An audit file may contain an engagement letter, an audit plan and a management representation letter, sometimes filed together. Each answers a different question. The engagement letter records the terms agreed with management or those charged with governance. The audit plan explains how the auditor intends to respond to assessed risks. The representation letter records management's written statements near the reporting date. Having one of these documents on file does not make up for a missing or inadequate other document.
Four questions separate them quickly. What are the engagement terms? What work will the audit team perform? What is management confirming in writing? What documentation shows how the auditor reached the final conclusion?
The three documents on one audit timeline
| Document | Main standard | When it belongs | What it does | Whose document is it? |
|---|---|---|---|---|
| Audit engagement letter | SA 210 | At acceptance or continuation, before the audit proceeds on an unclear basis | Records the agreed objective, scope, responsibilities, reporting framework and expected reporting basis | The auditor records the agreed terms; management or those charged with governance agree to the terms |
| Overall audit strategy and audit plan | SA 300 | During planning and then updated as the audit develops | Sets the audit's direction and translates risks into the nature, timing and extent of procedures | Auditor's planning documentation |
| Management representation letter | SA 580 | As near as practicable to, but not after, the auditor's report date | Provides written representations from management on required matters and other relevant assertions | Management representation addressed to the auditor |
These documents are connected, but the connection is sequential rather than interchangeable. A clear engagement letter defines the audit relationship. A risk-based plan decides how the work will be performed. The written representations record management's statements; they do not replace the other evidence needed to support the opinion. The broader audit file then shows the procedures, evidence, judgments and conclusions that support the opinion.
SA 210 fixes the basis on which the audit is accepted
SA 210 on agreeing audit engagement terms requires the auditor to agree the terms of the engagement with management or those charged with governance, as appropriate. Subject to the standard's exceptions, those terms are recorded in an engagement letter or other suitable written agreement. The standard identifies core matters that belong there: the objective and scope of the audit, the auditor's responsibilities, management's responsibilities, the applicable financial reporting framework, and a reference to the expected form and content of the auditor's reports.
That document therefore answers a boundary question: what audit have we agreed to perform, on what basis, and who is responsible for what? It does not decide the sample size for receivables, the timing of inventory testing or which revenue assertions need extra work. Those are planning and execution questions.
For a first-time appointment, the acceptance process also requires the auditor to consider whether the preconditions for an audit are present. On a recurring audit, SA 210 requires the auditor to assess whether circumstances require the terms to be revised or whether management should be reminded of the existing terms. If the client asks for a change in the engagement terms, the auditor must evaluate whether there is reasonable justification rather than simply replacing the letter. A fuller walkthrough of the document itself is available in the guide to an audit engagement letter under SA 210.
Planning turns assessed risk into procedures
Once the engagement basis is clear, planning becomes the working question. SA 300 on planning an audit requires an overall audit strategy that sets the scope, timing and direction of the audit and guides development of the audit plan. Compared with the overall strategy, the plan is more detailed. It describes the nature, timing and extent of planned risk-assessment procedures, further audit procedures at assertion level, and other procedures needed to comply with the Standards on Auditing.
That makes the audit plan very different from the engagement letter. The client does not use it to agree commercial or professional terms. Audit teams use the plan to decide what evidence they need and how they will obtain it. If revenue recognition is assessed as a higher-risk area, the plan might call for focused cut-off work, testing of manual journal entries, inspection of unusual contracts and procedures over post-year-end credit notes. If inventory is material and spread across locations, the plan may allocate attendance, test-count and roll-forward procedures by location and date.
SA 300 also requires the strategy and plan to be updated and changed when necessary during the audit. A plan copied from last year's file and never revisited is not made adequate merely because it has a current-year header. New risks, control failures, unexpected misstatements or changes in the business may require different procedures or more work. The separate guide on building an overall audit strategy and detailed audit plan explains that risk-to-procedure link in more depth.
Written representations belong near the report date
Management's representation arrives much later in the audit cycle. SA 580 on written representations requires specified written representations from management and may require additional representations where other standards or the circumstances call for them. The standard also says the representations should be dated as near as practicable to, but not after, the date of the auditor's report and should cover all financial statements and periods referred to in that report.
This timing is deliberate. Management is being asked to confirm matters after the audit has substantially developed and with the financial statements in their final reporting context. Obtaining a broad representation at the start of fieldwork cannot replace the final SA 580 representation because facts, adjustments and disclosures may change before the report is signed.
Written representations are audit evidence, but they are not a shortcut around other evidence. A representation that all receivables are recoverable does not remove the need to test subsequent receipts, ageing, disputes or other relevant evidence. A statement that all liabilities have been recorded does not eliminate the need for search-for-unrecorded-liabilities procedures. The detailed management representation letter guide under SA 580 covers who should provide the representations, dating and what to do when management refuses or the representations conflict with other evidence.
SA 230 explains why all three belong in a reviewable file
SA 230 on audit documentation sets an experienced-auditor test for the file. The documentation should show the nature, timing and extent of procedures performed, the results and evidence obtained, and significant matters, conclusions and professional judgments. That requirement helps explain the role of each document in the file.
- Engagement terms document the agreed audit relationship and responsibilities.
- Strategy and planning papers document how the auditor intends to respond to the engagement's risks and requirements.
- Management representations document specified written statements obtained near reporting.
- The remaining working papers show what was actually performed, what evidence was obtained, what exceptions arose and how the team concluded.
A signed engagement letter cannot prove that planned procedures were performed. A detailed audit plan cannot prove that management accepted its responsibilities. A representation letter cannot prove that the underlying balances were tested. Review-ready documentation requires the chain to be visible rather than one document being stretched beyond its purpose. The guide to review-ready working papers under SA 230 shows how to record that chain at procedure level.
Following the documents through one company audit
Consider a manufacturing company with a 31 March 2026 year-end. Its new statutory auditor was appointed at a September 2025 annual general meeting, and the audit report is expected in late August 2026. The dates illustrate the audit work, not statutory appointment or filing deadlines.
- September 2025: The auditor completes acceptance and independence considerations and agrees written engagement terms with the appropriate party, including the scope of the audit and management's responsibilities.
- October 2025: The team develops its strategy and audit plan. Revenue cut-off, inventory quantities and related-party transactions receive attention based on the entity's circumstances and the risks assessed.
- 31 March 2026: Year-end procedures include the planned inventory-count work, where applicable, and other tests directed at balances and transactions around the reporting date.
- May to July 2026: A possible dispatch cut-off problem emerges. The team revisits its risk assessment, changes the planned procedures where necessary and documents both the additional work and the reason for it.
- Late August 2026: After the financial statements, proposed adjustments and audit evidence have been evaluated, management provides the required written representations dated as near as practicable to, but not after, the auditor's report date. The auditor signs the report only after reaching and documenting the required conclusions.
The engagement terms are not renegotiated every time an audit sample changes. Nor does asking management to sign an audit plan establish that planned procedures were carried out. Each document has its own purpose.
A sales cut-off problem shows why the distinction matters
Imagine that a sale was recorded on 31 March although the goods were dispatched on 2 April. That difference needs investigation, but dispatch date alone does not settle the accounting treatment. The auditor has to consider the contract, delivery conditions, evidence of when control transferred and the applicable financial reporting framework.
The engagement letter already records the agreed scope and responsibilities; discovering this transaction does not, by itself, require a new letter. The audit plan may need to change. The team could extend its March and April cut-off testing, compare invoices with dispatch and customer acceptance records, inspect subsequent credit notes and examine relevant manual journal entries. The file should explain why those procedures were added.
What was actually tested belongs in the working papers: the items selected, documents inspected, exceptions found and conclusions reached. If the auditor identifies a misstatement, the file also records how any correction or uncorrected difference was evaluated. The management representation letter supplies the required written confirmations about management's responsibilities and the information provided to the auditor. It cannot make up for missing transaction-level evidence.
A reviewer should be able to trace this issue from the risk assessment and revised audit plan to the work performed and the conclusion. The mere presence of three documents, even neatly signed and filed, does not establish that trail.
Use this decision test when a file document is unclear
- If the question is "What have the auditor and management agreed about the engagement?", start with SA 210 and the engagement terms.
- For "What audit procedures should we perform, when, and to what extent?", use the SA 300 planning process and related working papers.
- For "What must management confirm in writing near the reporting date?", look to SA 580 and other standards that require specific representations.
- For "Can a reviewer understand what we did, what we found and why we concluded this way?", SA 230 documentation is the broader test.
Five file errors that create avoidable audit gaps
1. Signing the engagement letter after substantial fieldwork. The document is supposed to establish the agreed basis of the engagement. Late paperwork weakens that purpose and can hide unresolved scope or responsibility issues.
2. Treating the planning memo as a static annual template. SA 300 expects the strategy and plan to respond to the engagement and to change when necessary. Current-year risks should drive current-year procedures.
3. Asking management to sign the audit plan. Management can provide information relevant to planning, but the audit strategy and plan are the auditor's professional response to risk, not a management confirmation document.
4. Using the representation letter instead of substantive evidence. A written confirmation can support the file, but it does not replace procedures needed to obtain sufficient appropriate audit evidence on the underlying assertion.
5. Dating the representation letter after the auditor's report. SA 580 requires the date to be as near as practicable to, but not after, the report date. If a representation was obtained materially earlier and relevant matters changed, the auditor should consider whether an updated representation is needed.
A strong file lets a reviewer follow the chronology without asking the engagement team to reconstruct it from memory. The terms were agreed, the audit was planned from risk, the plan changed when evidence demanded it, management gave the required written representations, and the working papers show how the final opinion was supported.
