Audit documentation is more than a file assembled after fieldwork. Under SA 230, it is the record that supports what the auditor did, the evidence obtained and the conclusions reached. A well-built file should allow an experienced auditor, with no previous connection to the engagement, to understand the nature, timing and extent of procedures, their results, the audit evidence obtained, significant matters and the professional judgments used in reaching conclusions.
What counts as audit documentation?
ICAI's SA 230, Audit Documentation explains that documentation can exist on paper, electronically or on other media. Examples include audit programmes, analyses, issues memoranda, summaries of significant matters, confirmation and representation letters, checklists and correspondence about significant matters. Copies or abstracts of important client contracts may also form part of the file, but the audit file is not a substitute for the client's accounting records.
This distinction matters in practice. Simply saving a ledger, invoice or client-generated schedule does not document the audit procedure. The working paper should normally show why the item was tested, what procedure was performed, who performed and reviewed the work, what exceptions arose and how the auditor concluded on them.
What should an experienced auditor be able to understand?
The central test is usability by an experienced auditor who had no prior connection with the engagement. The file should make the audit trail understandable without depending on the memory of the engagement team. ICAI also provides a practical Implementation Guide to SA 230 for applying the documentation requirements.
- Procedure: What exactly was inspected, recalculated, confirmed, observed or analysed?
- Population and selection: Which records were covered and how were tested items selected?
- Evidence: What documents or other evidence supported the result?
- Exceptions: What differences, control failures or contradictory evidence were found?
- Judgment: Why was the exception accepted, escalated or treated as an audit adjustment?
- Conclusion: How did the work address the relevant assertion or audit objective?
A practical working-paper structure
A useful working paper can be built around six blocks: objective, source or population, procedure, evidence, exceptions, and conclusion. Add preparer and reviewer identification and relevant dates. Cross-reference the paper to the audit programme, financial-statement area and supporting evidence so another reviewer can follow the trail in both directions.
Worked illustration: trade receivables
Assume the auditor is testing existence of year-end trade receivables. A weak file may contain only a customer ageing and a note saying 'checked'. A stronger file identifies the receivables population, explains the selection basis, records confirmation requests or alternative procedures, captures differences between confirmations and books, documents management explanations and corroborating evidence, and concludes whether the results affect the receivables balance or wider risk assessment. If an exception is resolved using subsequent receipts, the file should identify the bank evidence and invoice being matched rather than merely state that the balance was verified.
Significant judgments need their reasoning
Documentation becomes especially important when the conclusion is not obvious from the evidence. Examples include why a control deficiency was or was not considered significant, why an accounting estimate was accepted despite a wide estimation range, why contradictory evidence did not change a conclusion, or why a potential related-party relationship was resolved in a particular way. The file should preserve the reasoning that connects evidence to conclusion, not just the final answer.
SA 230 also makes clear that oral explanations, on their own, are not adequate support for work performed or conclusions reached. They may explain or clarify information already contained in the documentation, but they do not replace the underlying record. This is one reason review notes should be cleared by improving the permanent engagement record rather than relying on later recollection.
What does not need to clutter the final file?
More pages do not automatically mean better documentation. SA 230 indicates that the auditor need not retain superseded drafts of working papers and financial statements, notes reflecting incomplete or preliminary thinking, previous copies corrected only for typographical or similar errors, or duplicates. The goal is a coherent evidential record, not an archive of every intermediate file created during the engagement.
Documentation should reflect the engagement, not a template
The form and extent of documentation depend on factors including the size and complexity of the entity, nature of audit procedures, identified risks of material misstatement, significance of evidence obtained, nature and extent of exceptions, the need to document conclusions that are not readily apparent, and the audit methodology and tools used. A checklist can improve consistency, but it cannot replace engagement-specific thinking.
ICAI's current Auditing, Review and Other Standards resources lists SA 230 within the Standards on Auditing framework. Teams should therefore connect documentation to the other standards actually driving the work—for example risk assessment, responses to assessed risks, audit evidence, sampling, estimates, related parties or going concern—rather than treating SA 230 as a stand-alone administrative requirement.
Common documentation failures
- Attaching evidence without recording the procedure performed on it.
- Using ticks or initials whose meaning is not defined.
- Recording a conclusion without explaining a significant judgment behind it.
- Leaving exceptions unresolved or relying only on management's verbal explanation.
- Failing to identify the specific items tested when the procedure relates to selected documents or transactions.
- Keeping generic prior-year narratives that no longer match the current-year process or risks.
- Completing documentation long after the work, when details and rationale are harder to reconstruct accurately.
A review-ready file checklist
- Can a reviewer identify the audit objective and assertion addressed?
- Is the population or source data identifiable and reconcilable where relevant?
- Are the nature, timing and extent of procedures clear?
- Can the reviewer identify the specific items tested?
- Are evidence and exceptions cross-referenced?
- Are significant judgments and contradictory evidence explained?
- Does the conclusion logically follow from the documented work?
- Are preparation and review responsibilities evident?
- Have obsolete drafts and unnecessary duplicates been excluded from the final file?
Practical takeaway
A strong audit file tells the story of the engagement from risk to procedure, evidence, exception, judgment and conclusion. The best test is not whether the file is large, but whether an experienced auditor unfamiliar with the engagement can understand what was done and why the conclusion is supportable. Use SA 230 and ICAI's implementation guidance as the baseline, then make every working paper specific enough to stand on its own during review.
