A statutory audit file has to contain, at minimum: evidence of acceptance and independence, the risk assessment and materiality determination that drove the plan, a working paper for each procedure showing population, selection, work done, results and a written conclusion, resolution of every exception and review point, the completion documents including the summary of uncorrected misstatements and the representation letter, and evidence of who reviewed and signed off. It then has to be assembled within the period set by the quality control standard and retained for the period set there.

How to use this

The checklist is organised by when the work happens rather than by which standard requires it. A checklist arranged by standard gets read once at the start of the season and never opened again, because nobody works in that order.

This is a working aid, not a compliance checklist. Meeting every line does not establish compliance with SA 230 or any other standard, and no checklist can. The requirement is that the documentation lets an experienced auditor with no previous connection to the engagement understand the work, and that is a judgement about a specific file.

Before fieldwork

Client acceptance or continuance considered and recorded, including anything that changed since last year.
Engagement letter signed for the current period, covering the engagements actually being performed.
Independence and ethical requirements addressed for the firm and for each member of the team, with any threats identified and the safeguards applied.
Understanding of the entity and its environment, including its internal control, recorded at a level that supports the risks identified rather than restating the client's brochure.
Risk assessment identifying the significant risks, with a reason for each and a response against each.
Materiality and performance materiality determined, with the benchmark, the percentage and the reason for both, and the threshold for clearly trivial items.
Audit programme reflecting the risk assessment. A programme identical to last year's on a client whose circumstances changed is a review point in itself.
Engagement team discussion held, including the susceptibility of the financial statements to material misstatement due to fraud, and who was present.
Reliance on internal audit, service organisations or experts considered where relevant.

During fieldwork: every working paper

Entity, period, preparer and date on the face of the paper.
Objective stated in terms of the assertion being addressed.
Population identified, its source recorded, and its completeness evidenced by agreement to the ledger and the trial balance.
Basis of selection recorded before selection, not reconstructed afterwards.
Procedure described specifically enough that another auditor could reperform it.
Results recorded for the whole selection, including the items with no exception.
Every exception investigated, resolved and cross-referenced, including the ones dismissed and why.
Evidence referenced by document and locator, never by category.
Conclusion written in the preparer's own words, addressing the assertion rather than restating the procedure.
Cross-references to related papers and to the summary of misstatements, and all of them resolving.

Areas that need more than routine documentation

Significant judgements require the reasoning, not just the outcome: what the issue was, the alternatives considered, the evidence weighed, who was consulted, and why the conclusion was reached. The areas below almost always qualify.

Judgement areas and what the file has to show
Area	What has to be documented beyond the result
Materiality	The benchmark chosen and why it suits this entity, the percentage applied, and any revision during the engagement with its effect on work already performed
Going concern	The period assessed, management's assessment and the auditor's evaluation of it, the events considered, and the basis for the conclusion
Accounting estimates	The method, the assumptions, the range considered, the auditor's point estimate or range, and the evaluation of management bias
Related parties	How parties were identified beyond management's list, the transactions examined, and how arm's length assertions were evaluated
Fraud risk	The risks identified, the responses including unpredictability, journal entry testing, and the evaluation of management override
Change of approach mid-engagement	What changed, why, and what it meant for work already completed under the earlier approach
Consultation	The matter, who was consulted, what they advised, and how it was resolved

Judgement areas and what the file has to show

Completion

Summary of uncorrected misstatements, with each item's effect on profit and on the balance sheet, and the conclusion on whether they are material individually or in aggregate.
Corrected misstatements recorded too, since a pattern of corrections is itself information about the control environment.
All review points cleared, with the clearance recorded rather than the point deleted.
Subsequent events procedures performed up to the date of the report, and documented.
Written representations obtained, dated as near as practicable to the report date, covering the matters required.
Going concern conclusion and any related reporting.
Communication with those charged with governance, and evidence it occurred.
Reporting checklists completed: the Companies Act reporting requirements, CARO where applicable, and internal financial controls reporting where applicable.
Audit trail reporting under Rule 11(g) addressed with supporting work, not as a standard paragraph.
Engagement quality control review completed where required, and before the report is signed.
The signed report, and the financial statements it refers to, in the file in the form issued.

Review points should be cleared, not deleted. A file where points vanish without a record shows a review that left no trace, and a reviewer cannot distinguish that from a review that never happened.

Assembly and retention

Regulatory requirement

SQC 1 addresses the completion of the assembly of the final engagement file and its retention. It indicates that the assembly of the final audit file is ordinarily completed not more than 60 days after the date of the auditor's report, and that the retention period for audit engagements is ordinarily no shorter than seven years from the date of the auditor's report, or, if later, the date of the group auditor's report. Confirm the current text of SQC 1 and any firm or regulatory requirement that is more demanding before relying on these periods.

Assembly is an administrative process. It does not involve performing new procedures or reaching new conclusions, and a file that changes substantively during assembly raises the question of when the work was actually done.

Assembly completed within the period, with the date of completion recorded.
Nothing deleted or discarded after assembly, for the whole of the retention period.
Any change made after assembly recorded with what was changed, by whom, when and why.
Where documentation was added after the report date, the reason recorded and its effect on the report considered.
Access to the assembled file restricted, so that the record of what was approved cannot be altered.
Backup and recovery arrangements adequate for the retention period, including for electronic files in a format that will still be readable.

The six gaps that most often draw comment

Recurring documentation gaps
Gap	Fix
Conclusions that restate the procedure	State what was concluded on the assertion and what the exceptions did or did not change
No basis for the sample	Record the method, the parameters and why the method suits the assessed risk, before selecting
Population completeness never evidenced	Agree the extract to the ledger and the ledger to the accounts, and document both
Exceptions raised but never cleared	Give every exception an outcome, including “examined and not a misstatement, because…”
Review evidenced only by an initial	Retain the review notes and their clearance; they are the evidence the review happened
Timestamps clustered weeks after the report date	Assemble as the work is done. A file reconstructed afterwards looks exactly like one

Recurring documentation gaps

How we think about this

Most of this checklist is about whether something exists and is linked to something else, which is the kind of check software can run continuously rather than at the end. Lekhya will not let a paper be approved without a written conclusion, and shows exceptions that have no outcome as open rather than letting them disappear. It has no view on whether a conclusion is a good one. That remains the reviewer's job, and it is the only part of this list that could not be automated.

This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.

Free tools, no signup

Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.

An audit documentation checklist for statutory audits