Audit work papers are owned by the accounting firm that prepared them, not by the audited company, and firms that audit public companies must keep them for at least seven years from the report release date. Willfully destroying those records is a federal felony. Private company audits run on a shorter minimum set by professional standards and state boards, though many firms apply the seven-year rule to every engagement to avoid guessing wrong.
What Counts as a Work Paper
Work papers are the record the auditor builds during an engagement: the procedures performed, the evidence gathered, and the conclusions reached. They exist to prove the audit followed applicable professional standards. For public companies, those standards come from the Public Company Accounting Oversight Board (PCAOB), created by the Sarbanes-Oxley Act to set auditing rules for firms that audit publicly traded companies.1Public Company Accounting Oversight Board. Auditing Standards
A typical file contains control testing documentation, bank confirmation summaries, schedules reconciling the general ledger to the financial statements, and analytical review memos. It must show what procedures were done, when, and what results they produced.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
A line worth drawing: the client’s own source documents (invoices, contracts, bank statements, general ledger printouts) remain the client’s property. Those are inputs to the audit. The work papers are what the auditor creates by testing those inputs, including confirmation requests, sampling analyses, and memos explaining judgment calls. That distinction drives the ownership rules.
Who Owns Audit Work Papers
The auditor does. The AICPA Code of Professional Conduct says so directly: “Working papers are the member’s property, and the member is not required to make such information available.”3American Institute of Certified Public Accountants. AICPA Code of Professional Conduct The interpretation defines working papers to include audit programs, analytical review schedules, statistical sampling results, and items the client prepared at the auditor’s specific request that reflect the auditor’s testing work.
The client has no automatic right to copies. State and federal statutes, along with the engagement letter signed at the start of the audit, can expand client access beyond that default.3American Institute of Certified Public Accountants. AICPA Code of Professional Conduct Some states have adopted rules requiring auditors to turn over certain client records on request. But the baseline is unchanged: the papers belong to the firm.
Confidentiality and When the Firm Must Produce the File
Owning the papers is not the same as being free to share them. The AICPA’s Confidential Client Information Rule (Rule 1.700.001) prohibits a member from disclosing confidential client information without the client’s consent, and that consent should be in writing.4Journal of Accountancy. AICPAs Revised Confidentiality Rule and Sec 7216
Several exceptions override that consent requirement. An auditor must produce work papers in response to a valid subpoena or summons, and when required by applicable statutes and government regulations.4Journal of Accountancy. AICPAs Revised Confidentiality Rule and Sec 7216 The SEC and PCAOB routinely use their inspection and enforcement authority to demand audit files from registered firms, and confidentiality is not a defense. Sarbanes-Oxley gave the PCAOB broad power to inspect registered firms and compel production of audit documentation during those inspections.
Peer reviews work the same way. Most state boards of accountancy require CPA firms to undergo peer review, typically once every three years, covering accounting and auditing practice not subject to PCAOB permanent inspection.5AICPA. AICPA Standards for Performing and Reporting on Peer Reviews Reviewers examine selected engagement files, and firms must cooperate, which means handing over the relevant papers.
How Long Audit Work Papers Must Be Kept
For public company audits the answer is seven years, and it is set by both federal law and PCAOB standards. PCAOB Auditing Standard 1215 requires the auditor to retain audit documentation for seven years from the report release date, meaning the date the auditor grants permission to use the audit report in connection with the company’s financial statements.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation If no report is issued, the seven years runs from the date fieldwork was substantially completed. If the engagement was abandoned, it runs from the date work ceased.
The seven-year period traces back to Section 802 of Sarbanes-Oxley, which told the SEC to adopt retention rules for audit records. The SEC implemented those rules through Rule 2-06 of Regulation S-X, requiring retention of work papers and other documents (memoranda, correspondence, communications, and records containing conclusions, opinions, analyses, or financial data related to the audit) for seven years after the auditor concludes the engagement.6Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews
Private companies are not subject to Sarbanes-Oxley or PCAOB standards, so the seven-year federal mandate does not directly apply. Retention periods for non-issuer audits are governed by AICPA professional standards and individual state board rules, which commonly set a five-year minimum. Many firms apply the seven-year period to every engagement anyway, to avoid misclassifying a file or scrambling if a private client later goes public through an IPO or merger.
One practical rule overrides whatever minimum applies. If litigation or a regulatory investigation is reasonably anticipated, a litigation hold takes over. Once that happens, the firm cannot destroy any potentially relevant documentation until the matter is fully resolved, even if the standard retention period has expired. Failing to preserve records after a hold is triggered can lead to court sanctions and adverse inferences.
The 14-Day Assembly Deadline and the No-Deletion Rule
Retention is not the only clock. PCAOB AS 1215 requires that a complete and final set of audit documentation be assembled and archived no later than 14 days after the report release date.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation That 14-day window is the documentation completion date, and once it passes the rules change.
After the documentation completion date, no audit documentation may be deleted or discarded. The auditor can still add information, but every addition has to show the date it was added, who prepared it, and why.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation The one-way-door design is there to prevent after-the-fact manipulation of the file. The engagement team has a short window to finalize everything, and after it closes, every change leaves a permanent trail.
Criminal Penalties for Destroying Audit Records
Section 802 of Sarbanes-Oxley created 18 U.S.C. § 1520, which makes it a federal crime to knowingly and willfully violate the audit record retention requirements. The penalty is a fine, imprisonment of up to 10 years, or both.7Office of the Law Revision Counsel. United States Code Title 18 Section 1520 Because the maximum sentence exceeds one year, this is a felony under federal law.
A separate and broader statute, 18 U.S.C. § 1519, reaches anyone who knowingly alters, destroys, or falsifies any record with intent to obstruct a federal investigation or any matter within the jurisdiction of a federal agency. That offense carries up to 20 years of imprisonment.8Office of the Law Revision Counsel. United States Code Title 18 Section 1519 Unlike § 1520, it is not limited to audit records and applies to any document destruction aimed at impeding federal oversight.
When a Company Changes Auditors
When a company switches auditors, the incoming firm needs to understand prior-year balances and any carryforward issues. PCAOB AS 2610 sets the protocol: the successor auditor asks the client to authorize the predecessor to allow a review of the predecessor’s work papers.9Public Company Accounting Oversight Board. AS 2610 – Initial Audits Communications Between Predecessor and Successor Auditors The client sits in the middle because the papers belong to the predecessor firm, not to the client.
The predecessor may ask the client to sign a consent and acknowledgment letter before granting access. The letter documents the scope of the communications being authorized and reduces misunderstandings between the parties.9Public Company Accounting Oversight Board. AS 2610 – Initial Audits Communications Between Predecessor and Successor Auditors The predecessor is not required to open the entire file; the review is typically limited to specific areas the successor identifies as relevant to the new engagement.
What a Retained File Has to Look Like
Keeping the papers is not enough on its own. PCAOB AS 1215 requires that audit documentation contain enough information for an experienced auditor with no prior connection to the engagement to understand the procedures performed, the evidence obtained, and the conclusions reached.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation If a competent outsider cannot follow the file, the documentation fails the standard.
The file must also show who performed the work, the date it was completed, who reviewed it, and the date of that review.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation When PCAOB inspectors pull a file years later, they need to see which staff member tested a given account and which partner signed off on the conclusion.
All significant findings and issues must be documented, with a clear link between the finding and the auditor’s conclusion.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation When something goes wrong (an unexpected variance, a control weakness, a disagreement with management), the file has to show the issue, the steps taken to resolve it, and how the resolution factored into the final opinion.