AI Answer Summary

Audit workpapers, also called audit working papers or audit documentation, are the written record of the procedures an auditor performed, the evidence obtained and the conclusions reached, together with who did the work, who reviewed it and when.

The PCAOB, AICPA and IAASB standards share one test: an experienced auditor with no previous connection to the engagement must be able to understand the work from the file alone. The deadlines differ. Public company audit files must be assembled within 14 days of the report release date and kept for seven years. US private company audit files have 60 days and a five-year minimum.

Tools can prepare workpaper shells, import data, perform tie-outs and draft narratives. The same documentation rules apply to that work, so every figure a tool places in a workpaper needs a record of its source, what was done to it and who reviewed it. Judgment about the evidence, and the final conclusion, stay with the auditor.

What Are Audit Workpapers?

Audit workpapers are the auditor's written record of the basis for their conclusions: the procedures performed, the evidence obtained and the conclusions reached on an engagement.

The terms vary, and they all mean the same thing. The PCAOB's standard is titled AS 1215, Audit Documentation, and it notes that audit documentation may also be called work papers or working papers. Firms use whichever term they trained on. This article uses "workpapers" and "audit documentation" interchangeably.

A workpaper can take many forms. AS 1215 lists memoranda, confirmations, correspondence, schedules, audit programs and letters of representation, in paper, electronic files or other media. In practice, many firms now keep the whole audit file in an audit software platform or a structured set of spreadsheets and documents, with each workpaper carrying a reference so that reviewers can move between them.

This article covers workpapers in external financial statement audits performed by accounting firms. Internal audit teams use the same idea under different standards, and most of the practical advice carries over, but the deadlines and retention rules below apply to external audits.

One distinction is worth making early. A PBC list records what the auditor asked the client to provide, and the evidence the client sent back. Workpapers record what the auditor did with that evidence, what it showed, and what the auditor concluded. Our guide to PBC lists covers the first; this article covers the second.

Why Audit Workpapers Matter: Who Reviews Them and What They Must Show

Audit workpapers are written for people who were not in the room when the work was done.

AS 1215 is specific about who those readers are. It lists auditors new to the engagement who read last year's file to plan this year's, supervisors reviewing the work of their team, engagement partners and engagement quality reviewers judging whether significant conclusions are supported, successor auditors taking over from a predecessor, and internal and external inspection teams assessing audit quality. Each of them arrives without the context the preparer had.

The standard also sets out what the documentation has to demonstrate. Under AS 1215.05, it should show that the engagement complied with the PCAOB's standards, support the auditor's conclusions on every relevant financial statement assertion, and show that the underlying accounting records agree or reconcile with the financial statements. Paragraph .06 adds that it must show the work was in fact performed, who performed it, who reviewed it and when.

Those requirements explain why weak documentation is expensive even when the audit work itself was sound. A partner who cannot follow a workpaper sends review notes, and the preparer spends time reconstructing what they did. An inspector who cannot follow it records a deficiency, whatever the preparer remembers. And next year's team, reading a file that does not explain itself, repeats work or rolls forward procedures that no longer fit.

Every one of those readers asks the same question: can I tell what was done, why, and what it showed, without asking anyone? Section 5 turns that question into a test.

What Should Audit Workpapers Contain?

A workpaper should let a reviewer answer, from the page, every question they would otherwise ask the preparer.

Not every workpaper needs the same depth. AS 1215.07 says the nature and extent of documentation depend on factors including the nature of the procedure, the risk of material misstatement, the significance of the evidence and the amount of judgment involved. An accounting estimate, where the auditor has to evaluate management's assumptions, needs far more documentation than a routine agreement of a balance to a bank statement.

Two further elements sit above individual workpapers. Significant findings or issues, such as significant accounting matters, results that require the audit plan to change, accumulated misstatements and disagreements within the team, have to be documented along with how they were resolved. And under AS 1215.13, they must be identified in an engagement completion document, with cross-references to the supporting workpapers, so that a reviewer can understand the significant matters on the engagement without reading every workpaper in the file.

The table is also a useful review tool on its own. A reviewer who cannot answer one of its questions from the workpaper has found the review note before writing it.

Audit Workpaper Example: Search for Unrecorded Liabilities

A search for unrecorded liabilities tests whether accounts payable is complete at year end. This example follows one workpaper from header to sign-off. The company, the people and every figure are fictional.

Header, Objective and Assertion

The workpaper opens with what a reviewer needs to place it:

• Client: Harbor Valley Manufacturing, Inc. (fictional)
• Period: year ended December 31, 2025
• Workpaper reference: L-4, within the accounts payable section
• Objective: determine whether liabilities for goods and services received on or before December 31, 2025 were recorded in accounts payable
• Assertion: completeness
• Link to risk assessment: cross-referenced to the risk assessment workpaper that identified the completeness of payables as a risk at this client

Population and Selection

The population is every disbursement from January 1 to February 28, 2026, taken from the cash disbursements journal, together with unpaid vendor invoices received up to the same date. Payments and invoices after year end are where an unrecorded year-end liability usually surfaces, because the bill arrives or gets paid after the books close.

The selection is every disbursement over $25,000 in that period, identified by payment number. Selecting all items above a threshold means no projection is needed: every item that met the criterion was tested. AS 1215.10 accepts this approach, saying that when all items over a specific amount are selected, the documentation need only describe the scope and identify the population. The workpaper records both the source journal and the threshold, so a reviewer could reproduce the selection.

Testing Results

For each item, the auditor inspected the vendor invoice and supporting documents, identified when the goods or services were received, and checked whether a liability had been recorded at year end.

Each row cross-references the invoice and receiving evidence stored in the file, so the reviewer can check any result against its source.

Exception, Conclusion and Sign-Off

Payment 10447 covers facility maintenance performed in December 2025 and invoiced in January. No liability was recorded at year end, so accounts payable was understated by $48,200.

The auditor discussed the item with the controller, who confirmed the timing, and carried it to the summary of identified misstatements at S-3. AS 1215.12 requires accumulated misstatements, and the evaluation of any left uncorrected, to be documented, and the cross-reference connects this workpaper to that evaluation.

The conclusion matches the objective: "Based on the procedures performed, and subject to the misstatement recorded at S-3, liabilities for goods and services received on or before December 31, 2025 were recorded in accounts payable."

Sign-off: prepared by J.M., March 6, 2026; reviewed by R.K., audit manager, March 9, 2026.

Every component from the table in the previous section appears in this one workpaper, and a reviewer can follow it from objective to conclusion without asking the preparer anything.

The Experienced Auditor Test: Can Someone Else Follow Your Workpapers?

The single most useful question to ask of any workpaper is whether someone who was never on the engagement could follow it.

That question is the test the standards themselves set. AS 1215.06A requires documentation to contain enough information for an experienced auditor, having no previous connection with the engagement, to understand the nature, timing, extent and results of the procedures performed, the evidence obtained and the conclusions reached, and to determine who did the work and who reviewed it, and when. The PCAOB defines an experienced auditor as someone with a reasonable understanding of audit activities who has studied the company's industry and its accounting and auditing issues. AU-C 230, paragraph .08, sets the same test for US private company audits, and ISA 230, paragraph 8, sets it internationally.

The test works best as a chain. A reviewer should be able to follow every link without a gap:

1. The risk or assertion that made the work necessary
2. The objective the work was designed to answer
3. The procedure performed
4. The population and selection the procedure was applied to
5. The evidence obtained for each item
6. The result for each item
7. Any exception, and what was done about it
8. The conclusion, matched to the objective
9. The review, with the reviewer's name and date

When a link is missing, the workpaper may look complete and still fail the test. A conclusion with no stated population cannot be evaluated. A result with no cross-reference to evidence cannot be checked.

There is a practical form of the test that every engagement team already knows: review notes. A note asking "what exactly did you do here?" is the test failing in real time. A good workpaper keeps those notes down, which saves the reviewer's time, the preparer's time, and the engagement's budget.

Audit Documentation Requirements: AS 1215, AU-C 230 and ISA 230 Compared

Which standard applies depends on the engagement. The three agree on the experienced auditor test and differ on deadlines and retention.

Two details in the table are easy to miss. The US standards count from the report release date, the date the auditor grants permission to use the report, while ISA 230 counts from the date of the auditor's report. And national law can lengthen the ISA retention period, as some countries do.

The PCAOB's 14-Day Documentation Completion Date

For public company audits, the window to assemble the final file is now 14 days. The PCAOB cut it from 45 days in its 2024 release adopting AS 1000. The change applies to firms that issued audit reports for more than 100 issuers in 2024 for fiscal years beginning on or after December 15, 2024, and to all other registered firms for fiscal years beginning on or after December 15, 2025.

Many study guides and practitioner pages still quote 45 days, so it is worth checking any internal methodology document that was written before the change.

AS 1215.15 also makes clear what the 14 days are for. Before the report release date, the auditor must already have completed all necessary procedures and obtained sufficient evidence, and the engagement partner and other supervisors must have completed their reviews. The 14 days are for assembling and archiving a file whose audit work is already finished.

Changing Workpapers After the File Is Assembled

Once the documentation completion date has passed, the file is effectively closed. Under AS 1215.16, audit documentation must not be deleted or discarded after that date, although information may be added. Anything added must show the date it was added, the name of the person who prepared it and the reason for adding it. ISA 230, paragraph 16, requires the same kind of record: the specific reasons for a change, and when and by whom it was made and reviewed.

AS 1215.09 deals with the harder case, where documentation turns out to be missing after the completion date. The auditor must then demonstrate, with persuasive other evidence, that the procedures were performed and the conclusions were appropriate, and the standard states that oral explanation alone does not count. If the auditor cannot demonstrate it, the standard on omitted procedures applies. The practical lesson is simple: work that is not in the file cannot be reliably added later.

Why Audit Workpapers Become Hard to Review

Most review problems come from a broken link in the chain from objective to conclusion. These are the common ones:

• A vague objective. "Test revenue" does not tell a reviewer which question the work answers, which assertion it addresses, or what a pass would mean
• A conclusion broader than the procedure. The team tested one thing and concluded on something wider, such as testing cutoff for one location and concluding on payables for the whole company
• An undocumented population. Nobody can tell what the selection represents, so the conclusion cannot be evaluated
• Evidence that exists but cannot be traced. "See support" sends the reviewer searching through the file for the document behind a result
• Prior-year files rolled forward without thought. Dates and amounts change while the procedure stays the same, even though the client's process, systems or risks have changed
• Contradictory information left out. AS 1215.08 requires information that is inconsistent with the final conclusions to be documented, together with how it was resolved. A file that shows only the supporting evidence invites the question of what else was seen
• Review notes doing the documenting. The workpaper only makes sense after the manager has asked three questions, and the answers live in the review notes rather than the workpaper
• The preparer as the only record. If the explanation exists only in someone's memory, it does not survive the documentation completion date, because oral explanation alone is not persuasive evidence

Two related problems belong to evidence intake rather than documentation: several versions of the same client file, and figures copied into a workpaper with no record of where they came from. Our guide to PBC lists covers how to prevent both when evidence arrives.

Each failure on the list shows up the same way: as a review note, an inspection comment, or next year's team redoing work that should have been clear the first time.

What to Automate in Audit Workpaper Preparation

Much of workpaper preparation is mechanical, some of it needs judgment, and the line between them decides what to automate.

Good candidates for automation:

• Creating workpaper shells from the firm's templates for each engagement
• Updating entity, period and engagement details across the file
• Importing trial balance and ledger data, and populating lead schedules
• Extracting figures from supporting documents
• Tying figures between source documents and schedules
• Maintaining cross-references as workpapers change
• Drafting status summaries and first-pass descriptions of procedures performed

Work a tool can assist with, under the reviewer's control:

• Matching evidence to the items selected for testing
• Flagging missing or inconsistent support
• Comparing evidence against the attributes being tested
• Drafting exception descriptions and variance explanations for the auditor to edit
• Surfacing inconsistencies across workpapers, such as a balance that differs between a lead schedule and a detail schedule

Work that stays with the auditor:

• Deciding whether evidence is sufficient and appropriate
• Deciding whether an item passes, and whether an exception is significant
• Changing the audit response when results require it
• Exercising professional skepticism
• Reaching the conclusion and signing off

The first group is where most of the hours go, and automating it frees senior time for the third. The middle group is where design matters most, because a tool that drafts an exception description can shape how the auditor thinks about it. Our article on how accurate AI needs to be for accounting automation covers how to set accuracy thresholds by task, so that the riskiest steps get the most review.

Requesting and receiving client evidence is a separate workflow, covered in our guide to PBC lists.

The Automation Trail: Documenting What AI and Other Tools Did

There is no separate documentation rulebook for automated work. The same test applies, so the file has to show what each tool did.

The PCAOB made this explicit. In June 2024 it adopted amendments covering audit procedures that use technology to analyze information in electronic form, approved by the SEC that August and effective for audits of fiscal years beginning on or after December 15, 2025. In its adopting release, the Board said the existing documentation requirements in AS 1215 apply also to procedures involving technology-assisted analysis, and it judged further documentation requirements unnecessary. A tie-out a tool performed has to be as understandable to an experienced auditor as one a person performed.

In practice, that means recording the following for every figure or fact a tool places in a workpaper:

Take a figure extracted from a client's bank statement into a cash workpaper. A reviewer should be able to trace it to the statement file and version, the page and line it came from, any rounding or conversion applied, whether a team member edited it, and who approved it. Without that record, automation replaces manual copy-and-paste with copy-and-paste nobody can see.

Two rules make the trail essential rather than optional. AS 1215.09 means that an undocumented step cannot be supported later by explanation, and a tool cannot be asked what it meant. And AS 1215.16 means a tool that keeps updating workpapers after the documentation completion date must preserve the original and record each addition with its date, author and reason. A tool that silently refreshes an archived file creates exactly the kind of problem the PCAOB's staff practice alert on improper alteration of audit documentation addresses.

The trail is what makes automated preparation reviewable, and reviewable work is the only kind the documentation standards accept.

How Codebridge Builds Workpaper Preparation Workflows

Our WIP and Realization Monitoring workflow can be scoped to audit workpaper preparation ahead of sign-off, as described on our professional services page. It prepares the mechanical parts of the file described above: shells, data imports, lead schedules, tie-outs and cross-references. It records the trail for every figure it places, and routes anything that needs judgment to the reviewer, with the source attached. Sign-off stays with the engagement team, and every action the workflow takes is logged.

One workflow goes live in three weeks, wired into the firm's audit and document systems, and your firm owns the repository, the prompts and the configuration from day one.

The closest reference we can offer, labelled for what it is: Knowledge Cloud, built for a Big Four tax and legal practice, runs an expert review queue with an immutable audit log, so a senior practitioner approves each output before the firm acts on it. A knowledge platform rather than an audit system. What it demonstrates is the review and audit-trail pattern this article describes.

Our founding team spent more than a decade at KPMG.

If you want to find out where your workpapers collect review notes, book a 20-minute call.