ISA 230

Audit Documentation

1Objective and scope

ISA 230 deals with the auditor's responsibility to prepare audit documentation for an audit of financial statements. It sets the purpose, form, content and extent of documentation, the timing of its assembly into the final file, and the treatment of changes after the date of the report. Other ISAs contain their own specific documentation requirements (ISA 240 on fraud, ISA 315 on risk assessment, ISA 550 on related parties, and so on); ISA 230 is the general requirement all of them build on, and it does not limit the additional documentation law or regulation may demand.

The objective is for the auditor to prepare documentation that provides a sufficient and appropriate record of the basis for the auditor's report, and evidence that the audit was planned and performed in accordance with the ISAs and applicable legal and regulatory requirements. Documentation also assists planning, direction and supervision, accountability of the team, retention of a record of matters of continuing significance, quality reviews and inspections, and external inspections by regulators such as ICPAK's practice review.

2Key definitions

3Requirements

Form, content and extent

The auditor prepares documentation that is sufficient to enable an experienced auditor, having no previous connection with the audit, to understand (a) the nature, timing and extent of the audit procedures performed to comply with the ISAs and legal requirements, (b) the results of those procedures and the evidence obtained, and (c) significant matters arising, the conclusions reached on them, and the significant professional judgements made in reaching those conclusions. Documentation is prepared on a timely basis, that is, during the audit and not reconstructed afterwards.

• In recording the nature, timing and extent of procedures, the auditor records the identifying characteristics of the specific items or matters tested (invoice numbers, the population and selection method for a sample, the names of persons interviewed), who performed the work and when it was completed, and who reviewed it, the date and the extent of the review.
• Significant matters include those giving rise to significant risks, results indicating that the financial statements could be materially misstated or that risk assessments need revising, circumstances causing significant difficulty in applying procedures, and findings that could lead to a modified opinion or an Emphasis of Matter paragraph.
• Discussions of significant matters with management, those charged with governance and others are documented, including the nature of the matter, when and with whom it was discussed.
• Where the auditor identifies information inconsistent with the final conclusion on a significant matter, the auditor documents how the inconsistency was addressed. Superseded drafts, incomplete notes and duplicate copies need not be kept.
• If in exceptional circumstances the auditor departs from a relevant requirement of an ISA, the auditor documents how the alternative procedures performed achieve the aim of that requirement and the reasons for the departure.
• Oral explanations by the auditor alone do not represent adequate support for the work or its conclusions, though they may explain or clarify documented information.

Assembly of the final file

The auditor assembles the audit documentation in an audit file and completes the administrative process of assembly on a timely basis after the date of the auditor's report, within the firm's limit of ordinarily not more than 60 days. Assembly is administrative only: deleting superseded documents, sorting, collating, cross-referencing, signing off checklists and documenting evidence obtained, discussed and agreed with the team before the report date. No new audit procedures are performed and no new conclusions are drawn in this period.

Changes after the report date

• After assembly is complete the auditor does not delete or discard documentation of any nature before the end of its retention period (ISQM 1 requires at least five years from the date of the report, or the group report if later; Kenyan regulation and the firm's policy may require longer).
• If, in exceptional circumstances, the auditor performs new or additional procedures or draws new conclusions after the report date (for example on discovering a fact under ISA 560), the auditor documents the circumstances, the new procedures, evidence and conclusions, and when and by whom the changes were made and reviewed.
• Any modification to existing documentation or addition of new documentation after the file is assembled must record the specific reasons for the change and when and by whom it was made and reviewed, so the audit trail is preserved.

4Documentation and reporting

ISA 230 is the standard about documentation, so its own record is the file: a well-referenced set of working papers, typically split into a permanent file (constitution, long-term contracts, systems descriptions, prior year analytical data) and a current file (planning memorandum, risk assessment, materiality, programmes, lead schedules, evidence, misstatement schedules, representations, completion memoranda and the signed report). Ownership of working papers rests with the auditor, and the firm's confidentiality and retention policies under ISQM 1 govern access, storage and destruction. Nothing in the file reaches the auditor's report except through the conclusions it supports.

5Examinable focus