Good audit documentation tells the story of the audit. Here, Graham Gardner explores where auditors may be going wrong, the benefits of getting it right and what ‘good’ looks like.
Despite its importance, many audit teams struggle with the task of properly documenting their work, leading to external reviewers or regulators raising concerns. All too often, it is not that the auditors haven’t done the necessary work or fully understood the matters at hand, or even that they failed to challenge management, but rather that they failed to sufficiently document these on their file. As a result, there are many times when audit teams do not receive credit for the hard work they have done.
Some of the responses that external reviewers hear when they raise concerns about a lack of proper documentation will, I suspect, be familiar to many. “We did the work but didn’t put it on file.” “We did the work, but the file didn’t make it clear.” “The audit platform didn’t prompt us for this.” “It’s obvious, isn’t it?” “Management gave us the evidence we needed, see X.” Perhaps, most painful of all: “It’s covered on… oh?”
The requirement to prepare sufficient and appropriate documentation appears throughout International Standards on Auditing (ISAs), not just in the documentation standard ISA 230. Getting audit documentation right is clearly important – and why this matters is explored in the recent faculty webinar Quality documentation – getting it right first time.
Why auditors struggle with documentation
Anecdotally, documentation as a weakness is often a feature of a firm’s root cause analysis regarding an identified deficiency. Contributory factors have been noted to include:
- a lack of or inappropriate staff allocated to the audit;
- poor project management; or
- problems arising that were outside the auditor’s control.
All of these factors add to time pressure on the audit and clearly have a contributory role to the deficiency arising. Those who look deeper, however, may identify two much more impactful causes: culture and understanding.
Culture
The standard of audit documentation prepared generally reflects culture within a firm. It can be a learned habit, based on what auditors have seen from their prior year audit files and what is deemed as acceptable by managers and responsible individuals (RIs).
The importance of audit documentation is not always fully appreciated by all members of an audit team. In some instances, reviewer feedback on shortcomings in audit documentation is dismissed with the phrase: “It’s just a documentation point.”
Documenting is auditing and auditing must include documenting – there should be no separation of the two
This approach seems to assume that documentation is “nice to have” rather than an essential part of auditing, but this is far from the truth. Documenting is auditing and auditing must include documenting – there should be no separation of the two.
The idea that audit documentation requirements in the ISAs can be skipped without negative impacts is simply not true.
Understanding
Lack of understanding about the purpose of documentation can be a significant factor behind weaknesses. An audit file is not just a storage space for work papers – it’s a record of the audit team’s thought process, objectivity and how they engaged with the information gathered during the audit.
Think of it like a prosecutor building a case: gathering evidence to present a compelling argument. Similarly, auditors must document everything, from analysis to conclusions, so that an independent third party (such as a regulator or expert witness) can understand the audit’s findings. The audit file, when read end to end, must present the auditor’s compelling case for their opinion.
ISA 230 requires that documentation must be sufficient for an experienced auditor, having no previous connection with the audit, to understand:
- the nature, timing and extent of the audit procedures performed;
- the results of the audit procedures performed and the audit evidence that was obtained from those procedures; and
- significant matters arising from the audit, conclusions reached thereon and significant professional judgements made in reaching those conclusions.
Too often, the phrase “I don’t understand…” is used in the notes of file reviewers; this is an indication that documentation is fundamentally not being prepared with the external reviewer in mind.
Just as in a trial, where the prosecutor’s case is not made for their own benefit but for the jury, so too our audit documentation should not be prepared for our purposes as auditors. Our jury and the entity we need to persuade is the independent third party: the experienced auditor who has no previous connection with the audit, as per ISA 230. Very often as auditors, we forget this.
What good documentation looks like
‘Good’ is a file that tells the story of the audit: from start to end with each section of the file describing the work that was done to conclude on that element.
When performing each procedure, we should document who, when, what, why and how it was done, our expectations, the results, what was done following those results being obtained and our basis for the conclusion reached. In ‘good’ audit documentation, the concluding section of the file shows how all that evidence comes together in support of the final opinion.
We should avoid using imprecise audit phrases such as “I challenged management”, “I checked this” or “I gained comfort” or contextless expressions such as “deemed reasonable”, “in line with expectation”, “done” and “N/A” without further description. In all cases, we need to be specific and exact.
As auditors, we should think of documentation as a chance to illustrate how we achieved the objectives of an audit procedure and ensure there is a valid basis for the conclusions reached i.e. that we have sufficient appropriate evidence to support them.
Remember, if it isn’t documented, it isn’t done. The full story of the procedure from start to end is needed – not just the final position. The value in the audit is in how we exercised our challenge of management and, ultimately, how numbers and disclosures changed as a result of our audit.
We need to ask ourselves whether the audit file will still make sense if picked up cold six months or even six years from now
There are many examples of audit teams not receiving the credit for their good work simply because they only included a final position on the audit file, omitting the steps they performed along the way. We need to ask ourselves whether the audit file will still make sense if picked up cold six months or even six years from now.
Remember that documentation is not simply management’s information copied into a file repository. The purpose of the information gathered is not to support management’s financial statements – it is to support our audit opinion. While our documentation may include information produced by management, the narrative around how that evidence contributes to our audit opinion is the critical element.
Benefits of good documentation
High quality audit documentation can deliver many benefits. It can:
- Facilitate better communication across the audit team.
- Improve focus on key issues and provide a clearer understanding of what matters.
- Enable more efficient and effective file reviews.
- Allow team leaders to assess the adequacy of the work performed.
- Foster better client engagement by identifying relevant issues emerging from the audit.
- Be crucial in defending claims and maintaining a firm’s reputation.
By taking the time to document thoroughly from the start, audit teams can avoid later complications, streamline the audit process, and ultimately perform this more efficiently.
Try to remember the phrase “Write it right, write it once”. If we document our work properly from the outset, we’ll not only avoid problems later down the line but also improve the quality and efficiency of the audit.
Graham Gardner, Audit Partner and Head of Technical, Kreston Reeves
Other ICAEW resources
Audit documentation – a lawyer’s perspective Simple steps to avoid the hidden costs of poor documentation
Tips on audit documentation Avoid and address areas of weakness with practical pointers from the Financial Reporting Council and ICAEW’s Quality Assurance Department (QAD).
Quality documentation – getting it right first time Specialists share insights and good practice techniques to help auditors overcome documentation challenges.
Reviewing audit file assembly procedures Strengthen file assembly, completion and safeguarding procedures, with insights and reminders from QAD.
