Audit Documentation (SA 230): What Working Papers Must Contain
- SA 230 requires auditors to document sufficient evidence so an experienced auditor with no prior knowledge of the engagement can understand every significant judgment made.
- Working papers must record the audit plan, procedures performed, evidence obtained, and conclusions reached — missing any one of these makes the file legally incomplete.
- The audit file must be assembled and locked within 60 days of signing the auditor's report, after which no substantive changes are permitted.
- What Is SA 230 and Why Should a Business Owner Care?
- The Five Core Elements Every Working Paper File Must Have
- Worked Example: Documenting a Salary Expense Test
- Mandatory Information on Every Working Paper Sheet
- The 60-Day Rule: File Assembly and Retention
- Common Mistakes in Audit Documentation
- What Business Owners Should Ask Their Auditor
Under SA 230 (Standard on Auditing 230) – Audit Documentation, an auditor must maintain working papers that are detailed enough for an experienced professional — who had no involvement in the audit — to reconstruct exactly what was done, why it was done, and what conclusion was reached. For a business owner whose accounts are being audited, this means your auditor is legally required to keep a structured paper trail of every significant check. If that trail is thin or missing, the audit itself can be challenged. Here is precisely what those working papers must contain, with a real-money example and a practical checklist.
What Is SA 230 and Why Should a Business Owner Care?
SA 230 is issued by the Institute of Chartered Accountants of India (ICAI) and applies to every statutory audit, tax audit under Section 44AB of the Income Tax Act, and any other engagement governed by ICAI standards. It is not just a procedural formality. If the Income Tax Department or a court ever questions the audit, the working papers are the auditor's — and your — primary defence. Thin documentation means thin defence.
From FY 2026-27 onwards, with increased scrutiny under faceless assessment and the NFRA (National Financial Reporting Authority) inspecting audit files of listed and large entities, the standard of documentation is under sharper focus than ever before.
The Five Core Elements Every Working Paper File Must Have
SA 230 does not prescribe a fixed format, but it mandates that documentation collectively covers these five pillars:
- Audit plan and strategy: Nature, timing, and extent of planned procedures. This includes materiality levels set before fieldwork begins.
- Work performed: Specific procedures executed — vouching, physical verification, analytical review — with dates and the name of the team member who performed each step.
- Evidence obtained: Copies or references to invoices, bank statements, confirmations, management representations, third-party certificates.
- Significant judgments and conclusions: Where the auditor exercised professional judgment — say, evaluating a provision for bad debts — the reasoning must be written down, not just the outcome.
- Issues identified and how they were resolved: Any unusual item, disagreement with management, or departures from the audit plan must be documented along with the resolution.
Worked Example: Documenting a Salary Expense Test
Suppose you run a trading firm and your auditor is testing the salary expense of ₹12,00,000 for the year. Here is how the working paper for this area should look:
- Objective stated: Verify that ₹12,00,000 salary paid to 4 employees is accurate, authorised, and properly classified.
- Materiality threshold set: Auditor has set overall materiality at ₹1,50,000 (say, 1% of turnover of ₹1.5 crore). Salary expense exceeds this, so it gets full substantive testing.
- Procedure — Reconciliation: Monthly payroll register checked: Jan ₹98,000 + Feb ₹98,000 + … + Dec ₹1,02,000 = ₹12,00,000. Ties to ledger ✓
- Procedure — Authorisation: 3 months of salary vouchers (April, August, December) physically vouched to bank transfer statements. All show payment from current account ending 4521 ✓
- Procedure — TDS compliance: Form 24Q filed for all four quarters. TDS deducted correctly as per applicable slab rates; Form 16 issued ✓
- Procedure — PF/ESI: ECR (Electronic Challan cum Return) for all 12 months reviewed. PF @ 12% of basic on ₹7,68,000 basic wages = ₹92,160 employer share — matches with expense ledger ✓
- Conclusion: Salary expense of ₹12,00,000 is fairly stated, properly authorised, and compliant with TDS and PF obligations. No exceptions noted.
- Prepared by: [Audit Assistant Name], Date: [DD/MM/YYYY]. Reviewed by: [CA Name], Date: [DD/MM/YYYY].
Notice the arithmetic is shown explicitly. A working paper that simply says "salary expense verified — OK" fails SA 230 because the reviewer cannot see how the conclusion was reached.
Mandatory Information on Every Working Paper Sheet
| Element | What to Include | Why It Matters |
|---|---|---|
| Client name | Full legal name of entity | Prevents file mix-up across clients |
| Period covered | FY start and end date (e.g., 01-Apr-2026 to 31-Mar-2027) | Pins the evidence to the correct year |
| Subject / area | E.g., "Salary Expense — Substantive Testing" | Allows quick cross-referencing |
| Index / reference number | Unique code (e.g., WP-PE-04) | Links working paper to audit programme |
| Date of preparation | Exact date work was performed | Confirms work was done before opinion date |
| Preparer's initials/sign | Person who did the work | Assigns accountability |
| Reviewer's initials/sign | Engagement partner or senior | Shows supervisory review as required by SA 220 |
The 60-Day Rule: File Assembly and Retention
SA 230 requires the audit file to be assembled within 60 days of the date of the auditor's report. After that, no documents can be added or removed without a formal supplementary memorandum explaining the change. The assembled file must be retained for a minimum period — ICAI guidance aligns with the Companies Act requirement of keeping records for at least 7 years from the date of the report. For tax audit files, best practice is to keep them at least until the corresponding assessment year is beyond appeal.
If you are a business owner whose audit is under scrutiny, you can ask your CA to share the index of the working paper file. Under SA 230, that index must exist. If your auditor cannot produce it, that is a red flag.
Common Mistakes in Audit Documentation
These are real errors found during ICAI peer reviews and NFRA inspections — not theoretical ones:
- Mistake 1 — Tick-and-flick without explanation: Auditors write a tick mark (✓) on a figure without a legend explaining what the tick means. A tick could mean "agreed to ledger" or "physically verified" — those are very different procedures. SA 230 requires a legend or clear description.
- Mistake 2 — No documentation of verbal management representations: If a client tells the auditor that a large receivable will be collected next month, that representation must be captured in a signed Management Representation Letter (MRL) and cross-referenced in the working paper. Verbal representations left undocumented are worthless.
- Mistake 3 — Missing "significant judgment" notes: When an auditor decides that a ₹5,00,000 contingent liability does not need to be provided for, the reasoning — not just the conclusion — must be on file. Files that show only "contingency reviewed — no provision required" are incomplete.
- Mistake 4 — Back-dating working papers: Creating or filling in working papers after the audit report is signed is a serious professional misconduct issue. SA 230 explicitly requires documentation to reflect work done during the engagement.
- Mistake 5 — No documentation of changed procedures: If the original audit plan said "confirm debtors above ₹50,000" but the team later confirmed only those above ₹2,00,000, the file must document why the plan changed and that the change was authorised by the engagement partner.
What Business Owners Should Ask Their Auditor
You do not need to understand every nuance of SA 230, but asking these three questions will ensure your audit is genuinely robust:
- Has materiality been documented and can I see the figure used for my audit?
- Is the working paper file indexed and will it be locked within 60 days of the report date?
- Has every significant judgment — especially on provisions, related-party transactions, and contingencies — been written up with reasoning, not just a conclusion?
If you are looking for a structured, documentation-compliant audit, explore our Tax Audit Services, where every engagement follows SA 230 to the letter.
Do it yourself in minutes — free to try, no login needed.
Open Tax Audit Services →Frequently asked questions
What is the main purpose of SA 230 audit documentation?
SA 230 ensures that an experienced auditor who had no involvement in the engagement can understand what procedures were performed, what evidence was obtained, and why each significant conclusion was reached. It is essentially a complete, reviewable record of the audit.
How long must audit working papers be retained in India?
Under ICAI guidance aligned with the Companies Act, audit working papers must be retained for a minimum of 7 years from the date of the auditor's report. For tax audit files, it is best practice to retain them until the related assessment year is fully settled and beyond the appeal window.
Can an auditor add documents to the file after signing the audit report?
Yes, but only within the 60-day assembly window and under strict conditions. After the file is locked, any additions require a formal supplementary memorandum stating the date, the reason for the change, and who authorised it. Back-dating or altering working papers without disclosure is professional misconduct.
Does SA 230 apply to a tax audit under Section 44AB?
Yes. SA 230 applies to all audit engagements conducted under ICAI standards, including tax audits under Section 44AB of the Income Tax Act. The auditor signing Form 3CA/3CB and 3CD is bound by SA 230 and must maintain proper working papers for that engagement.
General information for FY 2026-27, not professional advice for your specific case. Rules change — verify against the latest notification or ask a KyaTax expert.
Related: All free tools · More guides · Virtual CFO