ExamFinch.com My Study

Study guide

13.4 Audit Documentation, Assembly & Retention (AU-C 230)

Practice this exam

AICPA CPA Exam — Auditing & Attestation AUD

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Orientation & the Auditing Regulatory Environment

1.1 CPA AUD Exam Structure, Scoring & Blueprint Strategy 1.2 Regulatory Authorities & Auditing Standards Hierarchy 1.3 Preconditions for an Audit & Engagement Letters (AU-C 210)

2 Chapter 2: Professional Ethics & the AICPA Code of Conduct

2.1 AICPA Code of Professional Conduct & Conceptual Framework 2.2 Independence Rules: AICPA vs. SEC and PCAOB Standards 2.3 Independence Under Government (GAGAS) & Employee Benefit (DOL) Standards 2.4 Professional Skepticism, Professional Judgment & Client Confidentiality

3 Chapter 3: Quality Management at Firm & Engagement Levels

3.1 Firm System of Quality Management: SQMS No. 1 3.2 Engagement Quality Reviews: SQMS No. 2 3.3 Engagement-Level Quality Management: SAS 146 & AU-C 220

4 Chapter 4: Audit Planning, Strategy & Materiality

4.1 Audit Planning & Overall Audit Strategy (AU-C 300) 4.2 Materiality, Performance Materiality & Tolerable Misstatement (AU-C 320 & 450) 4.3 The Audit Risk Model & Risk Assessment Mechanics

5 Chapter 5: Entity Understanding, Inherent Risk & Internal Control

5.1 Understanding the Entity, Environment & Inherent Risk Factors (SAS 145 / AU-C 315) 5.2 Economic Conditions, Industry Factors & SOX Corporate Governance 5.3 COSO 2013 Internal Control Framework: 5 Components & 17 Principles 5.4 IT General Controls (ITGCs) & Application Controls 5.5 Evaluating Design & Implementation of Controls

6 Chapter 6: Fraud Risk, Laws & Specialized Resources

6.1 Fraud Risk Assessment & Auditor Responses (AU-C 240) 6.2 Consideration of Laws, Regulations & Non-Compliance (AU-C 250 & NOCLAR) 6.3 Group Audits: AU-C 600 and the SAS No. 149 Transition 6.4 Using the Work of Internal Auditors (AU-C 610) & Specialists (AU-C 620)

7 Chapter 7: Audit Evidence Fundamentals & General Procedures

7.1 Audit Evidence: Sufficiency, Appropriateness & Management Assertions (AU-C 500) 7.2 Audit Data: Relational Databases, Measurement Scales, Extraction & Reliability 7.3 Types of Audit Procedures & Audit Data Analytics (ADA) 7.4 Substantive Analytical Procedures (AU-C 520)

8 Chapter 8: Audit Sampling Concepts & Attribute Testing

8.1 Audit Sampling Principles & Sampling Risk (AU-C 530) 8.2 Attribute Sampling for Tests of Controls 8.3 Non-Statistical Sampling & Dual-Purpose Testing

9 Chapter 9: Variables Sampling & Monetary Unit Sampling (MUS)

9.1 Classical Variables Sampling Methods (MPU, Ratio, Difference) 9.2 Monetary Unit Sampling (MUS / PPS) Mechanics & Sizing 9.3 Evaluating Variables Sampling Results & Upper Misstatement Limits

10 Chapter 10: Substantive Testing: Revenue, Receivables & Confirmations

10.1 Auditing the Revenue and Receivables Cycle & Cutoff 10.2 External Confirmations: Positive, Negative & Non-Responses (AU-C 505) 10.3 Allowance for Credit Losses (CECL) & Valuation of Receivables

11 Chapter 11: Substantive Testing: Purchasing, Inventory, Cash & Long-Term Assets

11.1 Purchasing, Accounts Payable & Search for Unrecorded Liabilities 11.2 Inventory Observation & Valuation (AU-C 501) 11.3 Auditing Cash, Bank Reconciliations & Interbank Transfers (Kiting) 11.4 Auditing Property, Plant & Equipment, Debt & Equity Cycles

12 Chapter 12: Complex Estimates, Related Parties & Concluding Evidence

12.1 Auditing Accounting Estimates & Fair Value (AU-C 540) 12.2 Investments in Securities, Derivatives & Equity-Method Investees 12.3 Related Parties & Significant Unusual Transactions (AU-C 550) 12.4 Litigation, Claims & Assessments and Legal Inquiry (AU-C 501 / ASC 450) 12.5 Subsequent Events & Subsequently Discovered Facts (AU-C 560)

13 Chapter 13: Final Evaluation, Written Representations & Documentation

13.1 Evaluating Audit Findings & Misstatement Accumulation (AU-C 450) 13.2 Going Concern Evaluation (AU-C 570) 13.3 Written Management Representations (AU-C 580) 13.4 Audit Documentation, Assembly & Retention (AU-C 230)

14 Chapter 14: The Standard Audit Report & Opinion Modifications

14.1 The Standard Unmodified Audit Report (AU-C 700) 14.2 Audit Report Modifications: Qualified, Adverse & Disclaimer (AU-C 705) 14.3 Emphasis-of-Matter & Other-Matter Paragraphs (AU-C 706) 14.4 Key Audit Matters (AU-C 701) & Critical Audit Matters (AS 3101)

15 Chapter 15: Comparative Statements, Other Information & PCAOB Reporting

15.1 Comparative Financial Statements & Predecessor Auditor Reporting 15.2 Other Information, Supplementary Information & Special Purpose Frameworks 15.3 Reviews of Interim Financial Information (AU-C 930 & PCAOB AS 4105) 15.4 PCAOB Reporting & Integrated Audits of ICFR (AS 3101 & AS 2201)

16 Chapter 16: SSARS Engagements: Preparation, Compilation & Review

16.1 The SSARS Framework & Hierarchy of Services (AR-C 60-90) 16.2 Preparation of Financial Statements (AR-C 70) 16.3 Compilation Engagements (AR-C 80) 16.4 Review of Financial Statements (AR-C 90)

17 Chapter 17: SSAE Attestation, SOC Reports & Government Audits

17.1 The SSAE Attestation Framework: Assertion-Based and Direct Examinations and Reviews 17.2 Agreed-Upon Procedures Engagements (AT-C 215, SSAE No. 19) 17.3 Service Organization Controls: SOC 1 & SOC 2 Engagements (AT-C 320) 17.4 Reporting on Compliance: AU-C 806, AT-C 315 & AU-C 935 17.5 Government Auditing Standards (Yellow Book / GAGAS) & Uniform Guidance Single Audits

13.4 Audit Documentation, Assembly & Retention (AU-C 230)

Key Takeaways Explain This Topic AI

Under AU-C 230 and PCAOB AS 1215, audit documentation must satisfy the 'experienced auditor standard,' enabling an experienced auditor with no previous connection to understand the nature, timing, extent, evidence, and conclusions of the audit.

Audit documentation is divided into the Permanent File (documents of ongoing multi-year significance like bylaws, bond indentures, and lease contracts) and the Current File (working papers supporting the specific audit period).

Documentation must be complete within 60 days after the report release date under AU-C 230; amended PCAOB AS 1215 requires 14 days for issuer audits.

The mandatory document retention period is at least 5 years from the report release date for non-issuers (AICPA) and at least 7 years for public company issuers (PCAOB / Sarbanes-Oxley).

After the document assembly completion date, documentation may never be deleted or discarded; later additions must document the specific reasons and when and by whom they were made and reviewed.

Last updated: September 2026

13.4 Audit Documentation, Assembly & Retention (AU-C 230)

Core Principle: Audit documentation—traditionally termed working papers or workpapers—is the written record of the basis for the auditor's conclusions that provides the support for the auditor's representations. Under AU-C 230 ( Audit Documentation ) and PCAOB AS 1215 , documentation must be prepared on a timely basis and must satisfy the rigorous Experienced Auditor Standard . The adage of professional auditing applies: "If it was not documented, it was not done."

1. Purpose and Objectives of Audit Documentation

Audit documentation serves two primary functions and several secondary functions: +-------------------------------------------------------------------------------------------------------+

  • | FUNCTIONS OF AUDIT DOCUMENTATION |
  • | |
  • | PRIMARY PURPOSES SECONDARY PURPOSES |
  • | 1. Provide a sufficient and appropriate record 1. Assists the audit team in planning and |
  • | of the basis for the auditor's report. performing the audit. |
  • | 2. Provide evidence that the audit was planned 2. Facilitates direction, supervision, and review |
  • | and executed in accordance with GAAS and of audit work (AU-C 220). |
  • | applicable legal/regulatory requirements. 3. Enables engagement quality control reviews and |
  • | external inspections (peer review, PCAOB). |
  • | 4. Retains historical record of recurring matters. |
  • +-------------------------------------------------------------------------------------------------------+
  • 2. The "Experienced Auditor" Standard

AU-C 230.08 and PCAOB AS 1215 establish an objective benchmark for documentation sufficiency known as the Experienced Auditor Standard : THE EXPERIENCED AUDITOR BENCHMARK

  • |
  • Audit documentation must enable an EXPERIENCED AUDITOR having NO PREVIOUS

CONNECTION with the audit to understand the complete audit workflow:

  • |
  • +-----------------------------------------+-----------------------------------------+
  • | | |
  • NATURE, TIMING, & EXTENT RESULTS & EVIDENCE SIGNIFICANT FINDINGS
  • Specific procedures performed - Evidence obtained from testing - Significant issues arising
  • Items tested (identifying traits) - Reconciliation to general ledger - Conclusions reached thereon
  • Who performed work and date - Verification of assertion validity - Significant professional
  • Who reviewed work and date judgments exercised

Who is an "Experienced Auditor"?

An experienced auditor is defined as an individual (whether internal to the firm or an external peer reviewer/regulator) who possesses:

Practical audit experience, and

A reasonable understanding of audit processes, auditing standards (GAAS/PCAOB), the relevant business environment, and industry accounting and financial reporting standards.

Documenting Significant Audit Findings

Audit documentation must explicitly capture significant audit findings or issues , which include:

Significant risks identified and the results of audit procedures addressing them.

Results indicating that the financial statements could be materially misstated or the need to revise previous risk assessments.

Circumstances causing significant difficulty in applying necessary audit procedures.

Findings that could result in a modification of the audit opinion or the inclusion of an Emphasis-of-Matter/Going Concern section.

Disagreements among team members or with management regarding accounting treatments, including how those disagreements were resolved.

3. Permanent File vs. Current File Taxonomy

Audit workpapers are systematically organized into two primary archives based on their temporal relevance: +-------------------------------------------------------------------------------------------------------+

  • | PERMANENT FILE VS. CURRENT FILE TAXONOMY |
  • | |
  • | PERMANENT FILE (Continuing Significance) CURRENT FILE (Applicable to Current Year Only) |
  • | - Articles of Incorporation and Bylaws - Audit Engagement Letter |
  • | - Corporate Charter and Partnership Agreements - Overall Audit Strategy and Audit Plan |
  • | - Long-Term Bond Indentures and Mortgages - Working Trial Balance |
  • | - Long-Term Operating Leases and Union Contracts - Lead Schedules supporting F/S accounts |
  • | - Internal Control Flowcharts and System Manuals - Bank Confirmations and Bank Reconciliations |
  • | - Historical Analyses of Capital Stock & Equity - Accounts Receivable Confirmation Schedules |
  • | - Prior Years' Tax Returns & Depreciation Logs - Inventory Count Observation Test Sheets |
  • | - Pension and Post-Retirement Benefit Plans - Search for Unrecorded Liabilities Workpapers |
  • | - Historical Schedule of Unadjusted Differences - Legal Inquiry Letter and Attorney Responses |
  • | - Management Representation Letter (AU-C 580) |
  • | - Summary of Unadjusted Audit Differences (SUAD) |
  • +-------------------------------------------------------------------------------------------------------+
  • Ownership and Confidentiality of Working Papers

Auditor Ownership: Audit documentation is the exclusive property of the independent auditor , not the client. The client has no legal right to demand the auditor's workpapers.

Confidentiality (AICPA Code of Professional Conduct): The auditor must maintain strict confidentiality and cannot disclose workpapers without client consent, except in situations the Code permits, such as:

In response to a valid court subpoena or summons.

As part of an authorized AICPA or State Board of Accountancy peer review or quality review.

During an official professional ethics investigation or trial.

In connection with the sale or merger of the CPA firm's practice (with appropriate confidentiality safeguards).

4. Document Assembly Deadlines & Retention Periods: AICPA vs. PCAOB

The statutory deadlines for assembling the final audit file and the required retention periods are heavily tested on the CPA exam. The rules differ significantly between non-issuers (AICPA) and public company issuers (PCAOB / Sarbanes-Oxley) : +-------------------------------------------------------------------------------------------------------+

  • | STATUTORY DOCUMENTATION DEADLINES |
  • | |
  • | REGULATORY STANDARD DOCUMENT ASSEMBLY DEADLINE MANDATORY RETENTION PERIOD |
  • | Non-Issuers (Private) 60 CALENDAR DAYS AT LEAST 5 YEARS |
  • | AICPA AU-C 230 from the Report Release Date from the Report Release Date |
  • | |
  • | Issuers (Public / SEC) 14 CALENDAR DAYS* AT LEAST 7 YEARS |
  • | PCAOB AS 1215 / SOX from the Report Release Date from the Report Release Date |
  • +-------------------------------------------------------------------------------------------------------+

*PCAOB amendments to AS 1215 cut the issuer documentation completion window from 45 to 14 days, effective for audits of fiscal years beginning on or after December 15, 2024 for firms that issued audit reports for more than 100 issuers in 2024, and one year later for all other firms. Older materials still show 45 days.

The Report Release Date Defined

Both deadlines run from the Report Release Date , defined as:

The date on which the auditor grants the entity permission to use the auditor's report in connection with the financial statements (typically the date the audit report is physically or electronically delivered to the client).

Permissible Activities During the Assembly Period

The assembly window (60 days for AICPA; 14 days for PCAOB) is an administrative coordination phase. Permissible actions are strictly administrative :

Deleting or discarding superseded drafts and preliminary notes.

Sorting, collating, and cross-referencing final working papers.

Signing off on completed audit program review checklists.

Adding documentation of evidence previously gathered, discussed, and agreed upon with the audit team prior to the report date.

PROHIBITED: Performing new substantive audit procedures or reaching new audit conclusions during the assembly period without documenting subsequent events.

5. Post-Assembly Documentation Changes and Additions

Once the document assembly completion date has passed (Day 61 for AICPA; Day 15 for PCAOB), the audit file is permanently closed . POST-ASSEMBLY MODIFICATION PROTOCOL

  • |
  • +------------------------------+------------------------------+
  • | |
  • DELETIONS / DISCARDS ADDITIONS / MODIFICATIONS
  • STRICTLY PROHIBITED! PERMISSIBLE WITH STRICT CONDITIONS

No documentation of any nature may be Auditor MUST document (AU-C 230):

deleted, purged, or discarded after the reasons, and when/by whom made & reviewed

assembly completion date. 1. Specific reasons for modification.

2. When changes were made.

3. By whom changes were made.

4. Who reviewed changes & review date.

5. (Good practice) effect on conclusions.

Post-Assembly Documentation Rules

If the auditor discovers subsequent facts or omissions that necessitate adding or modifying documentation after the assembly period, the auditor must never overwrite or delete existing documentation . The auditor must add new documentation that explicitly details:

The Specific Reasons: The exact circumstances necessitating the addition (e.g., receipt of a delayed confirmation or response to a regulatory inquiry).

Who and When (Author): The identity of the individual who prepared the new documentation and the exact date it was added.

Who and When (Reviewer): The identity of the supervisor or partner who reviewed the new documentation and the review date.

Audit Conclusion Impact: A statement of the effect, if any, on conclusions and the report. This is good practice, and it is required when new procedures are performed after the report date.