CA
Tax Tutor
A

SA 230 — Audit Documentation

Think of audit documentation (also called working papers) as the auditor's official diary of the entire engagement. If the auditor examined Rajesh & Co.'s debtors, checked invoices, and concluded everything was fine — but wrote nothing down — professionally, that work never happened. SA 230 exists to prevent exactly this: it ensures the audit leaves a proper paper trail that can be reviewed, defended, and understood by anyone who picks it up later.

The objective of SA 230 is twofold: first, to provide sufficient evidence that the audit was planned and performed in accordance with the Standards on Auditing; second, to support the basis for the auditor's conclusions and the final report. The key benchmark SA 230 sets is this — could an experienced auditor, with no prior connection to this audit, pick up the file and understand (a) what procedures were done, (b) what evidence was obtained, and (c) what significant judgments were made? If yes, documentation is adequate. SA 230 does not prescribe a fixed format — that's left to professional judgment depending on size and complexity of the engagement.

Three dates you absolutely must memorise for the exam. (1) Assembly of final audit file: must be completed within 60 days of the auditor's report date. After the file is assembled, existing documentation cannot be deleted — you can only add new notes explaining post-assembly circumstances. (2) Retention period: working papers must be kept for 7 years from the auditor's report date. (3) Ownership vs. confidentiality: working papers belong to the auditor, not the client — but they are confidential. The auditor cannot hand them over to a third party without the client's consent, except where legally compelled (e.g., court order) or under ICAI quality/peer review. This ownership-vs-access distinction is a classic exam trap. Finally, for complex audits where significant judgments were made, SA 230 requires an audit completion memorandum summarising major issues and how they were resolved. This is asked frequently as a 4–8 mark question — know it cold.

📊 Worked example

Example 1 — Assembly Deadline

Setup: Mr. Arora is the statutory auditor of Pinnacle Textiles Ltd. He signed the audit report on 15 March 2026. His team is still organising working papers — sorting confirmations, filing bank reconciliations, and archiving the final signed accounts.

Question: By when must the final audit file be assembled? What if a junior finds a misplaced confirmation letter on 20 July 2026 — can it be added?

Working:

  • Report date = 15 March 2026
  • Assembly deadline = 60 days after report date
  • 60 days from 15 March 2026 = 14 May 2026
  • The confirmation letter surfaces on 20 July 2026 — that is after the 60-day window
  • Under SA 230, existing documentation cannot be removed or replaced after assembly
  • However, the junior can add the confirmation letter with a note explaining why it was added post-assembly and who authorised it — no deletion of anything already on file

Answer: Final file must be assembled by 14 May 2026. The late-found letter can be added with an explanatory note, but nothing already filed can be altered or removed.

---

Example 2 — Ownership & Confidentiality

Setup: Ms. Iyer audited Sunrise Pharma Ltd. The company's new management asks her to hand over all working papers — "they belong to us, we paid your fees." Meanwhile, ICAI's Quality Review Board (QRB) also requests access for a practice quality review.

Question: Should Ms. Iyer comply with either request?

Working:

  • SA 230 is clear: working papers are the property of the auditor, not the client — fees paid do not transfer ownership
  • The company has no right to demand the working papers
  • The QRB request, however, is a regulatory/professional review — SA 230 permits disclosure under such circumstances without needing client consent
  • Ms. Iyer must also maintain confidentiality (per SA 200 / ICAI Code of Ethics) — she cannot share papers with other third parties without client consent

Answer: Refuse the company's demand (working papers belong to Ms. Iyer). Comply with the QRB request (permitted exception to confidentiality for quality review).

⚠️ Common exam mistakes

  • Confusing ownership with access: Students often write that working papers belong to the client. Wrong — they belong to the auditor. The client may have certain access rights under specific circumstances, but ownership is the auditor's.
  • Mixing up the 60-day and 7-year timelines: The 60 days is the assembly deadline (after report date). The 7 years is the retention period. Many students write 7 years for assembly or 5 years for retention — both wrong.
  • Thinking documentation can be updated freely after assembly: Once the final audit file is assembled (within 60 days), you cannot delete or modify existing documents. You may only add new documents that explain post-assembly circumstances, with a clear note of the reason and date.
  • Forgetting the 'experienced auditor' benchmark: When asked what makes documentation adequate, students write vague answers like 'sufficient records.' The SA 230 standard is specific — documentation is adequate if an experienced auditor with no prior connection can understand the work, evidence, and judgments from the file alone. Use this phrase in exam answers.
  • Ignoring confidentiality exceptions: Students either say the auditor can never share working papers (too absolute) or that the auditor must share whenever asked (too permissive). The correct answer: confidentiality applies except when legally compelled, or for professional/regulatory reviews like ICAI QRB or peer review — no client consent needed in those cases.
📖 Reference: SA 230 — Institute of Chartered Accountants of India
Test yourself
Practice questions on this section, AI-graded with citations.
⚡ Practice now →