Audit documentation and working papers

ISA (UK) 230 requires an auditor to record the procedures performed, the evidence obtained and the conclusions reached in enough detail that an experienced auditor with no previous connection to the audit could understand them. In the UK the final audit file must be assembled within 60 days of the date of the auditor’s report, and audit documentation must then be kept for at least six years from that date under ISQM (UK) 1 and the professional bodies’ audit regulations.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What counts as audit documentation?

ISA (UK) 230 defines audit documentation as the record of audit procedures performed, relevant audit evidence obtained and conclusions the auditor reached, adding that “working papers” or “workpapers” are other names for it. A UK addition to the definition says it must include all documents, information, records and other data required by ISQM (UK) 1, the ISAs (UK) and applicable law and regulation. The audit file is the folder or electronic storage that holds those records for one engagement.

Paragraph A3 gives examples: audit programmes, analyses, issues memoranda, summaries of significant issues, confirmation and representation letters, checklists and correspondence, including email, on significant issues. Copies of the client’s contracts may be included, but the documentation is not a substitute for the entity’s own accounting records. Paragraph A4 says superseded drafts, preliminary notes, corrected copies and duplicates need not be kept.

What must the file show?

The core test is in paragraph 8. The documentation must be sufficient for an experienced auditor, having no previous connection with the audit, to understand:

the nature, timing and extent of the procedures performed to comply with the ISAs (UK) and legal requirements;
the results of those procedures and the evidence obtained; and
significant issues arising, the conclusions reached on them and the significant professional judgements made.

A UK addition requires the auditor also to retain any other data and documents important in supporting the auditor’s report. Paragraph 9 requires the file to record the identifying characteristics of items tested, who did the work and when, and who reviewed it, when and to what extent. Paragraph 10 requires discussions of significant issues with management and those charged with governance to be recorded, including when and with whom they took place. Paragraph 11 requires the auditor to record how any information inconsistent with a final conclusion on a significant issue was dealt with.

Other standards add their own documentation points, and an appendix to ISA (UK) 230 lists them. Examples include the risk assessment under ISA (UK) 315, materiality under ISA (UK) 320 and the work on group audits and component auditors under ISA (UK) 600.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

When must the documentation be prepared?

Paragraph 7 requires documentation to be prepared on a timely basis. Paragraph A1 explains why: notes written after the work has been done are likely to be less accurate than those made at the time, and timely documentation lets reviewers challenge conclusions before the report is signed. All the documentation of the work done and evidence obtained should therefore exist at the date of the auditor’s report.

What happens after the auditor’s report is signed?

Paragraph 14 requires the auditor to complete the administrative assembly of the final audit file on a timely basis, and adds that in the UK assembly must be completed no later than 60 days from the date of the auditor’s report. Assembly is administrative only. Paragraph A22 lists acceptable changes during that window, such as deleting superseded documents, sorting and cross referencing working papers, signing off completion checklists, and documenting evidence that was obtained and agreed with the team before the report date. New audit procedures and new conclusions are not part of assembly.

Once assembly is complete, paragraph 15 prohibits deleting or discarding documentation of any kind before the end of the retention period. If something has to be added or changed later, for example to clarify the file after comments from a monitoring review, paragraph 16 requires the auditor to record the specific reasons and when and by whom the changes were made and reviewed. Where, exceptionally, new procedures are performed or new conclusions are reached after the report date, paragraph 13 requires the circumstances, the work and its effect on the report to be recorded.

ICAEW has warned that its quality assurance visits sometimes find files that were never properly assembled or that cannot be found. It suggests every firm has a written assembly policy, that firms consider a deadline tighter than 60 days, and that electronic files are locked so that changes are logged with date and time stamps.

How long must audit files be kept?

The international text in ISA (UK) 230 says the retention period is ordinarily no shorter than five years. The UK position is longer:

ISQM (UK) 1, the UK paragraph added after paragraph 60. For audits of financial statements, firms must have policies requiring retention for at least as long as data protection law and any administrative or judicial proceedings require, and in any case not less than six years from the date of the auditor’s report.
ICAEW Audit Regulations, regulation 3.11. A registered auditor must keep all audit working papers that auditing standards require for at least six years, starting with the date of the auditor’s report. The papers may be held digitally, provided the firm keeps a way of accessing them.

ICAEW’s guidance adds that firms should make a final decision before destroying any file, keep it where in doubt, keep a record of what has been destroyed, and remember that some papers may serve another purpose, such as tax, with a longer retention period. Data protection law also applies. For the wider question of how long practices keep non audit files, see client file retention.

What if another firm does part of the work?

Regulation 3.12 of the ICAEW Audit Regulations requires a registered auditor that subcontracts audit work to arrange either for the other firm’s working papers to be returned, or for that firm to keep them for the same period and give the auditor unrestricted access. For group audits where a component is audited by a firm from a third country, regulation 3.13 requires arrangements so the papers can be obtained if the FRC or a monitoring unit asks for them. ISA (UK) 600 contains matching UK requirements on the group auditor.

When the auditor changes, the successor may ask to see relevant working papers. ICAEW’s guidance on this says requests should be as specific as possible rather than a request for everything, and that the predecessor should give access to permanent or systems files as well as the current file.

How does this apply to a small audit?

Paragraph A16 accepts that documentation for a smaller entity is generally less extensive. Where the engagement partner does all the work, there is nothing to record about team briefings or review by others. The paragraph 8 test still applies, because the file may be reviewed by external parties. Paragraph A17 suggests recording the understanding of the entity, strategy and plan, materiality, assessed risks and significant issues together in one document with cross references.

Illustration only. A sole practitioner signs the auditor’s report for a small company on 15 March 2027.

All testing, review and conclusions are on file before signing.
The final file must be assembled by 14 May 2027, the 60th day after the report date.
The assembled file is locked, or a paper file is dated and stored securely.
It is kept until at least 15 March 2033 before a documented destruction decision is made.

What are the common mistakes?

Recording conclusions with no evidence of the procedures behind them, so a reviewer cannot follow the work.
Leaving sign offs and review notes to be tidied up after the report, which turns assembly into undocumented audit work.
Missing the 60 day deadline or having no evidence of when the file was closed.
Keeping electronic files in open folders where anyone can change documents or time stamps.
Applying the international five year figure instead of the UK six year minimum.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.