Audit Documentation & Working Papers: Standards, Templates & Best Practices

SA 230 — Audit Documentation Standard: Core Requirements

SA 230 — Audit Documentation is the ICAI Standard on Auditing that establishes the framework for documenting audit work. It is equivalent to ISA 230 of IAASB and closely mirrors PCAOB AS 1215 for US-listed company audits. SA 230 recognizes that audit documentation serves multiple purposes: it provides evidence that the audit was conducted in accordance with SAs, supports the auditor's opinion, and facilitates quality control and peer review.

The "Experienced Auditor" Standard

SA 230 introduces the concept of the "experienced auditor" — documentation must be sufficient for an experienced auditor, having no previous connection with the engagement, to understand:

1. The nature, timing, and extent of audit procedures performed
2. The results of those procedures and the audit evidence obtained
3. Significant matters that arose during the audit
4. The conclusions reached and the professional judgments exercised

This standard is both a floor (minimum documentation) and a quality test — if a peer reviewer cannot understand what was done and why from the working papers alone, the documentation is deficient regardless of how good the actual audit work was.

What Must Be Documented Under SA 230

Assembly and Retention of Audit Files

SA 230 requires the auditor to assemble the final audit file within 60 days after the date of the audit report. After assembly, the file is considered complete and no new documentation should be added. SA 230 prohibits deletion or discarding of documentation before the end of the retention period. Under ICAI's guidelines, audit files must be retained for a minimum of 7 years from the date of the audit report.

Permanent File vs Current File — Structure and Contents

All organized audit engagements divide documentation into two distinct files. Understanding this structure is foundational for any CA articled assistant starting their first audit engagement.

Permanent Audit File (PAF)

The Permanent File contains information of ongoing relevance to the client that does not materially change from year to year. It is built up over time and carried forward:

• Legal and entity documents: MOA, AOA (Companies Act 2013), Certificate of Incorporation, partnership deed, trust deed
• Shareholder and ownership structure: List of directors, significant shareholders, group structure chart
• Significant contracts: Long-term lease agreements, major customer/supplier contracts, loan agreements with banks, debenture trust deeds
• Accounting policies: Client's documented accounting policies manual (depreciation method, inventory valuation, revenue recognition)
• Internal control documentation: Organizational charts, authority matrices, system flowcharts, IT general controls documentation
• Tax registrations: PAN, GST registration certificates, import-export code, MSME registration
• Prior year findings: Key issues from previous audits relevant to current year assessment

Current Audit File (CAF)

The Current Audit File is created fresh for each financial year and contains all documentation relevant to the current year's audit:

• Engagement letter and terms of appointment
• Audit planning memorandum — entity background update, materiality calculation, audit strategy
• Risk assessment working papers — inherent risks, control risks, RMM by assertion
• Audit programs — planned procedures for each balance sheet and P&L caption
• Lead schedules — summary of each account balance with prior year comparatives and movement explanations
• Detailed working papers — vouching lists, physical verification reports, bank reconciliation review, receivables aging analysis
• Audit evidence — management accounts, bank statements, board minutes, invoices, contracts
• Management representation letter
• Summary of unadjusted differences (SUD) / Points for Partner Attention (PPA)
• Audit report draft and signed final copy

Indexing Systems, Tick Marks & Lead Schedules

Working Paper Indexing

A consistent indexing system is essential for organized, navigable working papers. The standard approach used by most CA firms and Big 4 teams in India is an alphanumeric index:

Tick Marks and Working Paper Symbols

Tick marks (symbols) are standardized notations used in working papers to indicate the nature of audit work performed on a specific figure or item. Every firm maintains a tick mark legend at the front of the working paper file. Common tick marks used in Indian CA practice include:

• ✔ (Tick / Check mark): Vouched to supporting document
• ✓ (Small tick): Arithmetically verified / cross-referenced
• CF (Cross-footed): Column totals agree
• TB (Traced to Trial Balance): Amount agrees with TB
• PY (Prior Year): Agreed with prior year audited figures
• C (Confirmed): Balance confirmed by third party
• ^ (Recalculated): Figure independently recalculated and agrees
• SR (Subsequent Receipt): Debtor balance confirmed by subsequent cash receipt
• N (No exception): Procedure performed with no exceptions noted
• WP ref A3: Cross-reference to another working paper section

Lead Schedules — The Backbone of Working Papers

A lead schedule is a summary working paper for each balance sheet or P&L caption that shows the breakdown of the account balance, prior year figures, current year movement, audit references to detailed testing, and the auditor's conclusion. Every major account should have a lead schedule.

A typical lead schedule for Trade Receivables might look like:

• Gross debtors per TB (ref C1): ₹2,45,00,000
• Provision for bad debts: (₹18,50,000)
• Net debtors: ₹2,26,50,000
• Audit references: Aging analysis (F1), Circularization (F2), Subsequent receipts (F3), Provision adequacy (F4)
• Conclusion: Net debtors appear reasonably stated. Provision is adequate based on aging analysis and historical collection data.
• Auditor initials, date, partner review date

SALY Concept, Risk-Based Documentation & Sampling Records

SALY — Same As Last Year

SALY (Same As Last Year) is a significant audit quality concern. It refers to the practice of copying prior year working papers without adequately updating them for current year circumstances. ICAI's Quality Review Board has identified SALY as one of the most common deficiencies in audit documentation during quality reviews.

What SALY looks like: An articled assistant copies the prior year depreciation working paper and changes only the figures, without re-evaluating whether the client's depreciation policy is still appropriate, whether new additions were correctly classified, or whether the useful lives are reasonable compared to industry peers. The risk is that a systemic error in the prior year gets perpetuated without detection.

The correct approach is to use prior year working papers as a starting point but actively reassess each area:

• Has the accounting policy changed?
• Are there new transactions or structures not covered in prior year work?
• Have prior year risks materialized or changed?
• Has the business grown or contracted in a way that changes the nature of risk?

Documentation for Risk Assessment Procedures

Under SA 315 (Identifying and Assessing Risks of Material Misstatement), the auditor must document:

• The risk identification process — entity understanding, industry context, analytical procedures
• Identified risks at the financial statement level and at the assertion level (for each class of transactions, balances, and disclosures)
• Whether each identified risk is a significant risk requiring special audit attention
• The auditor's evaluation of the design and implementation of controls relevant to identified risks

Sampling Documentation Under SA 530

When the auditor uses sampling, SA 530 requires documentation of:

• Description of the population — "All sales invoices above ₹1 lakh for April–December 2024"
• Sampling unit — the invoice
• Sample size and the basis for determining it (risk of material misstatement, tolerable error, expected error)
• Sampling method — random (using random number tables), systematic (every nth item), or monetary unit sampling (MUS)
• Sample items actually selected and procedures performed on each
• Errors found in the sample and their nature (monetary vs compliance)
• Projection of sample results to the population and conclusion

Electronic Working Papers, EWP Tools & Big 4 Best Practices

Electronic Working Papers (EWP) are the standard in modern audit practice. They replaced physical ring binders and paper files, enabling structured templates, automatic cross-referencing, version control, and remote access — the last of which became critical during the COVID-19 pandemic and remains essential for hybrid audit models.

Leading EWP Tools in Indian Audit Practice

ICAI Standards vs PCAOB Standards — Key Differences in Documentation

Common Documentation Deficiencies Found in ICAI Quality Reviews

The ICAI's Quality Review Board has repeatedly cited the following deficiencies in audit documentation during firm-level quality reviews:

• No materiality calculation documented: Auditors assume materiality without documenting the basis (often 5% of PBT or 0.5–1% of revenue for different purposes)
• Absent or incomplete risk assessment: No identified risks of material misstatement; risk matrix missing or generic
• SALY working papers: Prior year documents simply rolled forward with figures changed but rationale not reassessed
• Missing conclusion statements: Working papers document procedures performed but do not include an explicit conclusion on whether the account is fairly stated
• Unsigned or undated working papers: Preparer and reviewer initials or dates missing, making quality review chain impossible to trace
• No documentation for significant judgments: Management's accounting estimates (provisions, useful lives, fair values) accepted without documenting the auditor's independent assessment
• Incomplete sampling documentation: Sample selected but no population description, no error extrapolation, and no conclusion on tolerable vs projected misstatement

Big 4 Working Paper Best Practices

Big 4 firms (Deloitte, EY, KPMG, PwC) in India follow highly structured documentation protocols developed over decades. Key best practices observed:

1. Every working paper has a header: Client name, financial year, section reference (e.g., F2 — Receivables Circularization), preparer name/initials, date prepared, reviewer initials, date reviewed
2. Objective-Procedures-Results-Conclusion (OPRC) format: Each working paper states its objective, the procedures performed, the results/findings, and an explicit conclusion
3. No orphan working papers: Every working paper is cross-referenced from a lead schedule or the audit program — no document exists without a clear linkage
4. Review notes are documented: When a reviewer raises a query, both the query and the preparer's response are documented in the working paper system (TeamMate+/EY Canvas tracks this automatically)
5. EWP lock-down after assembly: After the 45/60-day assembly window, working papers are locked in the system and cannot be modified — compliance with SA 230's no-deletion requirement
6. Color-coded status: Working papers are flagged as Draft (yellow), Under Review (orange), or Completed/Signed Off (green) within the EWP system, giving the engagement partner real-time visibility of audit completion status