Audit and Assurance · Audit planning and documentation

Audit Documentation under ISA 230 for ACCA AA

Updated 11 October 2026 · Fact-checked

Audit documentation is the record of the audit work performed, the evidence obtained and the conclusions reached, kept in working papers. ISA 230 requires it to be enough for an experienced auditor with no prior link to the audit to understand the work, the judgements made and the conclusions.

Understand Audit Documentation

Audit documentation is the auditor's record of what was done, what was found and what was concluded. It is usually called working papers. It can be on paper, electronic or in other media.

Think of it as proof. If someone asks, "How did you reach this opinion?", the file must answer. If the work is not on file, you will struggle to show it was done.

ISA 230 sets the test. Documentation must let an experienced auditor, having no previous connection with the audit, understand three things: the nature, timing and extent of the procedures performed; the results of those procedures and the evidence obtained; and the significant matters arising, the conclusions reached and the significant professional judgements made.

Documentation has several purposes. It provides evidence that the auditor has a basis for the report. It shows the audit was planned and performed in line with ISAs and legal requirements. It helps the team plan and perform the audit, and helps those supervising to direct and review the work. It keeps a record of matters of continuing importance to future audits, and it supports quality control reviews and external inspections.

The file belongs to the audit firm, not the client. The auditor must keep it confidential and retain it for the period required by law and firm policy. Documents can be assembled into the final file only within a reasonable time after the report date. After that, the auditor must not delete or discard working papers, except as the firm's retention policy allows.

Key rules to remember

Test of sufficient documentation: File must let an experienced auditor with no previous connection understand: procedures (nature, timing, extent) + results and evidence + significant matters, conclusions and judgements; This is the core ISA 230 test. Quote it when a question asks what documentation must achieve.
Items to record for each test: Who performed the work and the date + who reviewed it and the date + identifying characteristics of items tested; Identifying characteristics could be an invoice number, date, or the item selected for testing. This allows the work to be re-performed.
Departures from requirements: If an ISA requirement is not followed: document how alternative procedures achieved the aim, and the reasons for the departure; This applies only in exceptional circumstances.
Assembly of the final file: Complete assembly within a reasonable time after the date of the auditor's report; Many firms set 60 days as policy, but ISA 230 itself only says a reasonable time. Do not present 60 days as an ISA rule.
Changes after file completion: If changes or additions are needed: record when, by whom and the specific reasons, and who reviewed them; Never delete old papers to make the file look neater.

How to solve Audit Documentation questions

Use this method for any question on audit documentation, whether it asks for purpose, contents, ownership or retention.

1Identify what the question asks: purpose, contents, form, ownership, confidentiality, retention or a scenario with a weakness.
2Link every point to the ISA 230 test: could an experienced auditor with no previous connection to the audit understand the work and conclusions?
3For contents, think in three layers: planning, procedures and evidence, and conclusions. Add who prepared, who reviewed and dates.
4For ownership and confidentiality, state that the file belongs to the firm, is confidential and is not handed to the client as of right. Mention that the firm may choose to release parts of it.
5For retention, refer to legal requirements and the firm's policy, and say you must not tailor the answer to a fixed number of years unless the question gives one.
6In a scenario, find the specific failing, such as unsigned work, missing conclusions or papers altered after the report, then state the risk and the fix.
7Match your points to the marks available. Give one clear point per mark with a short reason.
8Finish multi-mark answers with a brief link to quality: documentation supports review, inspections and future audits.

Quickest way: The three-question file check

When to use it: Use this in Section A and Section B objective questions, and for a quick plan in Section C answers where documentation is part of the requirement.

Ask: what was done? This covers the procedure, the items tested and the date.
Ask: what was found? This covers the evidence and the result.
Ask: what was concluded, and who checked it? This covers judgement, conclusion, preparer, reviewer and dates.
If any of the three is missing in the scenario, that is the weakness the question is testing.
For objective questions, reject options that say the client owns the file or that working papers can be freely destroyed after the report is signed.

Common mistakes in Audit Documentation

Saying the client owns the audit working papers.
Students confuse them with the client's accounting records, which the client does own.
Fix: Working papers are the auditor's property. They are confidential, and the auditor decides whether to release any part of them, usually subject to the law and to confidentiality.
Stating that ISA 230 requires a fixed retention period such as five years or seven years.
Students remember a local rule or a firm policy and apply it to the ISA.
Fix: Say that retention is set by law, regulation and the firm's quality control policy. Use a specific number only if the question gives it.
Listing only the audit evidence as the contents of the file.
Students think of working papers as just copies of documents.
Fix: Add the engagement terms, planning, risk assessment, procedures, conclusions, significant judgements and matters discussed with management, plus the preparer and reviewer details.
Treating oral discussions as enough because they were held.
Students believe that what was said in a meeting counts as documentation.
Fix: Oral explanations do not on their own support the work. Record significant discussions, who was involved and when.
Writing that documentation is only for the current year's opinion.
Students focus on the report and forget wider uses.
Fix: Include supervision and review, quality control and inspections, and use in future audits. Note that a permanent file holds items of continuing importance.
Suggesting that the auditor can remove or replace old papers after the report to tidy the file.
Students think a clean file is a better file.
Fix: Late changes are allowed only if documented with when, by whom and why. Superseded papers must not be discarded before the retention period ends, except as policy allows.

Worked examples

Example 1

You are an audit senior reviewing a junior's working paper on trade receivables confirmations. It lists balances and says "All OK". There is no preparer name, no date, no reference to which items were selected and no explanation of how differences were resolved. Explain why this paper is inadequate under ISA 230. (6 marks)

Show the solution

State the ISA 230 test: an experienced auditor with no previous connection must be able to understand the procedures, results and conclusions.
Preparer and date missing: there is no accountability, and the reviewer cannot tell who did the work or when.
Items selected not identified: the work cannot be re-performed, and it is unclear how the sample was chosen.
Procedures not described: nature, timing and extent are unknown, so it is unclear whether positive confirmations, alternative procedures or both were used.
Differences not explained: there is no record of how discrepancies were followed up, so evidence may be insufficient.
"All OK" is not a conclusion: it does not say whether the assertion tested (existence, rights, valuation) has been supported.
Reviewer evidence missing: the file does not show supervision or review.

Answer: The paper fails ISA 230 because an independent experienced auditor could not understand what was done, the items tested, the results or the conclusion. It needs preparer and date, identification of items selected, a description of procedures, resolution of differences, a clear conclusion on the assertions and evidence of review.

Example 2

After the audit report on Kestrel Ltd was signed, the engagement partner finds that a significant inventory count conclusion was never written up. The client's finance director then asks for a copy of the full audit file for its own records. Advise on both matters. (6 marks)

Show the solution

Missing conclusion: the work should have been recorded when it was performed. Writing it after the report date does not replace the original record.
If the team now adds documentation, ISA 230 requires it to be marked as an addition. It must show when it was made, who made it, the reasons and who reviewed it.
The addition should not suggest it was prepared before the report date. It must not alter or replace existing papers.
The partner should also consider whether the omission means the opinion lacked support, and follow the firm's quality procedures if so.
Ownership: the audit file belongs to the audit firm, not the client.
Confidentiality: the file contains confidential information and judgements. The firm is not obliged to hand it over.
The firm may release extracts at its discretion, if law and confidentiality allow, and may decline to release the full file.

Answer: The team may add the missing conclusion only as a clearly dated late addition, with the reason, preparer and reviewer recorded, and the partner should consider the effect on the opinion. The audit file belongs to the firm, so the firm can refuse the finance director's request for the full file and may release extracts at its discretion.

Exam tips

Quote the ISA 230 test in your own words early in any explanation question. It earns marks and keeps the answer focused.
In scenarios, look for missing preparer sign-off, dates, conclusions or review evidence. Each one is usually a mark.
For retention questions, refer to law, regulation and firm policy, and avoid an exact number of years unless the question gives one.
In objective questions, rule out options saying the client owns the file or that papers may be freely destroyed. These are classic wrong answers.
Link documentation to quality control and review. A single sentence on this often secures the final mark.

Audit Documentation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Documentation: frequently asked questions

What is the purpose of audit working papers?

They show the basis for the audit report and that the audit was planned and performed in line with ISAs and legal requirements. They also help the team plan, supervise and review the work, and support quality reviews and future audits.

What should audit working papers contain?

They should record the nature, timing and extent of procedures, the results and evidence obtained, and the significant matters, conclusions and judgements. Each paper should also show who prepared it, who reviewed it, the dates and the items tested.

How long must audit files be retained?

The period is set by law, regulation and the firm's own quality control policy, not by a fixed figure in ISA 230. In an exam, say that the firm must keep the file for the required period and use a number only if the question provides one.

Who owns the audit file and can the client see it?

The working papers belong to the audit firm. They are confidential, and the client has no automatic right to see or copy them. The firm may choose to release parts of them, subject to the law and professional rules.