What is audit documentation?
ISA 230.5 defines audit documentation as the record of procedures performed, relevant audit evidence obtained, and conclusions the auditor reached. ISA 230.8 sets the benchmark for what that record must contain: enough detail that an experienced auditor, having no previous connection with the engagement, could understand the nature, timing, and extent of the procedures, the results, the evidence obtained, and the significant matters arising and conclusions reached.
That standard is harder to meet than most teams assume. A working paper that says "tested a sample of 25 invoices, no exceptions" passes the first half (nature and extent) but fails the second (results and conclusions). Which invoices? What did you test on each one? What would have constituted an exception? ISA 230.A2 adds that the form, content, and extent of documentation depend on professional judgment, but the baseline in paragraph 8 is non-negotiable.
Timing has its own rules. ISA 230.14 requires the auditor to assemble the final audit file on a timely basis after the date of the auditor's report, and states that an appropriate time limit is ordinarily no more than 60 days. After that, ISA 230.15 prohibits deleting or discarding documentation, and any additions must record who made them and why. ISQM 1.31(e) reinforces this by requiring the firm's quality management system to address file assembly timelines.
Key Points
- ISA 230.8 sets the test: could an experienced auditor with no connection to the engagement understand the file? This covers procedures, results, evidence, significant matters, and conclusions.
- The 60-day file assembly deadline under ISA 230.14 is a hard cut-off, not a target. It is for organising completed work, not for completing substantive procedures after the report date.
- Regulators inspect documentation, not intentions. If the rationale is not in the file, it does not exist for inspection purposes. The FRC consistently identifies insufficient documentation of auditor judgments as a top finding.
- ISA 230.15 prohibits deletion after the assembly period ends. Any additions must record who made them, when, and why.
Why it matters in practice
The FRC's annual inspection reports (2022 and 2023 cycles) consistently identify insufficient documentation of auditor judgments as a top finding. The file records what was done but not why the auditor concluded as they did. ISA 230.8(c) requires documentation of significant matters arising and conclusions reached. A working paper that records procedures and results but omits the reasoning behind the conclusion fails this requirement.
Consider a food producer where the engagement team performed an inventory observation, counting 340 pallets and reconciling to the perpetual inventory system. Good documentation records the count date, location, team members present, counting method, the reconciliation result, and the explanation for any difference. Separately, the materiality working paper should record not just the number (say 5% of consolidated revenue) but the rationale for the percentage, the performance materiality percentage with its justification (prior year misstatement levels, control environment stability), and cross-references to the relevant ISA paragraphs.
Teams also treat the 60-day file assembly period as a window for completing work rather than assembling completed work. ISA 230.14 and ISQM 1.31(e) are clear: the file is assembled after the engagement is finished. Adding substantive work to the file after the report date — rather than just organising existing documentation — is a quality management breach. Open review points must be resolved with documented evidence, including the date and the partner's confirmation, before or during assembly.
Key standard references
- ISA 230.5: Definition of audit documentation — the record of procedures performed, evidence obtained, and conclusions reached.
- ISA 230.8: The experienced auditor test — documentation must be sufficient for an auditor with no prior connection to understand the work.
- ISA 230.14: File assembly deadline — ordinarily no more than 60 days after the date of the auditor's report.
- ISA 230.15: Prohibition on deleting or discarding documentation after the assembly period; additions must be recorded with who, when, and why.
- ISQM 1.31(e): Firm-level requirement to address file assembly and documentation retention in the quality management system.
Related terms
Related reading
Frequently asked questions
What is the ISA 230.8 test for audit documentation?
ISA 230.8 sets the benchmark: could an experienced auditor, having no previous connection with the engagement, understand the nature, timing, and extent of the procedures performed, the results obtained, the evidence gathered, and the significant matters arising and conclusions reached? This is harder to meet than most teams assume. A working paper that records what was done but not why the auditor concluded as they did fails this requirement.
What is the 60-day file assembly deadline?
ISA 230.14 requires the auditor to assemble the final audit file on a timely basis after the date of the auditor's report, ordinarily no more than 60 days. This is a hard cut-off, not a target. The 60 days are for organising completed work into the final file, not for completing substantive audit work after the report has been signed.
Can you add to the audit file after the assembly deadline?
ISA 230.15 prohibits deleting or discarding documentation after the file assembly period ends. Any additions after that point must record who made them, when, and why. The file cannot be altered to change conclusions retroactively. ISQM 1.31(e) reinforces this by requiring the firm's quality management system to address file assembly timelines.