Audit documentation requirements set the rules for what auditors must record, how quickly they have to lock the file, how long they must keep it, and who can see it. A compliant working paper file has to be detailed enough that an experienced auditor with no prior connection to the engagement can reconstruct the nature, timing, and results of every procedure, the evidence gathered, and the conclusions reached. For public company audits, the complete file has to be archived within 14 days of the report release date and retained for at least seven years. Private company audits get 60 days to assemble and a minimum of five years to retain. Miss the standards on content, assembly, or retention and the consequences run from a censure to 20 years in federal prison.
What Must Be In the File
Two frameworks govern the content, depending on who was audited. Public companies fall under the Public Company Accounting Oversight Board’s Auditing Standard 1215. Private (nonissuer) engagements fall under AU-C Section 230 from the American Institute of CPAs. Both apply the same core test: an uninvolved reviewer must be able to follow the auditor’s reasoning from start to finish using only the file. If the documentation needs oral explanation to make sense, it fails.1Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
At the procedure level, the file has to record the nature, timing, and extent of every step performed. That means identifying the specific items tested, such as individual invoices, bank confirmations, or lease agreements, and noting the date the work happened. Every entry must show who performed the procedure and who reviewed it.1Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
Significant findings need their own detailed write-ups. When the team discovers an inventory discrepancy, an unrecognized liability, or a misstatement management chose not to correct, the file must explain how the issue was identified, what the team did about it, and how it affected the overall conclusion. Uncorrected misstatements get particular scrutiny: the auditor has to record which account was affected, the dollar amount involved, and whether the errors are material individually or in the aggregate.2PASAI. International Standard on Auditing 450 – Evaluation of Misstatements Identified During the Audit
Supporting calculations for items like depreciation, interest expense, or revenue recognition should be attached to the relevant work paper so anyone reviewing the file can verify the math independently. Every piece of evidence has to tie back to a specific financial statement assertion. Documentation that floats without a clear connection to what it is meant to prove does not satisfy the standard.
The medium does not matter. Paper, electronic files, and other formats all qualify, provided the documentation is complete, retrievable, and secure.3Public Company Accounting Oversight Board. AS 1215 – Audit Documentation – Appendix A
Documenting Materiality Thresholds
Materiality is one area where documentation failures are especially common. The auditor has to establish a materiality level for the financial statements as a whole, expressed as a specific dollar amount, and document the reasoning behind it. The determination should account for the company’s earnings and other relevant circumstances.4Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit
If certain accounts or disclosures could influence an investor’s judgment at amounts below the overall threshold, the auditor has to set separate, lower materiality levels for those areas. The file also has to document tolerable misstatement, set below overall materiality to reduce the risk that accumulated small errors add up to something material. When circumstances change mid-audit or preliminary estimates turn out to be significantly off, the auditor must revisit and re-document these levels.4Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit
Assembly Deadlines and the Lock-Down Rule
Once fieldwork wraps, the team has a fixed window to assemble, review, and archive the complete file. For public company audits, AS 1215 requires archiving no later than 14 days after the report release date. That date is the documentation completion date, and it operates as a hard cutoff.1Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
For private company audits under AU-C Section 230, firms get 60 days after the report release date to complete assembly. After either deadline passes, the file is effectively locked. No one may delete or discard any documentation from that point forward.
Locking does not mean nothing can ever be added. When circumstances require additions after the completion date, the auditor has to record the date the new information was added, the name of the person who prepared it, and the reason for adding it. The rule that matters is one-directional: you can add, you cannot subtract.1Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
That one-way door is where firms most often get into trouble. PCAOB enforcement data shows that a majority of disciplinary orders tied to inspection or investigation failures involved improper alteration of documents after finalization.5Public Company Accounting Oversight Board. Enforcement Spotlight – Improper Alteration of Audit Documentation
How Long You Have to Keep the Files
Retention rules diverge based on the type of engagement, and the gap in consequences is significant.
For public company audits, the Sarbanes-Oxley Act directs the PCAOB to require at least seven years of retention. The SEC’s implementing rule under Regulation S-X requires accountants to retain all records relevant to the audit or review, including workpapers, memoranda, correspondence, and electronic records containing conclusions, opinions, analyses, or financial data, for seven years after the auditor concludes the engagement.6U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews The seven-year clock starts at the conclusion of the audit or review, not at the report release date.
For private company audits, AU-C Section 230 requires a retention period of at least five years from the report release date. State boards of accountancy or firm policies may impose longer periods, so checking your jurisdiction’s rule is worth the effort.
Not everything has to be kept. Superseded drafts, notes reflecting incomplete preliminary thinking, copies corrected only for typos, and pure duplicates generally do not need to be retained.3Public Company Accounting Oversight Board. AS 1215 – Audit Documentation – Appendix A
Who Can See the Files
Audit files contain sensitive client data, but the working papers belong to the auditing firm, not the client. That distinction lets firms protect proprietary methodologies and risk assessment approaches. Clients can request certain records, but the firm is not required to hand over its internal work product absent a legal or regulatory obligation.
Confidentiality is a core professional duty. Under the AICPA Code of Professional Conduct, a CPA in public practice cannot disclose confidential client information without the client’s consent. Recognized exceptions include compliance with professional standards, response to a valid subpoena or summons, cooperation with a professional ethics investigation, and participation in peer review.
IRS Access
The IRS has legal authority to request audit working papers, a right the Supreme Court recognized in United States v. Arthur Young & Co. (1984). In practice, the IRS follows a policy of restraint and does not routinely request these files during standard examinations, a policy intended to encourage voluntary tax compliance.7Internal Revenue Service. Requesting Audit, Tax Accrual or Tax Reconciliation Workpapers
The restraint drops in specific situations. If the factual data cannot be obtained from the taxpayer’s own records or available third parties, the IRS may seek workpapers under what it calls the “unusual circumstances” standard. The rules tighten when a return involves a listed transaction, a category the IRS has identified as potentially abusive. For listed transactions that were properly disclosed, the IRS will request only the workpapers related to that transaction. If the transaction was not timely disclosed, the IRS will request all tax accrual workpapers for the year under examination.7Internal Revenue Service. Requesting Audit, Tax Accrual or Tax Reconciliation Workpapers
Subpoenas
A valid subpoena or court order generally overrides the confidentiality duty, but firms should involve legal counsel before producing documents. Many firms address this proactively in engagement letters, specifying how third-party requests will be handled and that the client will bear the firm’s compliance costs when the firm is not a party to the proceeding.
Penalties If You Get It Wrong
Documentation failures carry consequences at every level, and the severity scales with intent.
Criminal Statutes
The Sarbanes-Oxley Act created two criminal statutes that apply directly to audit records. Under 18 U.S.C. § 1520, anyone who knowingly and willfully fails to maintain audit records as required by SEC rules faces up to 10 years in prison, a fine, or both.8Office of the Law Revision Counsel. United States Code Title 18 – Section 1520
A broader companion statute, 18 U.S.C. § 1519, targets anyone who knowingly destroys, alters, or falsifies any record with intent to obstruct a federal investigation. The maximum penalty is 20 years. Section 1519 is not limited to auditors; it reaches anyone who tampers with records relevant to a federal proceeding.9Office of the Law Revision Counsel. United States Code Title 18 – Section 1519
Regulatory Enforcement
The PCAOB has revoked registration for 18 firms and barred 45 individuals from association with registered firms in cases involving improper document alteration or failure to cooperate with inspections and investigations.5Public Company Accounting Oversight Board. Enforcement Spotlight – Improper Alteration of Audit Documentation Less dramatic violations still draw real money. In 2025, the PCAOB imposed a $25,000 civil penalty on a firm that simply failed to timely assemble its audit file, along with a censure and mandatory remedial training.10Public Company Accounting Oversight Board. PCAOB Sanctions Two Firms for Violations Related to Required Audit Records and Disclosure of Key Information for Investors
The SEC pursues recordkeeping failures aggressively. In 2024, the SEC charged 26 firms for widespread failures to maintain and preserve electronic communications, resulting in combined civil penalties of $392.75 million. Firms that self-reported before the investigation received significantly lower penalties than those that did not.11U.S. Securities and Exchange Commission. Twenty-Six Firms to Pay More Than $390 Million Combined to Settle SEC Charges for Widespread Recordkeeping Failures
Professional Discipline
For private company auditors, the AICPA can impose its own sanctions through its Joint Trial Board and ethics committees. Options include expulsion from the AICPA, suspension for up to two years, public admonishment, or required corrective action such as mandatory continuing education and submission of future workpapers for outside review.12AICPA & CIMA. Explanations of Sanctions
Peer Review Puts Your Files on a Schedule
Documentation compliance gets tested on a predictable cycle, not only when something goes wrong. Every CPA firm that performs audits is subject to periodic peer review, and reviewers go straight to the working papers to assess whether the firm’s quality management system is properly designed, implemented, and operating effectively.
Peer reviewers select engagements and evaluate the highest-risk areas within each one, including the accounting and auditing documentation and the reports issued. They complete quality management checklists, review the firm’s documented quality objectives and risk assessments, and examine evidence such as personnel files, consultation correspondence, and technical reference sources. Deficient documentation can produce a peer review rating of “pass with deficiency” or “fail,” either of which affects the firm’s ability to retain clients and maintain its practice.13American Institute of Certified Public Accountants. Peer Review Standards Update No. 2
Firms with sloppy files find out on a schedule. That is the practical case for treating the documentation rules as day-one procedure rather than year-end cleanup.