Audit Documentation: Tips for Getting It Right: A Successful Engagement Hinges on Avoiding 3 Common Misconceptions

For many staff auditors, the very mention of working paper review is enough to make their hair stand on end. No matter how thoroughly they perform an audit procedure, they know if their documentation does not reflect what they've done, they can expect review comments from their supervisor. This is a vital lesson that is instilled in auditors from the beginning of their careers: Insufficient documentation represents a failure to comply with generally accepted auditing standards (GAAS). That lesson has never been more relevant than it is today. Starting in 2014, the AICPA Peer Review Program has performed what are called oversights. these oversights, subject-matter experts from public practice review a sample of engagements after they have been subject to peer review. The AICPA then tracks the number of engagements that did not conform to applicable professional standards in all material respects (commonly referred to as engagements). The experts have found high levels of material nonconformity, and the most common cause has been noncompliance with AU-C Section 230, Audit Documentation. In fact, one out of every four engagements subject to these enhanced oversights by the Peer Review Program was materially nonconforming due to a lack of adequate audit documentation. WHAT WE'VE LEARNED By collecting information from the firms subject to enhanced oversights, we've learned that three common misconceptions are driving nonconformity. They are: * Auditors can meet their overall audit objectives without documenting their work; * A signoff on an audit program is sufficient documentation of a detail test; and * Oral explanation can substitute for written documentation to meet the requirements of AU-C Section 230. Let's examine these one at a time: Misconception No. 1: Auditors can meet their overall audit objectives without documenting their work Through enhanced oversights, numerous firms have expressed their belief that sufficient evidence to support the audit opinion can be obtained without meeting the requirements of AU-C Section 230. For example, on one of the single-audit engagements subject to enhanced oversight, the engagement team had no documentation related to their tests of controls over compliance. When the subject-matter expert concluded that the engagement was materially nonconforming, the engagement partner disagreed. He explained to the expert that because the required tests had been performed, he reasoned, he had done enough to support the audit opinion. This is not an appropriate reading of the requirements of GAAS. Under AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards, obtaining sufficient appropriate audit evidence is necessary to reduce audit risk to an acceptably low level and thereby enable the auditor to draw reasonable conclusions on which to base the auditor's opinion. Meeting the requirements of AU-C Section 230, and the specific documentation requirements of other relevant AU-C sections, provides evidence of the auditor's basis for his or her audit opinion as well as evidence that the audit was planned and performed in accordance with GAAS, according to paragraph .02 of AU-C Section 230. If sufficient appropriate audit evidence necessary to support the audit opinion was not appropriately documented, then the audit was not conducted in accordance with GAAS and the auditor would not have a basis to render an opinion. In such instances, the auditor should take appropriate action under AU-C Section 585, Consideration of Omitted Procedures After the Report Release Date. This includes assessing the effect of omitted procedures on the auditor's ability to support the audit opinion and may include performing the omitted procedures or alternative procedures. …