Skip to main content
Regulatory Council
a promotional graphic telling you that PCI Compliance is no longer an annual exercise and that continuous monitory must be built in
Category: Internal Controls & Audit

Audit Working Papers

Also known as: Working Papers, Work Papers, Audit Workpapers, Audit Documentation
Simply put

Audit working papers are the records an auditor keeps to show what they did during an audit and why they reached their conclusions. They typically capture the procedures performed, the tests carried out, the information gathered, and the conclusions drawn. In essence, they are the documented trail that supports the findings and opinions in an audit report.

Formal definition

Audit working papers, also referred to as work papers, audit workpapers, or audit documentation, are the records maintained by an auditor of the procedures applied, the tests performed, the information obtained, and the pertinent conclusions reached during an engagement. In the standards referenced here, this work product serves as the support for the conclusions expressed in the auditor's report, providing evidence of the evidence obtained, procedures performed, and conclusions drawn. The specific form, content, and retention requirements for such documentation are governed by applicable auditing standards and may vary by engagement type, jurisdiction, and the professional standards under which the audit is conducted; practitioners should verify particular requirements against the primary source standards.

Why it matters

Audit working papers are the evidentiary backbone of any audit. Without them, an auditor's findings and opinions rest on assertion alone; with them, there is a documented trail showing what procedures were applied, what tests were performed, what information was gathered, and how the conclusions were reached. In many auditing standards, this documentation serves as the primary support for the conclusions expressed in the auditor's report, making it central to the credibility and defensibility of the audit itself.

Because working papers demonstrate the connection between evidence obtained and conclusions drawn, they are what allows an audit to be reviewed, challenged, or re-performed by another competent professional. This matters for quality control within an audit function, for oversight by regulators or peer reviewers, and in circumstances where an audit's rigor is later questioned. Inadequate or incomplete documentation can undermine confidence in an audit's conclusions even where the underlying work was sound, since the standards generally treat the documentation as the evidence that the work occurred.

The specific form, content, and retention expectations for working papers vary by engagement type, jurisdiction, and the professional standards under which the audit is conducted. Requirements under frameworks such as the PCAOB standards apply in particular contexts and may differ from those governing other engagement types. Practitioners should verify the particular requirements applicable to their engagement against the primary source standards rather than assuming a single universal expectation.

Who it's relevant to

Internal Auditors
Internal auditors prepare working papers as the documented support for their procedures, tests, and conclusions. Sound documentation allows their work to be reviewed within the audit function and demonstrates the basis for findings reported to management and the audit committee.
External and Financial Statement Auditors
For external auditors, working papers, referred to in some standards as audit documentation, serve as the work product supporting the conclusions expressed in the auditor's report. The applicable professional standards, such as those issued by the PCAOB in certain contexts, govern the form, content, and retention of this documentation.
Audit Committees and Governance Bodies
Those charged with oversight rely on the assurance that audit conclusions are properly supported. While they may not review working papers directly, an understanding of the role documentation plays helps them gauge the rigor and defensibility of the audit work presented to them.
Regulators and Peer Reviewers
Oversight bodies and peer reviewers use working papers to assess whether an audit was performed and documented in accordance with the applicable standards. The documentation is often the primary means by which the quality of the underlying work can be independently evaluated.

Inside Audit Working Papers

Audit Planning Documentation
Records that capture the audit's scope, objectives, risk assessment, and the planned nature, timing, and extent of procedures. These typically evidence how the auditor scoped the engagement and identified areas warranting attention.
Evidence of Procedures Performed
Documentation of the tests, inquiries, observations, inspections, and analytical work carried out, often including the population examined, sampling basis where applicable, and the results obtained. This forms the substantive backbone supporting conclusions.
Supporting Evidence and Records
Copies, extracts, or references to source materials such as documents, confirmations, correspondence, and data obtained from the auditee. These substantiate the assertions being tested and typically link findings back to underlying facts.
Findings, Conclusions, and Rationale
The auditor's observations, exceptions identified, and the reasoning connecting evidence to conclusions. This element typically demonstrates how professional judgment was exercised and how conclusions were reached.
Review and Sign-off Trail
Indications of who prepared and who reviewed each item, along with dates. This supervisory trail often supports accountability and quality control over the work performed.
Cross-References and Indexing
A referencing system linking working papers to one another and to the final report, which typically aids traceability from a reported conclusion back to its supporting evidence.

Common questions

Answers to the questions practitioners most commonly ask about Audit Working Papers.

Are audit working papers just the auditor's rough notes that can be discarded once the report is issued?
No. Although working papers do include the auditor's notes, they are more accurately understood as the formal record of the work performed, the evidence obtained, and the conclusions reached. In many audit frameworks they serve as the primary support for the audit opinion or findings and are typically subject to retention requirements rather than being treated as disposable drafts. Their status as a defensible record is often what distinguishes them from informal jottings, though specific retention obligations vary by jurisdiction, sector, and the standards under which the audit is conducted.
Do working papers belong to the auditee or the audited department since they document that department's activities?
Working papers document the auditee's activities, but ownership generally rests with the audit function or the auditor rather than the audited party. In common convention, working papers are considered the property of the audit organization, and access by the auditee or third parties is typically controlled. This distinction matters because working papers are the auditor's evidence of due professional care. Note that ownership, access, and disclosure can be affected by legal proceedings, regulatory demands, and jurisdiction-specific rules, which may require professional or legal advice to resolve.
What should an individual working paper typically contain to be considered adequate?
In many audit frameworks, an adequate working paper typically identifies the objective or purpose of the procedure, the source and nature of the evidence examined, the work actually performed, the results and any exceptions noted, and the conclusion reached. It is also common to record who prepared and who reviewed it, along with relevant dates and cross-references to related papers. The specific expectations vary by the standards applied and the type of engagement, so requirements should be confirmed against the governing methodology.
How should working papers be reviewed before findings are finalized?
A common practice is a supervisory or peer review in which a more senior reviewer evaluates whether the work performed supports the conclusions, whether procedures addressed the stated objectives, and whether evidence is sufficient and appropriate. Reviews are often documented through sign-offs or review notes that are then cleared. The depth and layering of review typically scale with the risk and complexity of the engagement, and the exact process depends on the audit function's methodology and applicable standards.
How long should working papers be retained?
Retention periods vary and are typically driven by applicable laws, regulatory requirements, professional standards, and internal policy rather than by a single universal rule. Because required periods differ by jurisdiction, sector, and engagement type, the applicable retention schedule should be verified against the relevant primary sources and the organization's own record-retention policy. Where litigation, investigation, or regulatory inquiry is anticipated, additional preservation obligations may apply and may warrant legal advice.
What controls help protect the integrity and confidentiality of working papers?
Common measures include restricting access to authorized personnel, maintaining version and change history, using secure storage whether physical or electronic, and applying clear procedures for cross-referencing, indexing, and archiving. These controls are intended to help preserve the completeness, reliability, and confidentiality of the record so it remains defensible if later relied upon. No control eliminates the risk of loss or unauthorized access entirely, and the appropriate combination typically depends on the sensitivity of the information and applicable requirements.

Common misconceptions

Working papers are merely an internal formality with little practical value once the audit report is issued.
Working papers typically serve as the primary evidence that the work was performed and that conclusions are supported. They are often relied upon in subsequent reviews, quality inspections, and, in some contexts, disputes or regulatory scrutiny, so their value commonly extends well beyond report issuance.
More documentation is always better, so working papers should capture everything possible.
The aim is generally sufficiency and relevance rather than volume. Well-prepared working papers typically document what a knowledgeable person needs to understand the work, findings, and conclusions, without extraneous material that obscures the audit trail.
Working papers definitively prove that the audited area is compliant or free of misstatement.
Working papers evidence the procedures performed and conclusions reached; they do not eliminate risk or guarantee an outcome. Because audits often rely on sampling and judgment, the documentation supports a conclusion within a scope rather than providing absolute assurance.

Best practices

Document work contemporaneously so that the record reflects procedures, evidence, and conclusions as they occur, rather than reconstructing them after the fact.
Prepare working papers to a standard where a knowledgeable reviewer not previously connected to the engagement can understand the nature, timing, and extent of work performed and the basis for conclusions.
Maintain a clear cross-referencing and indexing system so that every reported finding can be traced back to its supporting evidence.
Ensure a documented preparer and reviewer trail with dates, so supervisory review and accountability are evident.
Retain working papers in accordance with applicable retention requirements and organizational policy, verifying specific periods against the relevant standards or regulations that apply to your jurisdiction and sector.
Apply appropriate access controls and confidentiality safeguards, given that working papers often contain sensitive source information.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide