How to Write an Audit Memo: Criteria, Evidence, and Review

A well-written audit memo moves in a straight line from the criteria the entity was supposed to meet, to the evidence of what actually happened, to the gap between the two and its financial effect, with every finding cross-referenced to the workpaper that supports it. Learning how to write an audit memo means learning that structure, learning to document your professional skepticism on the page, classifying any deficiencies correctly, and finalizing the file within the assembly window your governing standard imposes. The stakes are real: PCAOB inspectors read these files, and intentionally destroying or altering them is a federal crime carrying up to ten years in prison.¹

Which Standard Governs Your Memo

Two frameworks run in parallel. For audits of SEC registrants, PCAOB Auditing Standard 1215 controls. For audits of private companies, nonprofits, and other non-issuers, the AICPA’s AU-C Section 230 applies. Both demand that the memo be detailed enough for an experienced auditor with no prior connection to the engagement to understand what was done, what was found, and why the conclusions follow.

AS 1215 puts it plainly: documentation must be “prepared in sufficient detail to provide a clear understanding of its purpose, source, and the conclusions reached,” and must demonstrate that the engagement complied with PCAOB standards.² AU-C 230 requires the same substance for non-public engagements: the nature, timing, and extent of procedures; the results and evidence obtained; and any significant findings with the judgments behind them.

Build the Memo Around Criteria, Evidence, and Effect

Open the memo by fixing the scope. State the audit period, the accounts or processes under review, and the criteria performance will be measured against. Criteria usually come from Generally Accepted Accounting Principles, but they can also be internal policies, regulatory rules, or contract terms. Pinning down the benchmark first keeps the analysis focused and prevents scope creep once fieldwork produces surprises.

Then document the evidence. Record what was examined during fieldwork: general ledger entries, bank reconciliations, vendor invoices, payroll records, electronic access logs, and notes from interviews. Explain how the evidence was obtained, not just what it shows. An observation of a physical inventory count carries different weight than an unverified management assertion, and the memo needs to make that distinction visible on its face.

Where the evidence reveals a gap between the criteria and the actual condition, explain the cause and quantify the effect. If a $50,000 discrepancy surfaces in accounts payable, work out whether it traces to a training gap, a software error, a breakdown in approval workflows, or something else, and then state the financial impact: potential balance sheet adjustments, effects on reported earnings, tax implications. Cause and effect is what separates a useful memo from a data dump.

Cross-reference everything. AS 1215 requires documentation to be “appropriately organized to provide a clear link to the significant findings or issues.”² In practice that means index numbers, tab references, or hyperlinks in the electronic workpaper system, so any reviewer can trace a conclusion to its supporting evidence without guessing.

Show Your Skepticism on the Page

The most common inspection deficiency is a memo that reaches a defensible conclusion without showing the reasoning that got there. PCAOB standards require auditors to maintain “a questioning mind and a critical assessment of audit evidence,” and to conduct the engagement with an acknowledgment that a material misstatement due to fraud could be present regardless of past experience with the entity or beliefs about management’s honesty.³

The memo has to show that in concrete terms. What alternative explanations did you consider? Which management representations did you test rather than accept? What additional procedures did you run when the initial evidence was ambiguous? A line that reads “we tested the revenue recognition schedule and found it consistent with GAAP,” without any account of what could have gone wrong, what risks were evaluated, and why the evidence was persuasive rather than merely convenient, is the kind of entry that draws regulatory attention.

Classify Findings Correctly

Not every control deficiency carries the same weight, and the memo has to place each finding in the correct tier. The two classifications that matter most are material weaknesses and significant deficiencies, and the line between them is a matter of judgment, not a numerical threshold.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting where there is a reasonable possibility that a material misstatement of the company’s financial statements will not be prevented or detected on a timely basis.⁴ “Reasonable possibility” means the likelihood is either reasonably possible or probable. For a public company, a material weakness triggers annual report disclosure, and the auditor cannot issue an unqualified opinion on internal controls while one exists.

A significant deficiency is less severe but still important enough to merit attention from those responsible for oversight of the company’s financial reporting.⁴ The auditor’s judgment turns on the magnitude of the potential misstatement and the likelihood it would slip through.

Both categories must be communicated in writing to management and the audit committee before the audit report is issued. The written communication has to distinguish clearly between the two and include the definitions of each.⁵ For public company engagements, the auditor’s attestation on internal controls under Sarbanes-Oxley Section 404 rests on the evidence the memo documents.⁶

Route the Draft for Review

Once drafted, the memo routes to the engagement partner for technical review. The partner verifies that every finding ties back to supporting workpapers, that the conclusions follow logically from the evidence, and that the documentation complies with applicable standards. Under the updated AS 1215 effective December 15, 2026, the engagement partner and all supervisory reviewers must complete their review before the report release date.⁷

Management typically receives the findings and has an opportunity to respond. In government audits, a formal corrective action plan with specific timelines is standard. In private company audits, the response is less formalized but still common, and it often becomes part of the permanent audit file.

Assemble the File Within the Deadline

After the report is released, the complete set of audit documentation must be assembled for retention within a fixed window. Under the current version of AS 1215, that window is no more than 45 days after the report release date.⁸ The updated AS 1215, effective for periods ending on or after December 15, 2026, shortens the window to 14 days.⁷ Teams built around the 45-day rhythm need to rework their close-out process before that change takes effect.

Anything added after the report release date has to be handled as an addition, not a substitution. Every added item must show the date it was added, the name of the person who prepared it, and the reason it was added. Previous workpapers stay in the file intact and cannot be discarded.⁹ The rule exists to prevent after-the-fact manipulation of the record.

Retain the File for Seven Years

AS 1215 requires auditors to retain all audit documentation for seven years from the report release date. If no report was issued, the clock starts from the date fieldwork was substantially completed.² The SEC’s parallel rule at 17 CFR 210.2-06 imposes the same seven-year period and covers workpapers, memoranda, correspondence, and any electronic records containing conclusions, opinions, analyses, or financial data related to the audit.¹⁰

One detail catches many teams off guard: records inconsistent with the final conclusions have to be retained too, not only the documents that support the opinion issued. If the team considered and rejected an alternative interpretation of a transaction, that analysis stays in the file.¹⁰

The PCAOB regularly sanctions firms for documentation failures through censures and civil money penalties. At the extreme end, 18 U.S.C. § 1520, enacted as part of the Sarbanes-Oxley Act, makes knowing and willful destruction or alteration of audit records a federal crime punishable by fines and up to ten years in prison.¹ That statute is why audit firms treat the memo, and everything filed with it, as a record that has to be right the first time.

1
Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records
2
Public Company Accounting Oversight Board. AS 1215 Audit Documentation
3
Public Company Accounting Oversight Board. AU 316.13
4
Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting
5
Public Company Accounting Oversight Board. AS 1305 Communications About Control Deficiencies in an Audit of Financial Statements
6
Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002
7
Public Company Accounting Oversight Board. AS 1215 Audit Documentation (Effective on 12/15/2026)
8
Public Company Accounting Oversight Board. Statement on Proposal to Modernize PCAOB Standards Addressing Core Auditing Principles and Responsibilities
9
Public Company Accounting Oversight Board. AS 1215 Audit Documentation – Appendix A
10
eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records