A tick beside a ledger balance tells a reviewer very little on its own. A working paper has to show what was tested, why that item was picked, which evidence supports the result and how any exception was cleared. Standard on Auditing (SA) 230, Audit Documentation, sets the minimum record an auditor must keep, and it is the standard reviewers, peer reviewers and quality inspectors test a file against.
This guide covers what SA 230 requires, what each working paper should contain, a completed receivables working paper, how to record judgments, and the rules on file assembly, later changes and retention. The requirements quoted here are from ICAI's study material on SA 230, Audit Documentation. For deeper practical guidance, ICAI has published the Implementation Guide to SA 230, Audit Documentation (Revised 2022 Edition), released on 15 December 2022.
What SA 230 asks the documentation to achieve
The objective of the auditor under SA 230 is to prepare documentation that provides:
- a sufficient and appropriate record of the basis for the auditor's report; and
- evidence that the audit was planned and performed in accordance with SAs and applicable legal and regulatory requirements.
SA 230 defines audit documentation as the record of audit procedures performed, relevant audit evidence obtained and conclusions the auditor reached. The audit file is one or more folders or other storage media, in physical or electronic form, containing those records for a specific engagement. Paper, electronic and mixed files are all acceptable; what matters is the content.
The experienced-auditor test
The documentation must be enough for an experienced auditor, having no previous connection with the audit, to understand the nature, timing and extent of the procedures performed, the results and evidence obtained, significant matters arising during the audit, the conclusions reached and the significant professional judgments made. SA 230 describes the experienced auditor as someone with practical audit experience and a reasonable understanding of audit processes, SAs and regulatory requirements, the entity's business environment and the relevant industry issues.
A quick way to apply the test: read the working paper without adding any explanation from memory. If you cannot tell which item was tested, why it was selected, what was found and what follow-up was done, attaching the client's schedule will not fill the gap.
The core requirements, in the order a reviewer checks them
| Requirement | What the file must show |
|---|---|
| Timely preparation | The auditor shall prepare audit documentation on a timely basis, not at the end of the engagement. |
| Identifying characteristics | The identifying characteristics of the specific items or matters tested. |
| Preparer and reviewer | Who performed the audit work and the date it was completed; who reviewed it, and the date and extent of that review. |
| Significant discussions | Discussions of significant matters with management, those charged with governance and others. |
| Inconsistent information | Where information contradicts the final conclusion on a significant matter, how the auditor addressed the inconsistency. |
| Departure from a requirement | In exceptional cases where a relevant SA requirement is departed from, how the alternative procedures achieve the aim of that requirement and the reasons for the departure. |
| Matters after the report date | If new procedures are performed after the date of the auditor's report, the circumstances, the procedures, evidence and conclusions, and when and by whom the resulting changes were made and reviewed. |
SA 230 lists audit programmes, analyses, issues memoranda, summaries of significant matters, letters of confirmation and representation, checklists and correspondence (including e-mail) concerning significant matters as examples of audit documentation. The documentation supports the audit; it is not a substitute for the entity's accounting records.
How much documentation is enough
There is no page count. Under SA 230, the form, content and extent of documentation depend on:
- the size and complexity of the entity;
- the nature of the audit procedures performed;
- the identified risks of material misstatement;
- the significance of the audit evidence obtained;
- the nature and extent of exceptions identified;
- the need to document a conclusion that is not readily apparent from the work performed; and
- the audit methodology and tools used.
Higher-risk and judgment-heavy areas need a clearer reasoning trail than routine low-risk procedures. Repetitive screenshots and duplicate client documents do not improve quality. For a smaller entity, the file is usually less extensive. Where the engagement partner performs all the work, SA 230 accepts that the file need not contain matters documented only to instruct or inform team members, and several matters can be recorded together in one document with cross-references.
What to record in each working paper
- Purpose: the assertion, risk or audit objective being addressed.
- Population and source: the report, ledger, contract or confirmation used, the period covered, and evidence that the population is complete (for example, agreed to the trial balance).
- Procedure: what was inspected, recalculated, confirmed, observed or enquired.
- Selection: the identifying characteristics of the items tested (see below).
- Evidence: the relevant support, retained or cross-referenced, without unnecessary duplicates.
- Exceptions: each difference, management's explanation, how it was corroborated and any further procedures.
- Conclusion: whether the objective was met and how any unresolved matter affects the audit.
- Sign-off: preparer and reviewer, with dates and the extent of review.
Recording identifying characteristics
SA 230's application material gives practical examples of how to identify what was tested:
- Detailed test of purchase orders: record the dates and unique purchase order numbers of the documents selected.
- All items above an amount: record the scope of the procedure and identify the population, for example all journal entries above a stated amount from the journal register.
- Systematic sampling: record the source, the starting point and the sampling interval. For example, from a sales register of 1,200 invoices, a start at invoice 17 and an interval of 40 selects 30 invoices (17, 57, 97 and so on up to 1,177). Writing those three parameters down lets a reviewer re-perform the selection exactly.
- Inquiries: record the dates of the inquiries and the names and job designations of the entity personnel.
- Observation: record the process or matter observed, the individuals involved and their responsibilities, and where and when the observation was carried out.
Worked example: a receivables confirmation difference
Fictional training example: the company, customer, staff initials, dates and references below illustrate a completed record. They are not from a real engagement and are not a prescribed ICAI format.
| Engagement and period | Illustrative Manufacturing Ltd; year ended 31 March 2026. Working paper AR-04. |
|---|---|
| Objective | Test existence and valuation of Customer C's balance, including a disputed price adjustment. |
| Population and selection | AR-01 ageing report totals Rs. 40,00,000 and agrees to the ledger control account. Customer C's balance of Rs. 5,00,000 was selected specifically because a dispute was flagged. This is one targeted item, not a representative sample. |
| Procedure and evidence | Confirmation controlled by the audit team and received directly from the customer (AR-04a) shows Rs. 4,70,000. The Rs. 30,000 difference was compared with the signed settlement dated 20 March 2026, approved credit note CN-17 and customer correspondence (AR-04b). |
| Exception | The credit note, issued before year-end, reduced the amount recoverable but had not been recorded. Management's explanation was corroborated by the settlement and the credit note. |
| Resolution | Adjustment AJ-12 and the updated ledger inspected: receivable reduced by Rs. 30,000, from Rs. 5,00,000 to Rs. 4,70,000. Receipt of Rs. 4,70,000 on 12 April 2026 traced to the bank statement and customer allocation (AR-04c). Revenue and GST effects evaluated in a separate linked working paper. |
| Conclusion | The difference on this balance is resolved after AJ-12. The exception is carried to the misstatement summary; its cause and effect on other customer balances are evaluated in AR-05. This paper does not conclude on the full Rs. 40,00,000 population. |
| Preparation and review | Prepared by P1 on 16 April 2026. Reviewed by R1 on 18 April 2026: confirmation authenticity, settlement support, posting of AJ-12 and the limited conclusion checked. Review point RP-04 closed with AR-04c. |
Notice what makes this paper review-ready: the population agrees to the ledger, the reason for selection is stated, the exception is traced to evidence rather than accepted on explanation, and the conclusion is limited to what was actually tested.
Documenting significant matters and judgments
SA 230 gives examples of significant matters: matters that give rise to significant risks; results indicating that the financial statements could be materially misstated; circumstances that cause significant difficulty in applying necessary procedures; and findings that could result in a modification of the audit opinion.
For each, the file should capture the facts considered, any contrary evidence, consultations held, and the basis for the conclusion. Typical areas are the response to a fraud indicator, an accounting estimate, whether a misstatement is material, and why contradictory evidence did not change a conclusion. A statement that a balance is "reasonable" or "not material" with no reasoning fails the experienced-auditor test. A summary of significant matters, cross-referenced to the detailed working papers, helps the engagement partner and any reviewer see the important issues in one place.
Common working-paper failures
- Client schedule without audit work: a ledger or reconciliation is filed, but the auditor's procedure is not recorded.
- Unexplained tick marks: symbols with no legend or description of what was checked.
- No link to risk or assertion: testing is performed but its audit purpose is unclear.
- Exceptions that disappear: differences are noted with no follow-up or conclusion.
- Selection not re-performable: the sample is listed but the population, start point or interval is missing.
- Review trail missing: no evidence of who reviewed what, when, or how review points were cleared.
- Dependence on oral explanation: the file makes sense only if the preparer explains it later.
File assembly, later changes and retention
The auditor must assemble the documentation in an audit file and complete the administrative process of assembling the final file on a timely basis after the date of the auditor's report. SA 230's application material states that an appropriate time limit is ordinarily not more than 60 days after that date. Assembly is an administrative process. It is not extra time to obtain the evidence the signed opinion needed.
SA 230 does not require the file to hold everything. Superseded drafts of working papers and financial statements, notes reflecting incomplete or preliminary thinking, earlier copies corrected for typographical or other errors, and duplicates need not be retained.
Once assembly is complete, the rules tighten. Under paragraph 15, the auditor shall not delete or discard audit documentation of any nature before the end of its retention period. If documentation is modified or added after assembly, the auditor must record the specific reasons and when and by whom the changes were made and reviewed.
On retention, SA 230 states that the period for audit engagements ordinarily is no shorter than seven years from the date of the auditor's report or, if later, the date of the group auditor's report. The seven-year figure comes from an ICAI Council decision of August 2009 that amended paragraph A23 of SA 230 from ten years to seven years, announced on 28 May 2010. Apply any longer period required by law or the engagement terms.
| Illustration | Date |
|---|---|
| Auditor's report signed | 20 May 2026 |
| Final file assembly ordinarily complete by (60 days) | 19 July 2026 |
| Earliest end of seven-year retention | 20 May 2033 |
For a component audit, if the group auditor's report is dated later than the component report, the seven years run from the later date. Protect the file against unauthorised change, loss and access, keep retrievable backups, and record the file-closure date so any later modification is visible.
Review-ready file checklist
- Does each important working paper state the objective and the risk or assertion it addresses?
- Are the nature, timing and extent of procedures clear?
- Can the selection be re-performed from the identifying characteristics recorded?
- Can the reviewer trace evidence to source and see how it was evaluated?
- Are exceptions and contradictory evidence visibly resolved?
- Are significant judgments supported by reasoning, with consultations recorded?
- Are preparer, reviewer, dates and review extent recorded, and review points closed?
- Was the file assembled within 60 days of the report, with later changes logged with reasons?
- Will the file stay secure and retrievable for at least seven years?
Updated on 27 September 2026: merged two duplicate SA 230 guides into this page, added SA 230's objective, definitions, full requirement list, identifying-characteristics examples with a worked sampling illustration, small-entity guidance, significant-matter examples and a dated assembly and retention illustration, verified against ICAI sources.
