How much audit documentation is enough?

Peer review to receive heightened focus

by Faye Hayhurst, CPA, MNCPA director of finance and administration and Brian Bluhm, CPA, partner, Eide Bailly LLP | December 2017/January 2018 Footnote

Editor's note: Updated Nov. 28, 2017

Imagine you are an audit partner in a thriving CPA practice. Your audit clients are in industries you know well, and many of the clients have been with you well over a decade.

You're conscientious in obtaining plenty of hours of audit-related CPE. You've been faithful in having a peer review of your firm in the required timeframe for as long as you can remember. The peer reviewer has had helpful comments from time to time, but your firm has always received the highest rating (under current standards, a "Pass").

But, this year, the peer reviewer is talking about one of the reviewed engagements not meeting the professional standards in all material respects (a "nonconforming engagement"). It's possible this could result in a deficiency being noted in the firm's peer review report.

What happened? Did something change?

What happened is the AICPA's increased effort to enhance audit quality throughout the CPA profession.

A first step was gathering data, with the AICPA peer review program as a prime source. One piece of the data-gathering process has been the peer review enhanced oversight program, where individual audit engagements from a peer review are combed through by a subject matter expert to determine if the engagement was performed in accordance with professional standards (and, if not, whether the peer reviewer arrived at that conclusion).

The takeaway statistic from the first two years of the program is one in four audit engagements reviewed in enhanced oversight was considered nonconforming due to inadequate documentation. Also revealed was a lack of agreement between CPAs -- including peer reviewers -- on what constitutes sufficient audit documentation.

In response, AICPA peer reviewer training has emphasized the importance of audit documentation in supporting the audit opinion issued by a firm. There is more guidance on evaluating audit workpapers. Peer reviewers have been instructed on what level of oral explanation as a supplement to the written documents is acceptable, and at what point that supplementation indicates documentation is insufficient. They've been warned against giving a firm credit for performing procedures that aren't clearly supported by the audit documentation.

Interestingly enough, what hasn't changed is the audit documentation standard itself.

Know the standards inside and out

According to AU-C 230 Audit Documentation, documentation is to be prepared to allow an experienced auditor with no connection to the audit to understand the:

  • Nature, timing and extent of procedures performed
  • Results of those procedures and evidence obtained
  • Significant findings, issues identified and professional judgments made

What might CPAs be doing that doesn't meet this standard? Here are a few examples:

  • Failing to document how and why a sample was selected.
  • Signing off on an audit program step with no workpaper reference or additional explanation in the audit program itself.
  • Documenting inquiries without stating who was interviewed or when.
  • Preparing a workpaper with many columns and rows of data and tickmarks, but lacking information on where the data came from, what is being tested, what audit steps are being performed and/or explanations for the tickmarks.
  • Performing a risk assessment, but not showing how it is linked to the audit plan.
  • Not documenting the basis of expectations for various analytical procedures, or how variances from expectations were explained and those explanations substantiated.

Unfortunately, it is not uncommon that the CPA may have performed the audit to fully support the opinion issued; however, without adequate documentation to back up the work performed, peer reviewers may have no choice but to identify the engagement as nonconforming. The standards indicate that oral explanations should not be required to support the documentation included in the workpapers.

Strategies for ensuring compliance

Ironically, knowing clients and industries well can play a role in documentation issues. Familiarity with industries and clients is always an asset, as long as an auditor keeps in mind the very real subconscious tendency to shorten explanations when familiarity is high. Fortunately, there are strategies for overcoming this inclination.

  • Prepare the workpaper with the reviewer in mind -- and not just any reviewer, but a reviewer who may not be familiar with your work, your firm or the client. Remember, the standard says that an experienced auditor with no connection to the audit should be able to understand the scope of work performed, any issues identified and the results of those procedures.
  • Go through a mental checklist before considering any workpaper complete. Is it clear who prepared it, why it was prepared and what was learned and concluded from the work performed?
  • Use the firm's annual internal monitoring to take a fresh, objective look at audit files. If a lack of clarity is noted, provide training to auditors and consider monitoring more frequently.
  • Perform file reviews that allow for a "separate set of eyes." This can be difficult for sole practitioners. However, the audit standards are the same for all firms, regardless of size. It's imperative for practitioners, either by collaborating with a colleague or contracting with another firm, to find a way to ensure that their work is as clear as it needs to be.

Moving forward

Reasonable people can disagree about workpaper formats and styles. They can disagree about exact wording and details of content. A determination of adequacy can often be a judgment call. However, it shouldn't be necessary for a reviewer to solve a puzzle, read an auditor's mind or have a lengthy conversation in order to understand the work completed by the auditor. Each workpaper needs to live up to the AU-C 230 standard. And, remember, that volume (of words and/or numbers) is no substitute for clarity.

Expect your firm's next peer review to have a heightened focus on documentation and be prepared. Don't let documentation shortcuts lead to a peer review detour.

Faye Hayhurst, CPA is the director of finance and administration for the Minnesota Society of CPAs. She is responsible for administering the peer review program at the MNCPA. You may reach Faye at or 952-885-5540.  

Brian R. Bluhm, CPA, is a partner and director of assurance services for Eide Bailly LLP. He is a member and past chair of the MNCPA Peer Review Committee, as well as a member of the AICPA Peer Review Board and AICPA National Peer Review Committee. 


Resources are available

The AICPA has developed many resources that are available at no charge on the AICPA website. These include:

  • A working paper template practice aid
  • FAQs with answers to some of the most common questions the AICPA receives about documentation
  • Internal Inspection Aid, designed to support those performing the inspection as they identify and address documentation deficiencies
  • A PowerPoint presentation (with speaker notes) to use in training a firm's audit personnel
  • Nano-learning segment that has a brief overview of AU-C 230, including common misconceptions about audit documentation
  • Employee benefit plan tool to assist firms in documenting procedures and findings related to controls at a service organization that are likely to be relevant to an employee benefit plan's internal control over financial reporting
  • Governmental dual-purpose testing practice aid that illustrates auditor documentation for a dual-purpose test of compliance and internal control over compliance for
    several requirements

All these resources can be found within the AICPA's Private Company Practice Section, "Invigorate the Focus on Quality" toolkit.