ten minutes of clarification at the start saves two hours of rework at the end.

A second time management issue: perfectionism on low-risk sections. Cash at bank for a client with two bank accounts and no unusual transactions should not take eight hours of documentation. If you're spending significant time formatting a working paper for a section with zero risk and zero findings, you've misjudged the priority. Your time is a budget resource. The manager allocated it based on where risk exists. Spending four hours polishing a clean section while a high-risk section gets rushed at the end of fieldwork is a net negative for the file.

Worked example: Sara's first statutory audit

Scenario: Sara Hendriks, 23, is a first-year associate at a 35-person firm in Eindhoven. Her first engagement is the statutory audit of De Groot Installatie B.V. (€18M revenue, electrical installation services, 85 employees). Her team is one senior associate and the signing partner. Sara is assigned the trade receivables, cash, and payroll sections.

Week 1: the PBC request

Sara drafts the PBC request list for her sections. Her first draft asks for "the receivables ageing report." Her senior edits it to: "Receivables ageing report as at 31 December 2025, broken down by customer, showing invoice date, due date, outstanding amount, and any amounts past due by more than 90 days." Sara sends the revised request. The client provides the correct document on the first attempt.

Week 2: trade receivables testing

The risk assessment identifies revenue overstatement as a significant risk for De Groot, driven by a history of disputed invoices on large installation projects. Sara's audit programme instructs her to select a sample of 20 receivable balances and agree to subsequent cash receipts or supporting documentation.

Sara selects the sample, tests 20 items, and finds that 18 agreed to cash receipts received after year-end. One agreed to a signed project completion certificate. One (€34,200 from a commercial property developer) had no cash receipt and no completion certificate. The client's explanation: the project is 90% complete, the invoice was raised on a percentage-of-completion basis, and the customer is disputing the scope of remaining work.

Sara's first draft conclusion: "19 of 20 items agreed to supporting documentation. One item outstanding, awaiting client response."

Her senior sends it back. The review comment: "The disputed item is the one that matters. Document: the nature of the dispute, the client's basis for recognising the revenue, whether the project completion methodology meets IFRS 15.35-37 criteria, and your assessment of whether the €34,200 is recoverable. This is a judgemental area on a significant risk. 'Awaiting client response' is not a conclusion."

Sara revises the working paper to include a separate analysis of the disputed receivable, referencing IFRS 15.35 (over-time recognition criteria) and ISA 540.13 (procedures for accounting estimates involving significant judgment). She discusses the assessment with her senior before finalising.

Week 3: the time problem

Sara spent 14 hours on trade receivables (budgeted at 10). The overrun was concentrated in the disputed item analysis (4 hours) and rework on her initial sample documentation (2 hours of reformatting after she realised she used last year's template, which didn't include a column for the assertion tested). Cash took 5 hours (budgeted at 6). Payroll took 8 hours (budgeted at 7).

Total: 27 hours against a 23-hour budget for her three sections. The 4-hour overrun is explained by the disputed receivable (a genuine complexity that the budget didn't anticipate) and 2 hours of avoidable rework.

Sara logs her time by task (not just by section) in the firm's time system. At the engagement debrief, the senior uses her detailed time log to adjust next year's budget for the receivables section.

Your first-engagement survival checklist

1. Before you start any section, read the risk assessment for that account balance. Identify the assessed risks at the assertion level and confirm that your planned procedures address each one. If they don't, raise it with your senior before you begin.
2. Write conclusions that state what you tested, what assertion you addressed, what you found, and what the result means. "No issues noted" is never a complete conclusion under ISA 230.8.
3. Draft PBC requests with enough specificity that the client can provide the exact document on the first attempt. Include the date, the format, the level of detail required, and any breakdowns you need.
4. Track your time by task within each section, not just by section total. Use this data to estimate more accurately on your next engagement.
5. Read every instruction your senior gives you in full before starting work. If anything is unclear, ask. Ten minutes of clarification prevents two hours of rework.
6. When you find something unexpected (a disputed balance, an unusual transaction, a document that doesn't match), stop and think before you document. Ask yourself: does this affect the risk assessment? Does the manager need to know now, or can it wait until review?

Mistakes that matter more than you think

Not asking questions is the most expensive first-year mistake, and it's driven by the fear of looking incompetent. A first-year who spends four hours trying to figure out a testing approach rather than asking the senior for guidance has cost the engagement four hours and still might get the approach wrong. Seniors expect questions from first-years. What they don't expect is four hours of silence followed by a working paper they have to rewrite.

The AFM's 2023 thematic review on audit quality at non-PIE firms noted that insufficient documentation of audit evidence was the most frequently cited deficiency across all file sizes. That deficiency starts at the first-year level. The working paper habits you build now will follow you for years. Invest the extra 40 seconds per conclusion. It compounds.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions