Every audit opinion rests on documentation, and when questions come up from a reviewer, a regulator, or a client, the file is what answers them. Not the auditor’s memory of what was done, and not the quality of the underlying work. The record either supports the conclusion or it doesn’t.

The standards governing workpapers are well established and haven’t changed much in recent years. However, the environment around workpapers has. 

There is more engagements, more complex evidence, and inspection scrutiny that increasingly treats documentation gaps as audit failures, regardless of what the work itself looked like. 

This guide covers what audit workpapers are, the standards that govern them, how to structure your files, what good documentation actually looks like, and where most teams fall short.

What Are Audit Workpapers?

Audit workpapers — also called audit working papers, audit documentation, or audit files — are the complete record of evidence obtained, procedures performed, and conclusions reached during an engagement. They support the audit opinion, demonstrate compliance with auditing standards, and give partners and third-party inspectors a clear basis for review.

Working papers belong to the auditor, not the client. Both ISA 230 and AU-C Section 230 impose confidentiality obligations on this documentation. Auditors are responsible for maintaining and protecting it accordingly.

The Standards Governing Audit Workpapers

Three frameworks govern audit documentation, depending on the engagement type.

ISA 230 / AU-C Section 230 

ISA 230 and AU-C Section 230 the foundational international and US requirements for the form, content, and retention of audit documentation. 

The standard’s central test, the “experienced auditor” standard, requires that documentation be sufficient to allow an experienced auditor with no prior connection to the engagement to understand what was done, why, and what was concluded. 

PCAOB AS 1215 

PCAOB AS 1215 applies to audits of public companies and carries stricter requirements around completion, assembly, and retention. Under current rules, auditors have 45 days after the report release date to assemble a complete and final set of documentation. Amended rules effective December 15, 2025, shorten that window to 14 days. The change means that documentation disciplines should be built into the workflow, not assembled under pressure after the fact. 

Retention for public company audits is seven years from the report release date. Under AICPA standards for nonissuers, the minimum is five years.

IIA Practice Advisory 2330-1 

IIA Practice Advisory 2330-1 applies similar principles to internal audit documentation, with the same emphasis on sufficiency, completeness, and defensibility.

The common thread across all three is that the file must stand on its own. A reviewer with no background on the engagement should be able to follow the logic from objective to conclusion.

Current Files vs. Permanent Files: What Goes Where 

A well-organized audit file has a clear structure. Most practitioners work with two primary categories.

  • The current file contains everything specific to the current engagement period: planning memos, risk assessments, materiality calculations, audit programs, evidence, review notes, representation letters, and the final audit report. This is the file that changes each year and gets assembled, reviewed, and locked following the engagement.
  • The permanent file is retained across engagements. It holds standing information that doesn’t change year to year: articles of incorporation, long-term contracts, prior-year financial statements, accounting policy summaries, key agreements covering leases, pensions, and debt instruments, and org charts.

Permanent file maintenance is often the first thing that slips when teams are busy. Outdated permanent files create real review risk and cost time that could have been spent on the actual work.

Some firms also maintain a working or general file for in-progress assessments, impact analyses for new standards, and cross-period evaluations, particularly useful when accounting standards are in transition.

What Every Audit Work Paper Needs to Include

Regardless of the procedure or engagement type, a well-prepared workpaper has consistent structural elements:

  • Header information: client name, period, engagement reference, preparer, date prepared, reviewer, and date reviewed
  • Objective: what the workpaper is designed to demonstrate or test
  • Procedures performed: specific steps taken, sampling methodology, and evidence inspected
  • Evidence obtained: source documents referenced or attached, cross-referenced to the audit file
  • Findings and exceptions: any exceptions noted, assessed impact, and resolution
  • Conclusion: an explicit statement of whether the objective was met
  • Sign-off: preparer and reviewer initials or signatures, with dates

The guiding principle: a workpaper should be self-contained. Anyone picking it up cold should be able to follow the logic from objective to conclusion without a single clarifying question.

Common Audit Work Paper Deficiencies and What They Signal to Inspectors

PCAOB inspection findings regularly cite documentation deficiencies even when the underlying audit work was sound. In 2023, 46% of PCAOB-inspected engagements had at least one Part I.A deficiency, a figure that dropped to 39% in 2024 – an improvement the PCAOB acknowledged, while also calling the overall rate unacceptably high. Inspectors evaluate not only whether the work was done, but whether the file proves it. Those are different questions.

Common audit work paper deficiencies include: 

  • Completeness. All planned procedures should be documented and signed off. Missing sign-offs and undated reviews are administrative gaps. 
  • Clarity. An experienced auditor with no prior connection to the engagement should be able to follow a workpaper from objective to conclusion without asking questions. A workpaper with no clear objective leaves reviewers guessing about what was being tested and why.
  • Support for conclusions. Every conclusion needs to show its work. Stating “no exceptions noted” without documenting what was reviewed is one of the most common deficiencies cited in inspections. The conclusion is only as strong as the evidence behind it.
  • Linkage. Evidence should connect logically to the conclusion, and workpapers should cross-reference the audit program, lead schedules, and final report. Files that exist in isolation signal a documentation process that wasn’t integrated into the workflow.
  • Timeliness. Workpapers completed close to the date of the work carry more credibility than files assembled at the end of busy season. Late assembly creates inspection risk, and it shows. The PCAOB’s move to shorten the assembly period from 45 days to 14 days makes this expectation explicit.
  • Professional skepticism. Documentation should reflect that the auditor considered alternative explanations and pushed back where appropriate. A file that reads as entirely confirmatory, with no evidence of challenge or judgment, is a red flag for reviewers.
  • Proportionality. Over-documentation is a real problem. Assembling every available piece of paper without demonstrating professional judgment can obscure conclusions rather than support them. More paper isn’t the same as better evidence.

The review must be documented too. Reviewer initials, dates, and resolution of any open notes. For inspection purposes, an undocumented review is no review at all.

What Auditable AI Means for Audit Work Paper Documentation

The audit file has always been the record of what happened. What’s changing is how that record gets built.

For most teams, working paper documentation is still a manual process: pulling evidence from client portals, copying data into spreadsheets, formatting lead schedules, and assembling the file at the end of busy season under significant time pressure. The conclusions may be sound. The documentation often doesn’t reflect that.

From paper-based assembly to connected documentation

Connected audit platforms enforce consistent formatting across the engagement, automate cross-references between lead schedules, audit programs, and workpapers, and give reviewers real-time access to the file as work progresses. Version control matters here in ways it rarely gets credit for. 

In a paper-based environment, superseded workpapers create confusion and risk. In a structured digital environment, every revision is tracked, every change is dated, and the history of the file is part of the file.

Traceability as a documentation standard

One of the most persistent inspection findings isn’t that auditors didn’t do the work. It’s that the file doesn’t prove it.

Audit platforms that link source documents directly to working paper conclusions change that equation. 

When a revenue transaction is selected for testing, the source invoice, the matching data extract, and the testing conclusion all sit in the same record. The reviewer can trace the logic without asking questions. An inspector can follow the file without a guided tour. That traceability is what makes the documentation defensible.

What auditable AI actually means in the working paper context

When AI assists with evidence extraction, transaction testing, or anomaly identification, that assistance needs to show up in the file the same way any other procedure would. The auditor still owns the conclusion. The AI-assisted process still needs to be documented: what was tested, how the AI was applied, what the output showed, and how the auditor evaluated it.

Auditable AI means the output wasn’t built in a black box. Every AI-assisted step traces back to source evidence, operates within defined parameters, and is subject to auditor review before it becomes part of the record. The strongest implementations go further, pulling directly from current auditing standards during workflow execution, not as a reference layer, but as part of how testing logic is built and applied.

The standard hasn’t changed: documentation must be sufficient for an experienced auditor with no prior connection to the engagement to understand what was done, why, and what was concluded. A well-designed platform helps teams meet it more consistently.

Trullion

Trullion connects data extraction, substantive testing, and working paper documentation into seamlessworkflows, so teams aren’t manually assembling the evidence trail after the fact. Every AI-assisted output is traceable to source evidence and subject to auditor review, giving firms a defensible, inspection-ready record of how conclusions were reached.

Book a demo to see how Trullion supports audit documentation from ingestion to sign-off.

FAQs

What is the difference between audit workpapers and audit documentation? 

“Workpapers,” “audit documentation,” and “audit files” all refer to the complete written record of an engagement, evidence obtained, procedures performed, and conclusions reached. The terms are used interchangeably across standards and in practice.

Who owns audit working papers? 

The auditor, not the client. This is a consistent principle across ISA 230, AU-C Section 230, and PCAOB AS 1215. Auditors carry confidentiality obligations that govern how documentation is stored, accessed, and shared.

How long do auditors need to keep working papers? 

It depends on the engagement type. AICPA standards for nonissuers require a minimum of five years. PCAOB AS 1215 for public company audits requires seven years from the report release date, or from the date fieldwork was substantially completed if no report was issued.

What happens to working papers during a PCAOB inspection? 

Inspectors review the actual audit file to evaluate whether procedures were performed as documented and whether the evidence supports the conclusions reached. Documentation deficiencies can result in Part I.A findings even when the underlying audit work was adequate, because inspectors can only evaluate what the file contains.

Can audit working papers be subpoenaed? 

Yes. Audit documentation can be subpoenaed in legal proceedings. That’s another reason accurate, well-organized, complete documentation matters beyond regulatory compliance. At some point, the file may need to stand up somewhere other than an inspection room.

Author

Katie Cavanaugh