Audit and Assurance · Audit finalisation and the final review

Audit Completion: Reviews, Documentation and Communication

Updated 11 October 2026 · Fact-checked

Audit completion is the final stage where the auditor checks the work done, finishes the file, and reports matters to others. It covers file review by seniors, a quality review on listed or high-risk audits, final documentation, and communication of findings to those charged with governance (ISA 260) and of control deficiencies (ISA 265).

Understand Audit Completion: Reviews, Documentation and Communication

Audit completion is the last stage of the audit. Fieldwork is finished, but the auditor cannot yet sign the report. First the firm must be sure the opinion is supported by the evidence on file. Then the auditor must tell the right people what was found.

There are three strands. The first is review. Each piece of work is reviewed by someone more senior than the person who did it. The manager checks the work, and the partner reviews key areas such as significant risks, judgements and the proposed opinion. On some audits, such as listed entities or high-risk clients, an engagement quality review is also done by someone independent of the team.

The second strand is documentation. The file must show what was done, the evidence obtained, the conclusions and the significant judgements. It must be complete enough for an experienced auditor with no prior link to the audit to understand it. The file is assembled and closed within a set time after the report date. After that, nothing is deleted. Changes are only added, with the reason, date and who made them.

The third strand is communication. Under ISA 260 the auditor communicates with those charged with governance (TCWG), such as the audit committee or board. This covers the auditor's responsibilities, planned scope and timing, significant findings from the audit, and independence matters. Under ISA 265 the auditor communicates significant deficiencies in internal control in writing, on a timely basis. Management also gets points that are less significant, often in a management letter.

Think of it as a quality gate. Review and documentation prove the work is sound. Communication makes sure the people responsible for oversight and for fixing the problems are properly informed.

Key rules to remember

Review levels: Preparer → Senior/Manager review → Partner review → Engagement quality review (where required); Review is always by someone more senior than the preparer. The EQ reviewer must be independent of the team.
Hot review: Hot review = review before the audit report is signed; It can still change the opinion or the work done. Examples are partner and engagement quality reviews.
Cold review: Cold review = review after the report is signed; It checks quality for learning and monitoring. It cannot change the signed report but can improve future audits.
ISA 260 matters to communicate: Auditor's responsibilities + planned scope and timing + significant findings + independence; Significant findings include views on accounting practices, difficulties, uncorrected misstatements, and matters discussed with management.
ISA 265 rule: Significant deficiencies → in writing to TCWG, on a timely basis; other deficiencies → to management; The auditor communicates deficiencies found during the audit. Absence of reported deficiencies does not mean controls are adequate.
Documentation rule: File assembly completed on a timely basis after the report date; no deletion after completion; Later additions must record when, by whom and why.

How to solve Audit Completion: Reviews, Documentation and Communication questions

Use this method for any question on completion, review, documentation or communication. It keeps your answer tied to the scenario.

1Identify what is being asked: review, documentation, communication to TCWG, or deficiencies to management. Many questions mix two of these.
2Pick out the scenario facts: listed or high risk client, who prepared the work, whether the report is signed, and what issues arose.
3Name the correct party and the correct standard. TCWG relates to ISA 260, internal control deficiencies to ISA 265, and file closure to documentation rules.
4State the rule or procedure in one clear sentence, then apply it to a specific fact in the scenario.
5Explain why it matters, such as protecting the opinion, quality, or oversight by governance.
6For written answers, use short headed points with one point per mark. For objective questions, remove options that break a rule, such as deleting documents or a reviewer being junior to the preparer.
7Check timing. Ask whether the matter must happen before the report is signed or afterwards.

Quickest way: Who, what, when check

When to use it: Use this on objective test questions and for planning a short written answer when time is short.

Who: preparer, reviewer, partner, EQ reviewer, TCWG or management?
What: review, file closure, significant findings, or control deficiency?
When: before or after the report is signed? Hot is before, cold is after.
Match to rule: TCWG gets significant findings and significant deficiencies in writing; management gets the rest.
Pick the option that fits all three and has no rule breach.

Common mistakes in Audit Completion: Reviews, Documentation and Communication

Treating hot and cold reviews as the same thing.
Both are called quality reviews, so the timing is overlooked.
Fix: Link hot to before signing, where it can change the opinion. Link cold to after signing, where it monitors quality and drives improvement.
Saying the auditor communicates only with management.
Students mix up the management letter with ISA 260 communication.
Fix: Remember TCWG are the oversight body. Significant matters go to them. Management receives the detailed points and the management letter.
Listing every deficiency as significant.
Students want to show they spotted all weaknesses.
Fix: Judge significance by the possible effect on the financial statements. Only significant deficiencies must be communicated in writing to TCWG. Lesser ones go to management.
Stating that old working papers can be removed once the file is closed.
Students think tidying the file means deleting items.
Fix: After file assembly, documents are not deleted. Additions are allowed only when the reason, date and person are recorded.
Listing procedures with no link to the scenario.
Students memorise lists and write them out in full.
Fix: Use the scenario. If a junior valued inventory, say the manager must review that work. If there is a significant risk, say the partner must review it.
Claiming the management letter proves the controls are effective if it is short.
Students confuse audit scope with a control review.
Fix: State that the auditor reports only deficiencies found during the audit and does not give assurance on controls or provide a full list of all weaknesses.

Worked examples

Example 1

You are the audit manager on a listed client. A senior has completed the receivables working papers, which include a significant risk of overstated revenue. The audit report is due to be signed next week. Explain the review procedures required before signing.

Show the solution

Identify the facts: listed client, a significant risk, work done by a senior, and report not yet signed. This points to hot reviews.
Review by the manager: the manager checks the receivables work for completeness, whether procedures were done as planned, whether evidence is sufficient and appropriate, and whether conclusions are supported.
Partner review: the engagement partner reviews the significant risk areas and key judgements, and the proposed audit opinion.
Engagement quality review: a listed entity audit needs an independent reviewer, who is not part of the team, to assess significant judgements and the conclusions reached in forming the report.
Outcome: any weaknesses found are fixed with extra work before signing, and review points are cleared and documented.

Answer: The senior's work should be reviewed by the manager, then the partner should review the revenue significant risk and the opinion. An independent engagement quality review is required for a listed client. All of this is a hot review done before the report is signed, and any review points must be cleared and documented.

Example 2

During the audit of Zeta Co, you found that credit limits are not enforced, so customers regularly exceed them. Receivables are material and some balances proved irrecoverable. Explain how and to whom you should communicate this, and what the communication should contain.

Show the solution

Classify the issue: the weakness in credit control has led to irrecoverable balances in a material area, so it is likely a significant deficiency under ISA 265.
Recipient: significant deficiencies are communicated in writing to TCWG, such as the audit committee or board. Management should also be told, and management's response should be sought.
Timing: communicate on a timely basis, so management can act before the next period, and in time for TCWG to take note. This is often at or before the end of the audit.
Content: describe the deficiency, explain the potential effects such as bad debts and cash flow problems, and give a recommendation, such as automated blocks on credit limits and approval of overrides.
Add a statement that the communication covers only deficiencies identified during the audit and that the audit was not designed to identify all weaknesses in controls.

Answer: Report the credit limit failure in writing to TCWG as a significant deficiency, and inform management. Describe the deficiency, its effects such as irrecoverable debts, and recommend a fix. Include a note that only deficiencies found during the audit are reported, and ask for management's response.

Exam tips

Always tie the answer to the scenario. Name the client's issue, such as listed status or a junior preparer, and then give the review or communication that fits it.
Learn the difference between hot and cold reviews with the timing hook of before or after signing. This is a favourite objective test point.
For deficiency questions, use a four-part layout: deficiency, effect, recommendation, and who to report to. This earns marks in constructed response answers.
In objective questions, watch for options that break a rule, such as deleting documents after file closure, or a reviewer who is more junior than the preparer.
Do not mix up ISA 260 and ISA 265. Use ISA 260 for overall communication with TCWG and ISA 265 for control deficiencies.

Audit Completion: Reviews, Documentation and Communication in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CA IntermediateAuditor's Communication and Completion Procedures

Audit Completion: Reviews, Documentation and Communication: frequently asked questions

What is the difference between a hot review and a cold review?

A hot review takes place before the audit report is signed, so it can change the work done or the opinion. A cold review takes place after signing and checks the quality of the completed audit. Its findings are used to improve future audits and to monitor the firm's quality.

Who are those charged with governance in ISA 260?

They are the people or bodies with responsibility for overseeing the entity's direction and accountability, such as the board, the audit committee or non-executive directors. In some entities, management and TCWG overlap. The auditor decides who is the right person or group to communicate with.

What must an ISA 265 communication include?

Significant deficiencies in internal control must be communicated in writing to TCWG on a timely basis. The communication should describe the deficiencies and explain their potential effects. Other deficiencies that merit management's attention are reported to management.

Can audit working papers be changed after the file is closed?

Documents should not be deleted or discarded after file assembly is complete. If changes or additions are needed, they must be recorded, including the specific reasons, when they were made and who made and reviewed them.