What's changed: Initial version
3.4Preparing, reviewing, and retaining audit working papers
Covers the requirements that audit working papers—the record of audit execution that backs the basis for conclusions—must meet (that a third party can trace and reproduce the procedures performed, evidence obtained, and conclusions reached), how review by a superior secures audit quality, and the need for retention for a set period and for confidentiality—viewing the working papers as determining the evidential force of the audit itself.
Without records to back it up, an audit conclusion becomes a matter of "whoever spoke wins." Audit working papers are documents that record which procedures the auditor performed, which evidence was obtained, and how the conclusions were reached—the foundation that underpins the audit's evidential force. This section covers why working papers must be made in a form a third party can trace and reproduce, how review by a superior secures quality, and why retention and confidentiality are necessary, alongside practical judgments.
3.4.1Requirements of audit working papers
- Audit working papers must record the audit procedures performed, the audit evidence obtained, and the conclusions reached, documented sufficiently and clearly enough that a third party not involved in the audit (another auditor or reviewer) can trace the content and reproducibly reach the same conclusion.
- Working papers must retain not just the conclusion but the basis for reaching it (how which evidence supports the conclusion). Findings are recorded so that the fact, condition, impact (risk), cause, and recommendation can be confirmed later. Poor working-paper quality shakes the evidential force of the report's findings.
3.4.2Review and retention
- Review is a quality-control mechanism in which a superior or audit manager, different from the auditor who prepared the working papers, inspects them and confirms the appropriateness of procedures, the sufficiency of evidence, and the logical consistency of the conclusions. Going through review lets the organization correct individual auditors' bias or insufficient evidence, securing the overall quality and objectivity of the audit.
- Retention: working papers are retained appropriately for a set period as audit evidence and in preparation for future follow-up, re-audits, or external requests for explanation. At the same time, since they contain the audited department's confidential information, access restriction and confidentiality management is essential, and disposal follows the defined retention period and procedures.
Most-tested: "audit working papers record procedures, evidence, and conclusions clearly enough for a third party to trace and reproduce," "review is quality control in which a superior different from the preparer inspects them and confirms evidence sufficiency and conclusion consistency," and "working papers are retained for a set period and require confidentiality and access restriction." Remember that working papers retain not just the conclusion but the basis for reaching it, and that review is done by a different superior, not by self-inspection.
A member of an audit team, responsible for auditing access-management controls, wrote the finding "privileged-ID inventory reviews are not performed quarterly" into a draft report. When the audit manager reviewed these working papers, he noticed that they recorded only the conclusion—"the inventory review was not performed"—but did not record the evidence supporting that conclusion (what was confirmed for which period, and the basis for judging it was not performed). As a result, a third party not involved in the audit later (another auditor, or the person the auditor must explain to if the audited department pushes back) could look at the working papers but could not trace or reproduce the fact of the finding, shaking its evidential force. The reviewer therefore instructs the auditor to add to the working papers the period of the inventory records checked, the specific quarters where records were actually missing, and the evidence used (whether inventory-execution records existed, and the results of confirmation with the responsible manager). This is a textbook case of review correcting an individual auditor's insufficient evidence organizationally and securing audit quality. Furthermore, since these working papers also become the starting point for next year's follow-up confirming "whether the inventory was corrected," and given that they contain highly confidential information such as privileged IDs, they are retained appropriately for a set period under access restriction. Working papers retain not just the conclusion but the basis for it in a form a third party can trace, and quality is secured by going through review—this is the correct practice for ensuring the evidential force of working papers. Having an auditor confirm his own working papers alone and call them complete is an error that lacks the objectivity that review provides.
Trap: "It is enough to write only the final conclusion concisely in working papers; the evidence and procedures leading to it need not be recorded" is wrong—working papers must retain the procedures performed and the evidence supporting the conclusion so a third party can trace and reproduce them; without that, the finding loses its evidential force. Also wrong: "it is enough for the auditor who prepared the working papers to review them himself"—review must be done by a superior or audit manager different from the preparer to correct bias and secure objectivity.
3.4.3Section summary
- Audit working papers record the procedures performed, evidence obtained, and conclusions clearly enough for a third party to trace and reproduce, retaining the basis for the conclusion
- Review is quality control in which a superior other than the preparer inspects procedure appropriateness, evidence sufficiency, and conclusion consistency; self-inspection cannot substitute for it
- Working papers are retained appropriately for a set period under confidentiality and access restriction, in preparation for future follow-up and re-audits
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. On reviewing the working papers, an audit manager finds only the conclusion "privileged-ID inventory not performed" recorded, with no record of the period checked or the evidence behind the judgment. What is the most appropriate action for the reviewer?
Q2. Which is the most appropriate purpose of reviewing audit working papers?
Q3. Which statement about handling the audit working papers of a completed audit is most appropriate?