Audit workpaper requirements come from three main sources: PCAOB Auditing Standard 1215 for public company audits, AICPA AU-C Section 230 for private company audits, and SEC Rule 2-06 together with the Sarbanes-Oxley Act for retention. Together they dictate what has to be documented, how quickly the file must be finalized after the audit report is released, how long the records must be kept, and what happens to anyone who alters or destroys them. The rules are strict, the deadlines are short, and the penalties reach federal prison.
What Workpapers Must Contain
PCAOB Auditing Standard 1215 sets the governing benchmark for public company audits: workpapers must be detailed enough that an experienced auditor with no prior connection to the engagement could understand the procedures performed, the evidence obtained, and the conclusions reached. Every workpaper has to identify who performed the work and when, along with who reviewed it and the date of that review. Oral explanations alone are not sufficient support for a conclusion, though they can clarify written evidence. If it isn’t written down, it didn’t happen.
A complete file typically includes the audit program describing the nature, timing, and extent of planned procedures; lead schedules and trial balances tying the financial statements to detailed testing; analytical procedures comparing results against benchmarks; internal control evaluations addressing both design and operating effectiveness; and substantive test results documenting samples, methods, and evidence obtained from direct testing of balances and transactions.
Each piece of evidence has to be cross-referenced to specific financial statement assertions such as existence, valuation, or completeness. That indexing lets a reviewer trace the logic from the final opinion back to the underlying data. For non-issuer audits, AICPA standards under AU-C Section 230 (SAS No. 122) impose comparable documentation requirements, though some specific thresholds differ.
The Engagement Completion Document
Every audit requires an engagement completion document, sometimes called a completion memorandum, that pulls together the significant findings from the engagement. AS 1215 defines significant findings broadly as substantive matters important to the procedures performed, the evidence obtained, or the conclusions reached. That covers:
- Significant matters involving the selection, application, or consistency of accounting principles and related disclosures.
- Results that indicated a need to significantly change planned audit procedures, or that pointed to material misstatements or significant control weaknesses.
- Accumulated uncorrected misstatements, both quantitative totals and the qualitative factors the auditor weighed.
- Differences of professional judgment among engagement team members or with outside consultants, and how those differences were resolved.
- Significant changes in risk assessments during the engagement and the additional procedures performed in response.
- Any matters that could result in a modified audit opinion.
The document can either contain the full analysis or cross-reference supporting workpapers, but either way it must be specific enough for a reviewer to thoroughly understand each finding. For annual audits, it also has to cover significant findings from any interim reviews performed during the year.
Management Representation Letter
One of the final items added to the file is the management representation letter. Typically signed by the CEO and CFO, this letter is dated as of the auditor’s report date and confirms key facts the auditor relied on. Management must confirm that all financial records and related data were made available, that there are no unrecorded transactions, and that there are no undisclosed side agreements. The letter also addresses fraud: management must acknowledge responsibility for anti-fraud controls and disclose any known or suspected fraud involving management or employees with significant roles in internal control. The representations extend to litigation, contingent liabilities, related-party transactions, compliance with contractual agreements, and the reasonableness of significant accounting estimates.
Without this letter, the auditor generally cannot issue an unqualified opinion. If management refuses to provide written representations the auditor considers necessary, that refusal is itself a scope limitation. The auditor should provide a copy of the representation letter to the audit committee if management has not already done so.
Who Owns the Workpapers and Who Can See Them
The auditing firm owns the workpapers it creates. The client provides the underlying financial data, but the analysis, testing documentation, and conclusions belong to the firm.
Ownership does not mean the firm can disclose whatever it likes. AICPA Rule 1.700.001 prohibits auditors from disclosing confidential client information without specific client consent. Limited exceptions apply: the auditor must comply with a valid subpoena, cooperate with peer reviews authorized by the AICPA or state boards, and respond to inquiries from professional ethics bodies or regulatory agencies.
Client Records Versus Firm Work Product
The distinction between client property and firm property becomes contentious when fees go unpaid. Client-provided records, meaning accounting records and documents that belong to the client, must be returned regardless of whether the client has paid. The firm can charge a reasonable fee for retrieval and copying but cannot hold the records hostage.
Member-prepared records sit in a middle category. These are items the firm created but was not specifically engaged to produce, such as adjusting journal entries or consolidating schedules that are not in the client’s own books. The firm may withhold these if fees for the related work remain unpaid, and the same applies to deliverables explicitly set out in the engagement terms, such as tax returns. Workpapers themselves, including audit programs, analytical review schedules, and sampling results, are the firm’s property outright and need not be shared with the client at all. State law can override these defaults; if a state board of accountancy prohibits withholding certain records even for unpaid fees, the state rule controls.
Assembly Deadlines After the Report
Once the audit report is released, the clock starts on assembling the final file, and the deadline depends on the type of client.
For public company (issuer) audits, PCAOB AS 1215 sets the documentation completion date at no more than 14 days after the report release date. After that date, the file is locked. Nothing can be deleted or discarded. Information may still be added, but every addition must document the date it was added, who prepared it, and why.
For non-issuer audits, AICPA standards under AU-C Section 230 allow 60 days after the report release date to complete the final assembly. The same locking principle applies once the deadline passes.
Missing either deadline can itself become a documentation deficiency flagged in quality reviews.
How Long Workpapers Must Be Kept
Retention periods split along the same public/private line.
For issuer audits, both the SEC and the PCAOB require seven-year retention. The underlying statute, 18 U.S.C. 1520, originally set a five-year floor, but Section 103 of the Sarbanes-Oxley Act directed the PCAOB to require seven years, and the SEC adopted that longer period. SEC Rule 2-06 (17 CFR 210.2-06) specifies that the seven-year clock starts when the accountant concludes the audit or review, and the retained records must include not just workpapers but also memoranda, correspondence, and communications containing conclusions, opinions, analyses, or financial data related to the engagement. Records must be retained whether they support the auditor’s final conclusions or contain information inconsistent with them.
PCAOB AS 1215 separately requires seven-year retention from the report release date. If no report was issued, the period runs from the date fieldwork was substantially completed. If the engagement was never completed, the seven years run from the date the engagement ceased.
For non-issuer audits, AICPA standards set a minimum five-year retention period from the report release date. State boards of accountancy may set longer requirements, and many firms impose longer periods through internal policies.
Adding to a Locked File
The rules do not assume perfection. Auditors sometimes discover after the documentation completion date that a procedure may not have been performed, that evidence may not have been obtained, or that a conclusion may not have been properly supported. When that happens, AS 1215 requires the auditor to determine whether sufficient procedures were actually performed and appropriate conclusions actually reached, using persuasive evidence other than oral explanations alone.
Any documentation added after the completion date must record three things: the date of the addition, the name of the person who prepared it, and the reason for adding it. That rule applies to both issuer and non-issuer audits. Nothing can be deleted or discarded after the completion date. Additions are permitted; subtractions never are.
The SEC layers on more. Auditors of issuers must retain all memoranda, correspondence, and electronic communications created or received in connection with the engagement that contain conclusions, opinions, analyses, or data related to the audit, even if those documents were not part of the original workpaper file.
Penalties for Altering or Destroying Workpapers
Consequences run from professional sanctions to federal prison.
Professional Sanctions
The PCAOB treats improper alteration of audit documentation as a high-priority enforcement matter with a zero-tolerance policy, especially when the alteration occurs in connection with a Board inspection or investigation. The Board has revoked the registration of 18 firms and sanctioned 53 individuals, including barring 45 of them from association with any registered firm. Losing PCAOB registration ends a firm’s ability to audit public companies.
Criminal Penalties
Under 18 U.S.C. 1519, anyone who knowingly alters, destroys, or falsifies records with intent to obstruct a federal investigation faces up to 20 years in prison and fines. The statute reaches beyond auditors to anyone destroying records relevant to a federal proceeding.
Section 802 of the Sarbanes-Oxley Act created a more targeted provision under 18 U.S.C. 1520. An accountant who willfully violates the audit record retention requirements, or any SEC rule implementing them, faces up to 10 years in prison and fines. Prosecutors can choose which statute to pursue based on the facts, and the broader obstruction statute carries the harsher penalty.