Internal and Forensic Audit · Internal Audit Tools and Techniques

Audit Working Papers and Documentation in Internal Audit

Updated 11 October 2026 · Fact-checked

Audit working papers are the internal auditor's record of the work done: the plan, procedures, evidence, findings and conclusions. They support the report, show standards were followed, and help review. The internal audit function owns them, and they are kept for a period set by the audit charter, policy and law.

Understand Audit Working Papers and Documentation

Start with a simple idea: if it is not written down, it cannot be proved. An internal auditor tests controls, collects evidence and forms views. Working papers are the written record of all this. They show what you did, what you found and why you concluded as you did.

They serve several purposes. They help plan and supervise the work. They support the findings in the report. They let a reviewer, such as the head of internal audit or the audit committee, check the quality of the work. They also help the next audit team, and they provide a defence if management disputes a finding.

Working papers can be on paper or electronic. Typical contents are the engagement letter or terms, audit plan and programme, understanding of the process and controls, flowcharts, questionnaires and checklists, test results and samples, copies or extracts of documents, analyses, confirmations, management responses, review notes and the conclusions drawn. Include only what is relevant. Do not copy documents without a purpose.

Good working papers have clear features. Each has a title, the entity or area, the period, the preparer's name and date, and a reviewer's sign-off. They state the objective, the work done, the source of data, the result and the conclusion. They carry an index or reference so that a finding in the report can be traced to the evidence. A third party should be able to follow them without asking you questions.

Ownership and confidentiality matter. Working papers generally belong to the internal audit function or the organisation, not to the individual auditor. In an outsourced engagement, the contract should state who holds them. They contain sensitive information, so access should be controlled and given to others only with proper authority. Retention follows the organisation's policy and the audit charter, and must also meet any legal requirement. Where the law fixes a period, follow it. Where it does not, use the policy.

Key rules to remember

Purpose of working papers: Plan and supervise + Support the report + Enable review + Provide evidence of work done + Aid future audits; Use this list to open any answer on why working papers are kept.
Core features of a good working paper: Heading + Objective + Work done + Source + Result + Conclusion + Preparer and reviewer sign-off + Index reference; Tick these off when asked for features or a model format.
Ownership rule: Working papers belong to the internal audit function or the organisation, not to the individual auditor; For outsourced work, state that the engagement terms should settle ownership.
Retention rule: Retention period = longer of the policy or charter period and any period required by law; Do not quote a fixed number of years unless the question gives one.

How to solve Audit Working Papers and Documentation questions

Most questions ask you to explain, list or apply. Use this order so that your answer reads like a short professional note.

1Read the question and mark the verb: define, explain, list, distinguish or advise.
2Define working papers in one line as the record of audit work, evidence and conclusions.
3State the purpose that matches the question: planning, support for the report, review or defence.
4List the relevant contents or features. Keep to the ones the facts point to.
5Apply them to the facts given. Name the missing item, such as no reviewer sign-off or no index.
6Cover ownership, confidentiality and retention if the facts raise access or storage issues.
7Conclude with a clear recommendation or answer in one sentence.

Quickest way: Purpose, Contents, Ownership, Retention

When to use it: Use it when time is short and the question is a general one such as 'Discuss working papers'.

Write the definition in one line.
Give three or four purposes.
List contents in a compact bullet list.
Add features: clear, indexed, signed, reviewed.
Close with ownership, confidentiality and retention in two lines.

Common mistakes in Audit Working Papers and Documentation

Saying working papers belong to the auditor personally.
Students link them to the person who prepared them.
Fix: Say they belong to the internal audit function or the organisation, subject to the engagement terms.
Quoting a fixed retention period as a universal rule.
Students remember a number from another law or practice.
Fix: Say retention follows policy, the charter and any legal requirement, and use a figure only if the question gives it.
Listing only documents collected and ignoring the auditor's own analysis and conclusions.
Working papers are imagined as a file of copies.
Fix: Include the plan, tests, results, reasoning, conclusions and review notes.
Leaving out review and sign-off.
Students focus on preparing, not supervising.
Fix: Show preparer and reviewer names and dates as part of every working paper.
Confusing working papers with the audit report.
Both record findings.
Fix: The report is the communication to management. Working papers are the supporting record behind it.
Ignoring confidentiality of the papers.
Students treat documentation as only a technical task.
Fix: Mention controlled access, safe storage and release only with proper authority.

Worked examples

Example 1

Explain the purposes of audit working papers in an internal audit and state the features of a good working paper.

Show the solution

Define: working papers are the record of procedures performed, evidence obtained and conclusions reached.
Purposes: they help plan and supervise the engagement.
They support the findings in the report.
They allow review by the head of internal audit or the audit committee.
They show that the work followed the audit programme and standards.
They help in follow-up and in later audits.
Features: a clear heading with entity, area and period; objective; work done; source of information; results; conclusion.
Also: preparer and reviewer sign-off with dates, and an index so that report findings can be traced to evidence.

Answer: Working papers are the written record of the audit. They serve planning, support for the report, review, proof of work done and future use. A good one is clear, complete, indexed, signed by preparer and reviewer, and understandable to a third party.

Example 2

Rao & Co., an outsourced internal auditor of Sunrise Textiles Ltd, completes a purchase audit. The partner takes the working papers to his office and says they are his firm's personal property. A year later the audit committee asks to see them. Advise on ownership, access and retention.

Show the solution

Identify the issue: who owns and controls the working papers.
Rule: ownership depends on the engagement terms. They are not the personal property of an individual auditor.
Check the contract with Sunrise Textiles Ltd. If it is silent, the papers support work done for the company and should be available to it.
Access: the audit committee oversees internal audit, so a request for access is proper. The firm should provide it, keeping confidential material protected.
Retention: the papers should be kept for the longer of the period in the charter or policy and any legal requirement, and should be stored securely.
Recommendation: record ownership, access and retention in the engagement letter for future engagements.

Answer: The partner cannot treat the papers as purely personal property. Ownership follows the engagement terms, and the audit committee is entitled to reasonable access. The firm must keep them securely for the period required by policy or law. Future engagement letters should settle these points.

Exam tips

Open with a one-line definition. Examiners look for it before the detail.
In case questions, point to the missing element in the facts, such as no index, no review or no retention rule.
Do not quote retention years unless the question gives them. Refer to policy, charter and law.
Use short bullet lists for purposes, contents and features, followed by one applied sentence.
Link working papers to the report: every finding must trace back to documented evidence.

Practice questions from Internal Audit Tools and Techniques

Audit Working Papers and Documentation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Working Papers and Documentation: frequently asked questions

What are audit working papers in internal audit?

They are the record of the planning, procedures, evidence, findings and conclusions of an internal audit engagement. They support the report and allow others to review the work.

Who owns internal audit working papers?

They generally belong to the internal audit function or the organisation, not to the individual auditor. In outsourced work the engagement terms should state ownership and access.

How long should working papers be retained?

For the period set by the organisation's policy and audit charter, or any longer period required by law. Quote a specific number of years only if the question gives it.

What should working papers contain?

They contain the audit plan and programme, understanding of controls, test work, evidence extracts, analyses, findings, management responses, conclusions and review notes. Each should show its objective, source, preparer and reviewer.