COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

1111 Nature, purpose, and extent of audit documentation
Apr-2018

Overview

The discussion of the nature, purpose, and extent of audit documentation is related to the discussion of sufficient appropriate audit evidence found in OAG Audit 1051 Sufficient appropriate audit evidence and OAG Audit 1052 Audit procedures for obtaining audit evidence.

Sufficient appropriate evidence involves the quantity and quality of evidence.

This section describes the documentation of such evidence, including

the experienced auditor principle;
the nature and purpose of audit documentation;
the form, content, and extent of audit documentation;
the need to be able to identify within documentation the specific items tested;
documentation of compliance with professional standards;
audit programs; and
best practices for effective and efficient audit documentation.

CPA Canada Copyright

CPA Canada Assurance Standards

Office

Annual Audit

Performance Audit, Special Examination, and Other Assurance Engagements

Nature and Purposes of Audit Documentation

CAS 230.2 Audit documentation that meets the requirements of this CAS and the specific documentation requirements of other relevant CASs provides:

(a) Evidence of the auditor's basis for a conclusion about the achievement of the overall objectives of the auditor; and

(b) Evidence that the audit was planned and performed in accordance with CASs and applicable legal and regulatory requirements.

CAS 230.3 Audit documentation serves a number of additional purposes, including the following:

Assisting the engagement team to plan and perform the audit.
Assisting members of the engagement team responsible for supervision to direct and supervise the audit work, and to discharge their review responsibilities in accordance with CAS 220.
Enabling the engagement team to be accountable for its work.
Retaining a record of matters of continuing significance to future audits.
Enabling the conduct of engagement quality reviews, other types of engagements reviews and monitoring activities under the firm’s system of quality management.
Enabling the conduct of external inspections in accordance with applicable legal, regulatory or other requirements.

Form, Content and Extent of Audit Documentation

CAS 230.8 The auditor shall prepare audit documentation that is sufficient to enable an experienced auditor, having no previous connection with the audit, to understand: (Ref: Para. A2-A5, A16-A17)

(a) The nature, timing and extent of the audit procedures performed to comply with the CASs and applicable legal and regulatory requirements; (Ref: Para. A6-A7)

(b) The results of the audit procedures performed, and the audit evidence obtained; and

(c) Significant matters arising during the audit, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions. (Ref: Para. A8-A11)

CAS 230.A2 The form, content and extent of audit documentation depend on factors such as:

The size and complexity of the entity.
The nature of the audit procedures to be performed.
The identified risks of material misstatement.
The significance of the audit evidence obtained.
The nature and extent of exceptions identified.
The need to document a conclusion or the basis for a conclusion not readily determinable from the documentation of the work performed or audit evidence obtained.
The audit methodology and tools used.

CAS 230.A3 Audit documentation may be recorded on paper or on electronic or other media. Examples of audit documentation include:

Audit programs.
Analyses.
Issues memoranda.
Summaries of significant matters.
Letters of confirmation and representation.
Checklists.
Correspondence (including e-mail) concerning significant matters.

The auditor may include abstracts or copies of the entity's records (for example, significant and specific contracts and agreements) as part of audit documentation. Audit documentation, however, is not a substitute for the entity's accounting records.

CAS 230.A4 The auditor need not include in audit documentation superseded drafts of working papers and financial statements, notes that reflect incomplete or preliminary thinking, previous copies of documents corrected for typographical or other errors, and duplicates of documents.

CAS 230.A5 Oral explanations by the auditor, on their own, do not represent adequate support for the work the auditor performed or conclusions the auditor reached, but may be used to explain or clarify information contained in the audit documentation.

Documentation of Compliance with CASs (Ref: Para. 8(a))

CAS 230.A6 In principle, compliance with the requirements of this CAS will result in the audit documentation being sufficient and appropriate in the circumstances. Other CASs contain specific documentation requirements that are intended to clarify the application of this CAS in the particular circumstances of those other CASs. The specific documentation requirements of other CASs do not limit the application of this CAS. Furthermore, the absence of a documentation requirement in any particular CAS is not intended to suggest that there is no documentation that will be prepared as a result of complying with that CAS.

CAS 230.A7 Audit documentation provides evidence that the audit complies with the CASs. However, it is neither necessary nor practicable for the auditor to document every matter considered, or professional judgment made, in an audit. Further, it is unnecessary for the auditor to document separately (as in a checklist, for example) compliance with matters for which compliance is demonstrated by documents included within the audit file. For example:

The existence of an adequately documented audit plan demonstrates that the auditor has planned the audit.
The existence of a signed engagement letter in the audit file demonstrates that the auditor has agreed the terms of the audit engagement with management or, where appropriate, those charged with governance.
An auditor's report containing an appropriately qualified opinion on the financial statements demonstrates that the auditor has complied with the requirement to express a qualified opinion under the circumstances specified in the CASs.
In relation to requirements that apply generally throughout the audit, there may be a number of ways in which compliance with them may be demonstrated within the audit file:
- For example, there may be no single way in which the auditor's professional skepticism is documented. But the audit documentation may nevertheless provide evidence of the auditor's exercise of professional skepticism in accordance with the CASs. For example, in relation to accounting estimates, when the audit evidence obtained includes evidence that both corroborates and contradicts management's assertions, documenting how the auditor evaluated that evidence, including the professional judgments made in forming a conclusion as to the sufficiency and appropriateness of the audit evidence obtained.
- Similarly, that the engagement partner has taken responsibility for the direction and supervision of the engagement team and the review of their work may be evidenced in a number of ways within the audit documentation. This may include documentation that evidences the engagement partner's sufficient and appropriate involvement in the audit, such as participation in engagement team discussions.

CAS 230.A8 Judging the significance of a matter requires an objective analysis of the facts and circumstances. Examples of significant matters include:

Matters that give rise to significant risks (as defined in CAS 315).
Results of audit procedures indicating (a) that the financial statements could be materially misstated, or (b) a need to revise the auditor's previous assessment of the risks of material misstatement and the auditor's responses to those risks.
Circumstances that cause the auditor significant difficulty in applying necessary audit procedures.
Findings that could result in a modification to the audit opinion or the inclusion of an Emphasis of Matter paragraph in the auditor's report.

CAS 230.A9 An important factor in determining the form, content and extent of audit documentation of significant matters is the extent of professional judgment exercised in performing the work and evaluating the results. Documentation of the professional judgments made, where significant, serves to explain the auditor's conclusions and to reinforce the quality of the judgment. Such matters are of particular interest to those responsible for reviewing audit documentation, including those carrying out subsequent audits when reviewing matters of continuing significance (for example, when performing a retrospective review of accounting estimates).

CAS 230.A10 Some examples of circumstances in which, in accordance with paragraph 8, it is appropriate to prepare audit documentation relating to the use of professional judgment include, where the matters and judgments are significant:

The rationale for the auditor's conclusion when a requirement provides that the auditor 'shall consider' certain information or factors, and that consideration is significant in the context of the particular engagement.
The basis for the auditor's conclusion on the reasonableness of areas of subjective judgments made by management.
The basis for the auditor's evaluation of whether an accounting estimate and related disclosures are reasonable in the context of the applicable financial reporting framework, or are misstated.
The basis for the auditor's conclusions about the authenticity of a document when further investigation (such as making appropriate use of an expert or of confirmation procedures) is undertaken in response to conditions identified during the audit that caused the auditor to believe that the document may not be authentic.
When CAS 701 applies, the auditor's determination of the key audit matters or the determination that there are no key audit matters to be communicated.

CAS 230.A11 The auditor may consider it helpful to prepare and retain as part of the audit documentation a summary (sometimes known as a completion memorandum) that describes the significant matters identified during the audit and how they were addressed, or that includes cross-references to other relevant supporting audit documentation that provides such information. Such a summary may facilitate effective and efficient reviews and inspections of the audit documentation, particularly for large and complex audits. Further, the preparation of such a summary may assist the auditor's consideration of the significant matters. It may also help the auditor to consider whether, in light of the audit procedures performed and conclusions reached, there is any individual relevant CAS objective that the auditor cannot achieve that would prevent the auditor from achieving the overall objectives of the auditor.

CAS 230.9 In documenting the nature, timing and extent of audit procedures performed, the auditor shall record:

(a) The identifying characteristics of the specific items or matters tested; (Ref: Para. A12)

(b) Who performed the audit work and the date such work was completed; and

Identification of Specific Items or Matters Tested, and of the Preparer and Reviewer (Ref: Para. 9)

CAS 230.A12 Recording the identifying characteristics serves a number of purposes. For example, it enables the engagement team to be accountable for its work and facilitates the investigation of exceptions or inconsistencies. Identifying characteristics will vary with the nature of the audit procedure and the item or matter tested. For example:

For a detailed test of entity-generated purchase orders, the auditor may identify the documents selected for testing by their dates and unique purchase order numbers.
For a procedure requiring selection or review of all items over a specific amount from a given population, the auditor may record the scope of the procedure and identify the population (for example, all journal entries over a specified amount from the journal register).
For a procedure requiring systematic sampling from a population of documents, the auditor may identify the documents selected by recording their source, the starting point and the sampling interval (for example, a systematic sample of shipping reports selected from the shipping log for the period from April 1 to September 30, starting with report number 12345 and selecting every 125th report).
For a procedure requiring inquiries of specific entity personnel, the auditor may record the dates of the inquiries and the names and job designations of the entity personnel.
For an observation procedure, the auditor may record the process or matter being observed, the relevant individuals, their respective responsibilities, and where and when the observation was carried out.

CAS 230.A13 CAS 220 contains requirements and guidance on the review of audit documentation. The requirement to document who reviewed the audit work performed does not imply a need for each specific working paper to include evidence of review. The requirement, however, means documenting what audit work was reviewed, who reviewed such work, and when it was reviewed.

Documentation

CSAE 3001.82 The practitioner shall prepare on a timely basis engagement documentation that provides a record of the basis for the assurance report that is sufficient and appropriate to enable an experienced practitioner, having no previous connection with the engagement, to understand: (Ref: Para. A198-A202)

(a) The nature, timing and extent of the procedures performed to comply with relevant CSAEs and applicable legal and regulatory requirements;

(b) The results of the procedures performed, and the evidence obtained; and

(c) Significant matters arising during the engagement, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions.

CSAE 3001.A199 It is neither necessary nor practical to document every matter considered, or professional judgment made, during an engagement. Further, it is unnecessary for the practitioner to document separately (as in a checklist, for example) compliance with matters for which compliance is demonstrated by documents included within the engagement file. Similarly, the practitioner need not include in the engagement file superseded drafts of working papers, notes that reflect incomplete or preliminary thinking, previous copies of documents corrected for typographical or other errors, and duplicates of documents.

Documentation (Ref: Para. 82–86)

CSAE 3001.A198 Documentation includes a record of the practitioner’s reasoning on all significant matters that require the exercise of professional judgment, and related conclusions. When difficult questions of principle or professional judgment exist, documentation that includes the relevant facts that were known by the practitioner at the time the conclusion was reached may assist in demonstrating the practitioner’s knowledge.

CSAE 3001.A202 Documentation may include a record of, for example:

Issues identified with respect to compliance with relevant ethical requirements and how they were resolved.
Conclusions on compliance with independence requirements that apply to the engagement, and any relevant discussions within the firm that support these conclusions.
Conclusions reached regarding the acceptance and continuance of client relationships and assurance engagements.
The nature and scope of, and conclusions resulting from, consultations undertaken during the course of the engagement.

CSAE 3001.A200 In applying professional judgment to assessing the extent of documentation to be prepared and retained, the practitioner may consider what is necessary to provide an understanding of the work performed and the basis of the principal decisions taken (but not the detailed aspects of the engagement) to another practitioner who has no previous experience with the engagement. That other practitioner may only be able to obtain an understanding of detailed aspects of the engagement by discussing them with the practitioner who prepared the documentation.

CSAE 3001.A201 Documentation may include a record of, for example:

The identifying characteristics of the specific items or matters tested;
Who performed the engagement work and the date such work was completed;
Who reviewed the engagement work performed and the date and extent of such review; and
Discussions of significant matters with the appropriate party(ies) and others, including the nature of the significant matters discussed and when and with whom the discussions took place

OAG Policy

Auditors shall prepare audit documentation adhering to the experienced auditor principle, while recording who performed the audit work and the date such work was completed. [Nov-2011]

OAG Guidance

Experienced auditor principle

Auditors shall prepare audit documentation that is sufficient to enable an experienced auditor, having no previous connection with the audit, to understand:

(a) The nature, timing and extent of the audit procedures performed to comply with GAAS and applicable legal and regulatory requirements;

(b) The results of the audit procedures performed, and the audit evidence obtained; and

(c) Significant matters arising during the audit, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions.

Nature and purpose of audit documentation

The nature and extent of audit documentation for a particular audit, while required to meet professional standards and Office policy, are largely a matter of professional judgment, based on the unique circumstances of each audit. Neither professional standards nor Office policy prohibits the audit team members from including documentation in the file that they believe necessary to support their work.

Documentation serves multiple purposes: it aids the planning and performance of the audit, it facilitates and supports review, it helps demonstrate the application of the requirements of applicable professional standards, and it supports the evaluation of the sufficiency and appropriateness of evidence obtained and the drawing of conclusions. Documentation further supports practice reviews and inspections performed, according to CSQM 1 and by external bodies.

Sufficient appropriate evidence and procedures for obtaining such evidence is explained in OAG Audit 1051 and OAG Audit 1052 respectively. The evaluation of sufficiency and appropriateness of audit evidence is outlined in OAG Audit 7021.

The objective is to document the audit so that, when it is complete, the audit file tells the story of how the audit team arrived at its conclusions. This does not mean a step-by-step narrative of every aspect of how the audit was conducted. It is also important to ensure documentation has a clear purpose and link to the audit objectives and procedures applied.

To properly document the nature and extent of the audit procedures performed, auditors need to show

linkages between significant risks and how these risks were addressed;
how evidence gathered from the planning phase links with judgments and/or decisions about how much audit work was needed;
how evidence gathered through risk assessment and the work performed on internal control links to the subject of the audit (for example, the financial statement areas and assertions);
how the audit team reached its conclusions and whether the supporting evidence supports those conclusions;
compliance with relevant assurance standards, Office policies, and methodology; and
how audit programs conclude on the objectives of the audit and the line of enquiry.

Form and content of audit documentation

The form and content of audit documentation is dependent on the following factors:

the size and complexity of the entity and/or its operations;
the nature of the audit procedures to be performed;
the identified risk of material misstatement, significant deficiency, or significant finding;
the significance of the audit evidence obtained;
the nature and extent of exceptions identified; and
the audit methodology and audit tools used.

Specific considerations on the extent of documentation

In determining the nature and extent of the documentation for a particular audit area or procedure, auditors generally need more persuasive or extensive documentation when

the risk is greater (the risk associated with conducting the audit or the risk of a material misstatement, significant deficiency, or significant finding);
more judgment is needed in performing the work or evaluating the results; and
the evidence is more significant (i.e., the evidence is critical to conclude on the objectives of the audit).

Auditors should document an overall conclusion, including the reasons for it, if the documentation of the results of the testing do not make the conclusion apparent.

The audit team includes sufficient documentation regarding significant risk areas and/or matters of significant judgment, addressing issues that, in the audit team's judgment, are significant, actions taken to address them (including additional evidence obtained), and the basis for the conclusions reached. OAG Audit 1143 provides guidance on documenting significant matters and significant professional judgments.

Identification of items tested

Taking note of the identifying characteristics of an item or matter to be tested serves a number of purposes. For example, it enables the audit team to be accountable for its work and facilitates the investigation of exceptions or inconsistencies. Identifying characteristics will vary with the nature of the procedure and the item or matter being tested.

Documentation of compliance with professional standards

It is neither necessary nor practicable for the auditor to document every matter considered or professional judgment made in an audit. Further, it is unnecessary for the auditor to document separately (as in a checklist, for example) compliance with matters for which compliance is demonstrated by documents included within the audit file. For example:

The existence of an adequately documented audit plan shows that the auditor has planned the audit.
There may be no single way in which the auditor's professional skepticism is documented, but the audit documentation may nevertheless provide evidence of the auditor's exercise of professional skepticism. Such evidence may include specific procedures performed to corroborate management's responses to the auditor's inquiries.
The audit documentation may show evidence of the engagement leader taking responsibility for the direction, supervision, and performance of the audit in a number of ways. This may include documentation that demonstrates the engagement leader's timely involvement in aspects of the audit.

Audit programs

Audit programs provide a comprehensive definition of work to be performed. Each product line has standard audit procedures that are updated periodically, and the work that is performed in response to audit programs is documented in the audit working paper software. A good audit program provides detailed guidance to the auditor doing the work regarding the nature, timing, and extent of the procedures to be performed. Further, it can provide details of evidence obtained (results) and conclusions drawn to allow for an effective review.

The use of audit programs reduces the amount of additional documentation needed following the completion of the procedures. It also aids in the preparation of the audit file in subsequent years for attest audits and helps the audit team prepare the substantiation for performance audits and special examinations. Information contained in the audit program, such as criteria and audit steps, can be used again for attest audits in the following year, in follow-up chapters for performance audits, or for future Crown-specific audit projects for special examinations. Changes to the audit programs may be needed in light of the entity's circumstances, risks, and any other changes that have been identified during the planning phase of the audit.

The audit steps and the documented results need to be looked at together to determine whether audit documentation is sufficient. For example, an audit step with only the word “Done” documented as the result will often not meet documentation requirements because it is not possible to identify the items tested, extent of audit work performed, or conclusions drawn. If an audit step is not applicable, the audit documentation needs to record why this is the case or whether the audit steps are amended accordingly.

Modifications to audit programs and associated audit steps need to be completed before the start of the work in the examination phase. If there are any potential amendments to the audit program, auditors communicate these changes and raise any other issues on a timely basis with the senior members of the audit team. In instances where modifications did not take place before the start of field work, auditors modify the audit steps as the work progresses; obtain approval for changes to audit programs; and include appropriate information on the nature, timing, and extent of steps to be performed.

Effective and efficient documentation

The following is a checklist of best practices for every audit step:

Purpose—auditors write the audit steps with sufficient detail to understand the objective and/or purpose of the audit procedures.
Source—auditors indicate the source of documents, e.g., prepared by entity (PBE) or prepared by the OAG or a third party (name of third party).
Conclusion/result—auditors document conclusions and/or results from the evidence for every audit step.
Extent—the extent of documentation is sufficient for an experienced auditor having no previous connection with the engagement to understand the nature, timing, extent, results of procedures performed, evidence obtained, and conclusions reached.
Nature—documentation of audit steps, which involve the inspection of documents or confirmation, tests of operating effectiveness of controls, and tests of details, includes identification of items inspected (sources from which items were selected and the specific selection criteria). Documentation of audit steps related to the inspection of significant contracts or agreements with financial impact includes abstracts or copies of the documents.
Timing—auditors obtain and review all evidence to support the audit report before finalizing the audit report. Documentation is completed and the file archived at a minimum in accordance with the Office’s policy.

1111 Nature, purpose, and extent of audit documentation Apr-2018