Working paper review and sign-off are two distinct responsibilities. Reviewing a working paper means establishing that the work was appropriate to the assessed risk, that it was actually performed and evidenced, that exceptions were resolved, and that the conclusion follows from what is in the paper. Signing off means taking responsibility for that judgement. The two most common failures are reviewing for presentation rather than for sufficiency, and allowing an approval to remain attached to a paper whose content has changed since it was given.

What the reviewer is responsible for

A reviewer is not re-performing the work. They are forming a view on whether the work performed and documented supports the conclusion drawn, and whether the conclusion is one a competent auditor would reach on the same evidence.

Three levels of review, and what each is looking at
Level	Looking at	Not looking at
Senior reviewing an article's work	Whether the procedure was carried out as described, arithmetic, completeness of the schedule, whether exceptions were followed up	Whether the procedure was the right one. That was decided at planning.
Manager reviewing a section	Whether the procedures address the risks identified, whether the evidence is sufficient and appropriate, whether the conclusion follows, and whether anything needs to go to the partner	Every line of every schedule. Sampling the detail is legitimate if the basis for doing so is recorded.
Partner reviewing the file	Significant judgements, significant risks, the summary of misstatements, going concern, the form of the report, and whether the file as a whole supports the opinion	Routine testing already reviewed at manager level, unless something indicates it should be looked at.
Engagement quality control reviewer, where required	An objective evaluation of the significant judgements and the conclusions reached, before the report is issued	Being part of the engagement team. The reviewer's independence from the engagement is the point of the role.

Three levels of review, and what each is looking at

Regulatory requirement

The responsibilities of the engagement partner for direction, supervision, review and for the engagement quality control review where one is required are set out in SA 220 and SQC 1. The circumstances in which an engagement quality control review is required depend on the firm's own policies and on the applicable requirements. Read the current text rather than relying on this summary.

A defensible order to review in

Reviewing a paper from the top down invites the reviewer to read the conclusion first and then look for support for it, which is the wrong direction and is how weak papers get approved. Working outwards from the population is harder to fool.

01Start with the populationWhere did it come from, and what evidence is there that it is complete? If this fails, nothing downstream matters and the rest of the review is wasted effort.
02Then the selectionIs there a basis recorded, was it recorded before selection, and does it address the risk that was actually identified at planning rather than a generic one?
03Then the workCould you reperform this from the description? Pick one item and follow it to its evidence. A single item followed end to end tells you more about a paper than reading all of it.
04Then the exceptionsDoes every exception have an outcome? Are the dismissed ones recorded with a reason? Does the aggregate carry to the summary of misstatements?
05Only then the conclusionDoes it follow from what is above it, and does it address the assertion rather than restate the procedure? By this point you already know what the conclusion should say, which makes it easy to see when it says something else.
06Finally, the cross-referencesDo they resolve? A reference to a schedule that was renumbered is a broken link, and broken links are how an apparently complete file turns out to be missing a section.

Writing a review point that gets cleared

A review point is an instruction, and the quality of the instruction determines whether the response closes the issue or generates another round. Three things make the difference.

Review points that work and points that do not
Weak point	Why it fails	Stronger
“Insufficient evidence.”	The preparer cannot tell what would be sufficient	“The population is not agreed to the ledger. Please agree the register total to the purchases account and evidence the reconciliation.”
“Please explain.”	Invites a verbal answer that never reaches the file	“Please record in the paper why the three exceptions at rows 8, 14 and 22 were not treated as misstatements.”
“Conclusion needs work.”	The preparer rewrites the sentence rather than the thinking	“The conclusion states purchases are fairly stated but no completeness procedure was performed. Either add one or qualify the conclusion to occurrence only.”
“Discussed and cleared.”	Records that a conversation happened, not what it established	“Cleared: the client provided the goods receipt register; the four items are supported; see WP P-03.2.”

Review points that work and points that do not

A review point cleared by deleting it leaves no evidence that the review occurred. Clear points by recording the response and the resolution, and keep both. The cleared points are among the strongest evidence in the file that the review was real.

Sign-off is a statement about a particular version

This is the part most often handled badly, and it is a design problem rather than a discipline problem. A sign-off means that a named person, on a stated date, judged that the work as it then stood supported the conclusion as it then read. If the conclusion is later revised, or the procedure is re-run, or the exception schedule changes, the sign-off no longer refers to anything that exists.

Leaving the approval attached in those circumstances is not a small administrative matter. It puts a name against text that person never saw, which is precisely what the documentation is supposed to prevent.

An approval should identify the version it was given at, not just the paper.
A change to content after approval should withdraw the approval and say so, naming who had approved it and what revoked it.
The withdrawal should be visible on the paper itself, not only in a log nobody opens.
Re-approval after the change is a new approval, recorded as one.
Only the person whose responsibility it is should be able to give the final sign-off, and the system or the process should enforce that rather than relying on convention.

The two gates before approval

Two conditions are worth making explicit before anyone can approve a paper, because both are checkable and both are routinely missed under deadline pressure.

A written conclusion exists, in the preparer's words. A paper with no conclusion is not finished, however complete the testing.
No review point remains open. An approved paper with an open point is a contradiction that only surfaces when someone reads the file cold.

Common practice, not a requirement

Many firms rely on the reviewer noticing these. Making them a precondition of the approval action instead is a firm-level choice, not a requirement of any standard, and it removes an entire category of review point from the file.

Review under deadline pressure

Almost all of the audit season's review happens in the weeks before the statutory deadlines, which is the worst possible condition for the judgement involved. Two things help and neither is complicated: review sections as they are completed rather than in one pass at the end, and put the significant judgement areas in front of the partner early, since those are the papers where a late review point is most expensive to clear.

A file reviewed entirely in the last fortnight shows it. Preparation and review timestamps cluster, review points are thin, and the clearances are terse. None of that is a breach of anything, and all of it reads badly to anyone examining the file later.

How we think about this

In Lekhya a paper cannot be approved without a written conclusion or while a review point is open, only the partner can sign off, and changing content after review bumps the version and withdraws the approval rather than silently keeping it. The point is not to police the reviewer. It is to make sure the file never claims an approval that no longer corresponds to what the paper says.

This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.

Free tools, no signup

Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.

Reviewing and signing off audit working papers