A reviewer who has never met your client opens your audit file three years post-report. If they cannot trace your risk assessment to your conclusion using only what is in that file, your documentation has failed AU-C 230, even if the audit itself was perfect.
Audit documentation is the firm's primary defense in peer review, regulatory inspection, and litigation. The standard forces enough recording that work survives the people who did it.
KEY: AU-C 230 is the AICPA standard. PCAOB AS 1215 is the issuer equivalent. Principles are similar; deadlines and retention windows differ. The exam signals "issuer" or "nonissuer" to test which set applies.
HIGH-FREQUENCY: The "experienced auditor" test is the central rule. An experienced auditor has audit expertise but no prior connection to the engagement. If that person cannot understand nature, timing, and extent of procedures from the file alone, documentation is insufficient.
The file must support every significant judgment. AU-C 230 requires:
- Nature, timing, extent of procedures: what you did, when, how much
- Results and audit evidence: confirmations, inventory memos, recalculations, analytical results
Common mistakes
- Confusing assembly deadlines. AICPA is 60, PCAOB is 45. Trap answer in any nonissuer question is 45; in any issuer question, 60. Mnemonic: PCAOB protects investors faster (45) and longer (7).
- Confusing retention periods. AICPA is 5 years, PCAOB is 7. "Publicly traded" or "broker-dealer" signals PCAOB and 7; "private," "nonprofit," or "nonissuer" signals AICPA and 5.
- Believing documentation can be deleted. Once assembled, no deletion under any circumstances. Trap: "remove the inaccurate workpaper and replace it." Correct: add a corrective memo with date, preparer, reason; leave the original untouched.
Bottom line
- AU-C 230: documentation must let an experienced auditor with no prior connection understand the nature, timing, extent, results, and conclusions from the file alone.
- Required contents: audit plan, risk assessments, procedures, evidence, significant findings, written representations, engagement letter, and preparer-reviewer identification on every workpaper.
- Documentation identifies the engagement team: preparer, reviewer, specialists, and component auditors on group audits.
- Assembly deadline: 60 days post-report (AICPA), 45 days (PCAOB).
Exam shortcut
When you see a documentation question, look for two signals: (1) issuer vs. nonissuer fixes 60/45 and 5/7, and (2) whether the file is assembled determines whether the action is administrative cleanup or a regulated post-assembly modification. Any answer that involves deleting a workpaper after assembly is automatically wrong, no exceptions. DECISION: Stem says "issuer," "publicly traded," or "broker-dealer" → PCAOB → 45 days assembly, 7 years retention.
The full lesson (about 1,942 words, 13 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- I.E1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.