SA 230 requires audit documentation sufficient for an experienced auditor with no previous connection to the engagement to understand the nature, timing and extent of the procedures performed, the results obtained, the evidence examined, and the conclusions reached. In practice it means the file must stand on its own without the engagement team present to explain it.
The experienced-auditor test, in plain terms
Imagine handing your file to a competent auditor who has never met the client, cannot call you, and has to form a view on whether the work supports the opinion. If they would have to guess at what you did, why you selected what you selected, or how you got from the exceptions to the conclusion, the documentation is insufficient. That is the whole standard, restated.
What every working paper has to show
- What you were trying to establish — the objective of the procedure, not a restatement of the account balance.
- The population you worked from, and evidence that it is complete. An extract that was never agreed to the trial balance is not a population.
- What you selected and why. “Judgemental” is not a basis; “all items above performance materiality, plus a monetary-unit selection across the remainder” is.
- What you actually did, specifically enough to be repeated by someone else.
- What you found, including the items that turned out to be fine.
- How each exception was resolved, and what you concluded — in your words, not a generated sentence.
- Who prepared it, who reviewed it, and when.
Documenting significant judgements
Routine procedures need routine documentation. Significant judgements need considerably more: what the issue was, what alternatives you considered, what evidence you weighed, who you discussed it with, and why you landed where you did. Materiality determination, going concern, estimates, related parties and any area where you changed your approach mid-engagement all fall here.
Assembly and retention
The final audit file has to be assembled within a defined period after the date of the audit report, and retained for a defined minimum period afterwards. Both are set out in the quality control standard rather than in SA 230 itself. Confirm the current periods before relying on them — the commonly cited figures have been stable for some years but should be verified against the current text, not against last year's file.
After assembly, you may not delete documentation. Changes are permitted but must record what was changed, by whom, when, and why. This is the specific reason an audit trail needs to be append-only: a system that lets a reviewer quietly edit a conclusion after sign-off cannot support the standard.
Where files most often fall short
| Gap | What a reviewer sees | Fix |
|---|---|---|
| Conclusions that restate the procedure | “Purchases were tested and found to be in order.” This records that work happened, not what it showed. | State what you concluded on the assertion, and what the exceptions did or did not change. |
| No basis for the sample | A list of twenty-five items with no explanation of how they were chosen | Record the method, the parameters and the reason the method suits the risk. |
| Population completeness never evidenced | Testing performed on an extract that is never agreed to anything | Agree the extract to the trial balance and the trial balance to the prior-year accounts, and document it. |
| Exceptions raised but not cleared | Open items with no resolution and no conclusion | Every exception needs an outcome, including “examined and not a misstatement, because…”. |
| Review evidenced only by a signature | A sign-off with no review notes and no record of what was questioned | Retain the review notes and how they were cleared. They are evidence the review happened. |
| File assembled long after the report date | Timestamps clustered weeks after the opinion was signed | Assemble as the work is done rather than reconstructing afterwards. |
Paragraph numbers, assembly deadlines and retention periods are deliberately not quoted here because they change and because quoting them inaccurately is worse than omitting them. Read the current SA 230 and the current quality control standard as issued by the ICAI before concluding on any of this.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationAudit working papers: what they should containThe anatomy of a paper that stands on its own: objective, population, sample basis, procedure, results, exceptions, conclusion and sign-off, and what each must establish.
- Audit documentationAn audit documentation checklist for statutory auditsA checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
- Audit documentationAudit evidence: what makes it sufficient, appropriate and traceableSufficiency and appropriateness without the textbook circularity, a reliability hierarchy for Indian practice, and what has to be recorded for evidence to be traceable.
- Audit documentationReviewing and signing off audit working papersWhat a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.