Audit documentation requirements come from two frameworks: PCAOB Auditing Standard 1215 for public company audits and AU-C Section 230 for private company work under generally accepted auditing standards. Both require a written record complete enough that an experienced auditor with no prior connection to the engagement could retrace every procedure, every piece of evidence, and every conclusion. Retention runs five to seven years depending on the engagement type, and for public company audits, knowingly destroying or falsifying the file carries up to twenty years in federal prison.
What the Audit File Must Show
The working papers have to demonstrate three things: that the engagement followed applicable professional standards, that the conclusions rest on actual evidence for every relevant assertion in the financial statements, and that the underlying accounting records reconcile with the reported figures.1Public Company Accounting Oversight Board. AS 1215: Audit Documentation
A typical file starts with the overall audit strategy, which lays out how the team plans to address the risks of material misstatement. From there it branches into specific testing: schedules, confirmations, contracts, management inquiry memos, and any correspondence bearing on the conclusions. Every entry must identify who did the work, when it was completed, who reviewed it, and the date of that review.1Public Company Accounting Oversight Board. AS 1215: Audit Documentation That applies to outside specialists too, when the auditor relied on their work. Items tested must be described with enough specificity that a reviewer can identify them independently, whether by invoice number, transaction code, or account identifier.
Significant professional judgments get special attention. When a complex accounting issue comes up, the file must show how the auditor resolved it. If early evidence pointed one direction and the final conclusion went another, the auditor has to explain how that contradiction was addressed. Regulators evaluating a failed audit almost always start by reading the judgment memos.
The Experienced Auditor Standard
Both frameworks use the same benchmark for completeness. An experienced auditor with no previous connection to the engagement should be able to pick up the file and understand the nature, timing, and extent of every procedure, the results obtained, and the conclusions reached.1Public Company Accounting Oversight Board. AS 1215: Audit Documentation “Experienced” here means someone with a working understanding of audit activities who has studied the relevant industry and its accounting issues.
The standard sets a practical floor for detail. Shorthand notes that only make sense to the person who wrote them fail. So does a memo that jumps from “we tested revenue” to “revenue is fairly stated” without showing what was tested, how samples were selected, or what the results looked like.
Documentation Triggers That Get Extra Scrutiny
Materiality and Tolerable Misstatement
During planning, the auditor sets a materiality level for the financial statements as a whole, expressed as a dollar amount. That figure drives which accounts get the most testing, what sample sizes look like, and how misstatements are evaluated. The file has to document how the level was determined, including the benchmarks and factors considered.2Public Company Accounting Oversight Board. AS 2105: Consideration of Materiality in Planning and Performing an Audit
Tolerable misstatement amounts for individual accounts or disclosures sit below the overall level and factor in prior-year misstatements. Certain accounts warrant lower thresholds when a smaller misstatement could still influence investor decisions, such as related-party transactions or executive compensation disclosures. If circumstances change during the audit, the auditor must reassess and document updated materiality levels.
Substantive Analytical Procedures
When analytical procedures are used as a substantive test, the file must cover four specific items: the expected outcome and the factors used to develop it, the comparison between that expectation and the recorded amounts, any follow-up procedures triggered by significant differences, and the results of those follow-up procedures.3Public Company Accounting Oversight Board. AS 2305: Substantive Analytical Procedures Skipping any of these leaves a gap an inspection team will find immediately.
Going Concern
When conditions suggest a company might not survive the next twelve months, the requirements expand. The auditor must record the specific conditions that raised doubt, which elements of management’s survival plan the auditor considered most important, the procedures used to evaluate those plans, and whether the doubt was ultimately resolved or remains.4Public Company Accounting Oversight Board. AS 2415: Consideration of an Entity’s Ability to Continue as a Going Concern If substantial doubt persists, the file must also address effects on the financial statements and the adequacy of disclosures. Thin documentation in this area consistently leads to enforcement actions after a company collapses.
Who Owns the File
The working papers belong to the accounting firm, not the client. The client owns its own books, ledgers, and financial records; the papers the auditor creates during the engagement are the firm’s property.5Public Company Accounting Oversight Board. AU 339A Working Papers Clients can generally request copies of portions containing information ordinarily considered part of their own records.
Confidentiality is strict, but several exceptions apply. The firm has to turn over documentation in response to a valid subpoena or a regulatory request from the SEC or PCAOB. Peer reviews assessing the firm’s quality-control systems require access. Ethics investigations by a state board or the AICPA provide another pathway. And when a firm is being sold or merged, prospective buyers may review files under nondisclosure. Outside these exceptions, the confidentiality wall holds.
How Long Records Must Be Kept
Public Company Audits: Seven Years
Federal law requires accountants who audit public companies to keep all records relevant to the engagement for seven years after concluding the audit or review.6eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records The seven-year period comes from SEC Rule 2-06, which implemented Section 802 of Sarbanes-Oxley.7Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews Covered records extend well beyond traditional working papers to any correspondence, memos, communications, or electronic records created or received in connection with the audit that contain conclusions, opinions, analyses, or financial data.
Private Company Audits: Five Years
Private company documentation generally follows AICPA standards, which require retention for at least five years from the report release date. Firms can keep records longer if their own quality-control policies or state regulations demand it, and many do.
ERISA Employee Benefit Plans: Six Years
Audits of employee benefit plans subject to ERISA add another layer. Records supporting required filings must be kept for at least six years from the date the report was due or actually filed. For records tied to benefit calculations, the safer practice is to retain them until all benefits have been paid out and any audit periods have closed, since disputes over benefit amounts can surface long after an employee leaves.
The Assembly Window: 14 Days for Public Companies
After the audit report is released, the firm gets a limited window to organize and archive the documentation into a complete, final set. Under amended PCAOB standards, public company audits now have 14 days from the report release date to finalize the file, down from the previous 45-day window.1Public Company Accounting Oversight Board. AS 1215: Audit Documentation
The accelerated timeline took effect for larger firms (those issuing more than 100 audit reports for public companies in calendar year 2024) on audits of fiscal years beginning on or after December 15, 2024. All other registered firms follow the same 14-day rule for fiscal years beginning on or after December 15, 2025.8Public Company Accounting Oversight Board. PCAOB Solidifies Foundation of Every Audit With Adoption of New Standard on General Responsibilities of the Auditor In practice, virtually all public company audits in 2026 operate under the 14-day deadline. Private company audits still follow the AICPA framework, which allows 60 days from the report release date to assemble the final file.
During assembly, auditors handle clerical tasks like removing superseded drafts, cross-referencing final versions, and confirming the file is properly indexed. Once the window closes, the file is locked.
What Can Be Changed After the File Is Locked
After the documentation completion date passes, the file is treated as a permanent record. No existing documentation may be deleted or discarded for any reason.9Public Company Accounting Oversight Board. AS 1215: Audit Documentation – Appendix A If new information surfaces that requires an addition, the addition must include the date it was added, the name of the person who prepared it and the person who reviewed it, and the reason for the addition.1Public Company Accounting Oversight Board. AS 1215: Audit Documentation
The prohibition on discarding is absolute. Even if a superseded document is replaced by updated work performed after the report date, the original stays. Firms typically enforce this through audit management software that maintains version history and prevents overwrites.
Criminal Penalties for Destruction or Tampering
Two overlapping federal statutes apply. 18 U.S.C. § 1520 directly targets accountants: anyone who conducts a public company audit and knowingly fails to maintain the required records faces fines and up to ten years in prison.10Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records The statute reaches both active destruction, such as shredding documents, and passive failure to maintain records for the required period.
18 U.S.C. § 1519 is broader and harsher. It covers anyone who knowingly destroys, alters, or falsifies any record with the intent to obstruct a federal investigation or proceeding, with a maximum of twenty years in prison.11Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations Section 1519 doesn’t require the person to be an accountant or the records to be audit workpapers. A company executive who orders the deletion of emails relevant to an audit could face charges. Both statutes were enacted as part of Sarbanes-Oxley, and the SEC and Department of Justice have shown a consistent willingness to use them when audit documentation goes missing.