Auditing and Ethics · Audit Documentation

Ownership, Custody, Confidentiality and Retention of Audit Working Papers

Updated 5 October 2026

Audit working papers belong to the auditor, not the client. The auditor keeps them safe, keeps them confidential, and retains the audit file for a period not shorter than needed by law or firm policy. After file assembly, the auditor may only make administrative changes, unless exceptional circumstances arise. Any later change must be documented.

Understand Ownership, Custody, Confidentiality and Retention

Audit documentation is the record of the work the auditor did, the evidence obtained and the conclusions reached. The big question is: who does this record belong to, and who can see it?

The working papers are the property of the auditor. The client does not own them. The auditor decides how to keep them, who may see them, and when they can be destroyed within the legal limits. This is why an auditor is not bound to hand over the file to the client on request. Questions of lien concern the client's own records, not the auditor's working papers, and they are governed by the Code of Ethics and applicable law.

But ownership is not unlimited. The auditor has a duty of confidentiality to the client under the Code of Ethics. Working papers contain client information, so the auditor cannot show them freely to outsiders. Exceptions exist: where law requires disclosure, where a regulator or the Institute (for example in quality review or disciplinary matters) asks, or where the client consents. The SA 230 application material treats the documentation as the auditor's property. The auditor may, at their discretion, make portions of or extracts from the working papers available to the client, provided this does not undermine the validity of the work performed or the auditor's independence. Access by third parties is governed by the confidentiality requirements in the Code of Ethics and by law.

A successor auditor has no right to the working papers. When a proposed or incoming auditor communicates with the outgoing auditor, the outgoing auditor's duty under the Code of Ethics is to respond to that communication. That duty is about replying, not about handing over documents. If the outgoing auditor chooses to share any extracts, that is at their discretion and subject to confidentiality.

The auditor must also look after the file. This is custody. The firm must have policies to keep documentation safe, intact, accessible and retrievable for the whole retention period, and to prevent unauthorised alteration or loss.

On retention, SA 230 does not fix one number of years for every case. It requires the retention period to be not shorter than the period needed to satisfy the firm's requirements and any legal or regulatory requirements. SQC 1 requires a period sufficient to meet the firm's needs and legal needs and, ordinarily, not shorter than five years from the date of the auditor's report. The exact period in a given case depends on the applicable law and firm policy, and it can be longer. Do not quote a single fixed period for all auditors as if SA 230 laid it down.

Finally, once the auditor has assembled the final audit file, SA 230 requires this to be done on a timely basis after the date of the auditor's report. The SA 230 application material says an appropriate time limit for completing assembly is ordinarily not more than 60 days after the date of the auditor's report. This is ordinary guidance, not a strict rule. After assembly, the auditor must not delete or discard documentation before the retention period ends. The one exception is superseded documentation, which SA 230 allows the auditor to delete or discard as an administrative change. Other changes after assembly are also limited to administrative ones (such as sorting and cross-referencing, signing off completion checklists, and adding evidence already obtained and agreed before the report date). In exceptional cases, new or amended documentation may be added, and you must record who made the change, when, why and who reviewed it.

Key rules to remember

Ownership: Working papers = property of the auditor; The client has no right to demand them. Auditor may give portions to the client at their discretion. A successor auditor also has no right to them.
Confidentiality: Working papers = confidential, disclose only if law, regulator, professional duty or client consent permits; The SA 230 application material treats the documentation as the auditor's property. The auditor may, at their discretion, make portions available to the client, provided this does not undermine the validity of the work or the auditor's independence. Third-party access is governed by confidentiality requirements in the Code of Ethics and by law. Do not state that the client or any third party can see them as of right.
Retention period: Retention period ≥ period needed for firm requirements and legal or regulatory requirements; SA 230 sets no fixed number of years for every case. SQC 1 requires a period sufficient to meet the firm's and legal needs and, ordinarily, not shorter than 5 years from the date of the auditor's report. The exact period depends on applicable law and firm policy.
Assembly of final file: Complete assembly on a timely basis after the date of the auditor's report; The SA 230 application material says the time limit for completing assembly is ordinarily not more than 60 days after the date of the auditor's report. This is ordinary guidance, not a strict rule. After assembly, no deleting or discarding of documentation until the retention period ends, except superseded documentation, which may be deleted or discarded as an administrative change.
Changes after assembly: Allowed only: administrative changes, or exceptional circumstances with documented reasons; Record when, by whom, who reviewed, and the specific reasons.

How to solve Ownership, Custody, Confidentiality and Retention questions

Use this order for any question on who owns, keeps, shows or alters audit documentation.

1Read the facts and identify what is asked: ownership, access, custody, retention, or change after assembly.
2State the basic rule: working papers belong to the auditor, not the client.
3If a client or third party asks for access, apply confidentiality. Check whether law, a regulator, the Institute or client consent allows disclosure. If a successor auditor asks, say that there is no right to the file and that the outgoing auditor's duty is only to respond to the communication under the Code of Ethics.
4If the question is on retention, state the rule: not shorter than legal or regulatory requirements and firm policy, with SQC 1 ordinarily requiring not shorter than 5 years from the date of the auditor's report. Say that the exact period depends on applicable law and firm policy, and count from the date asked.
5If the question is on changes, find the date of assembly. Before it, changes are normal. After it, only administrative changes or documented exceptional changes.
6Apply the rule to the facts and give a clear conclusion, such as 'refuse', 'may share', 'allowed', or 'not allowed'.
7Add the documentation requirement: who changed, when, why, and who reviewed.

Quickest way: Own, Show, Keep, Change

When to use it: Use this for both MCQs and short descriptive answers when you have under two minutes.

Own: ask whose property. Auditor's, always.
Show: ask if law, regulator or consent allows. If none, no disclosure.
Keep: not shorter than legal and firm requirements; SQC 1 ordinarily requires not shorter than 5 years from the report date. The exact period depends on law and firm policy.
Change: before assembly free; after assembly only administrative or documented exceptional.
MCQ elimination: reject any option that says the client owns the papers, that the papers can be destroyed right after the report, or that post-assembly changes need no record.
Written answer format: Provision (SA 230 rule), Facts (apply to the case), Conclusion (one line). This earns step marks.

Common mistakes in Ownership, Custody, Confidentiality and Retention

Saying the client owns the working papers because the client pays the fee.
Students link payment with ownership.
Fix: Remember the working papers are the auditor's own record of the work done. The client owns its books and records, not the auditor's file.
Writing that the auditor must give the working papers to the client or a successor auditor on request.
Students confuse the outgoing auditor's duty to respond to communication from the successor auditor (Code of Ethics) with a duty to hand over documents.
Fix: Neither the client nor a successor auditor has a right to the working papers. The outgoing auditor's duty is to respond to the communication, as the Code of Ethics requires. Sharing any extracts or portions is at the auditor's discretion and subject to confidentiality.
Ignoring confidentiality and saying any third party can see the file.
Students focus on ownership and forget the duty of confidentiality.
Fix: Disclosure needs a legal, regulatory or professional duty, or client consent. Third-party access is governed by the confidentiality requirements in the Code of Ethics and by law.
Stating a fixed retention period as if SA 230 set it for all auditors, or counting from the wrong date.
Students mix SA 230, SQC 1, firm policy and the Companies Act records provisions, which apply to companies' own records.
Fix: Say: not shorter than legal and firm requirements, with SQC 1 ordinarily requiring not shorter than 5 years from the date of the auditor's report. State that the exact period depends on applicable law and firm policy.
Saying the auditor can freely change the file after assembly.
Students think the file is still a draft after the report is signed.
Fix: After assembly only administrative changes, or documented exceptional changes. Apart from superseded documentation (an administrative change), never delete or discard documentation before retention ends.

Worked examples

Example 1

After the audit of Alpha Ltd, the management asks the auditor to hand over all working papers, saying it paid the audit fee and is the owner of the audit file. Can the auditor refuse? Discuss as per SA 230.

Show the solution

Provision: Audit working papers are the property of the auditor. The client has no right to the auditor's documentation.
Facts: Alpha Ltd bases its claim on payment of fees. Payment of fees does not transfer ownership of the auditor's record.
Confidentiality and discretion: The auditor may, at their discretion, give portions of or extracts from working papers to the client, provided this does not harm the independence or validity of the work done.
Conclusion: The auditor can refuse to hand over the whole file, but may give extracts if appropriate.

Answer: Yes. The working papers belong to the auditor, so the auditor may refuse to hand over the entire file and may, at their discretion, provide extracts.

Example 2

An auditor signed the report of Beta Ltd on 20 May. The file was assembled on 10 July. On 25 July, the audit team wants to delete a superseded draft working paper and also add a new analysis based on procedures performed after the report date. What can the auditor do?

Show the solution

Provision: After assembly, the auditor must not delete or discard documentation before the retention period ends. The exception is superseded documentation, which SA 230 allows to be deleted or discarded as an administrative change. Other changes are limited to administrative ones, or exceptional circumstances with documentation.
Check the timing: 20 May to 10 July is 51 days (11 days left in May after 20 May, 30 in June and 10 in July). The SA 230 application material gives 60 days as ordinary guidance for completing assembly, not a strict rule. At 51 days, assembly was timely.
Deleting a superseded draft: this is an administrative change, which is allowed.
New analysis based on procedures performed after the report date: only evidence already obtained and agreed before the report date can be added as an administrative change. This analysis comes from work done after that date, so it is not an administrative change.
It can therefore be added only in exceptional circumstances, such as a need to perform new procedures after the report date. It must be clearly shown as work done after the report date, and it cannot be treated as support for the opinion already issued, which was formed on the evidence available at the report date.
Documentation: record the specific reasons for the change, who made it, when it was made, and who reviewed it.
Conclusion: Deletion of the superseded draft is permitted. The new analysis may be added only in exceptional circumstances, with a full record, and not as support for the opinion already given.

Answer: The auditor may delete the superseded draft as an administrative change. The new analysis is post-report work, so it is not an administrative change and cannot support the opinion already issued. It may be added only in exceptional circumstances, with the reasons, date, person making the change and reviewer recorded.

Exam tips

Open every answer with the one-line rule: 'Working papers are the property of the auditor.' It secures the first mark.
In case-study questions, use the Provision, Facts, Conclusion format. Each part usually carries a mark.
Count days carefully when a question gives dates for file assembly. The SA 230 application material says assembly should ordinarily be completed not more than 60 days after the date of the auditor's report. Count from the report date, not the balance sheet date.
For MCQs, watch for options that say 'client owns' or 'can be destroyed after signing'. These are almost always wrong.
Always add the documentation line for post-assembly changes: who, when, why, reviewer.

Practice questions from Audit Documentation

Ownership, Custody, Confidentiality and Retention: frequently asked questions

Who owns audit working papers?

The auditor owns them. They are the auditor's record of work done, evidence and conclusions. The client owns its own books and records, not the auditor's file.

Can the auditor show working papers to the client or a third party?

The auditor may, at their discretion, give portions or extracts to the client, provided this does not undermine the validity of the work or the auditor's independence. Third-party access is governed by the confidentiality requirements in the Code of Ethics and by law, so third parties can see them only if law, a regulator or the Institute requires it, or the client consents. A successor auditor has no right to the working papers either. The outgoing auditor must respond to the successor's communication under the Code of Ethics, and sharing any extracts is at their discretion and subject to confidentiality.

What is the retention period for audit documentation?

SA 230 says the period must not be shorter than needed to meet the firm's requirements and any legal or regulatory requirements. It does not fix one number of years for every case. SQC 1 requires a period sufficient to meet the firm's and legal needs and, ordinarily, not shorter than 5 years from the date of the auditor's report. The exact period depends on applicable law and firm policy.

Can the auditor change the audit file after it is assembled?

Only for administrative changes, or in exceptional circumstances with full documentation. Superseded documentation may be deleted or discarded as an administrative change. The auditor must not delete or discard other documentation before the retention period ends.

Does the auditor have a lien on working papers?

Working papers are the auditor's own property, so the lien question does not concern them. Lien issues relate to the client's own books and records, and they are governed by the Code of Ethics and applicable law. In exam answers, rely on ownership and confidentiality for working papers.