COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.
This section describes the Office’s retention periods for audit files, how and where to retain audit files, and the importance of not deleting or discarding audit documentation before the end of its retention period.
Retention periods for engagement files are as follows:
After the assembly of the final audit file has been completed, the auditor shall not delete or discard audit documentation before the end of its retention period. [Nov-2011]
The auditor shall include a reference in the electronic audit file to the existence and physical location of any audit records retained outside of the electronic audit file in order to maintain the completeness of the audit file. [Nov-2011]
The audit working paper software is the business tool used to capture and store audit records during the course of an audit, and PROxI is the corporate repository for managing all OAG records ,including finalized audit files.
Finalizing the audit is important to enable the Office to retain a final record of the procedures performed, evidence obtained, and conclusions reached. Finalizing an audit file ensures that only the final audit file is called up for use in the subsequent year’s audit (for annual audits) or when referred to (in a performance audit or special examination), and that only the final version, with all coaching notes resolved and deleted, can be called on for future reference (e.g. for use as evidence).
All audit records are organized by product code.
Electronic format is the preferred format for keeping audit records, but exceptions are made with the approval of Information and Records Management. Examples of exception are electronic files that are too big or not compatible with the audit working paper software or documents that are above Protected B (OAG Audit 1192 Confidentiality, safe custody, integrity, accessibility, and retrievability of engagement documentation).
Audit teams store electronic documents that form part of the audit record in the audit working paper software. When necessary, they store other electronic documents in PROxI or a paper file, under the appropriate audit product code, until the audit is finalized.
The Guidance on Managing Audit Records, Appendix C—Audit Records Checklist, provides additional guidance.
Audit teams may temporarily store audit documentation in PROxI, encrypted USB keys or local hard drives. Before finalizing the audit file, they must transfer audit documentation from these media to the electronic audit file in the audit working paper software (OAG Audit 1112 Entity documentation and electronic (including email) audit evidence).
It is important to ensure audit documentation is properly assembled during the final file assembly period and deleted from temporary storage devices within the 60 days period. All documentation that supports the audit conclusion must be retained in the audit working paper software.
Audit teams complete the audit file documentation in the audit working paper software through the finalization process and deliver paper records to Information and Records Management for storage and maintenance.
The audit principal completes the New Material to be Managed by Information and Records Management Form (from Appendix B) and reviews the Audit Records Checklist (Appendix C) to ensure that the audit records provided to Information and Records Management are consolidated and complete. The principal will include the New Material to be Managed by Information and Records Management form with the paper audit records when submitting them to Information and Records Management.
Finalized electronic audit files are kept in the audit working paper software until the end of their retention period.
Audit teams follow the appropriate security procedures to dispose of transitory audit records, regardless of their format, as soon as they no longer need them within 60 days period. Library and Archives Canada has given the Office and its staff the authority to dispose of transitory records.
Under the Library and Archives of Canada Act, and according to disposition authorities that are OAG-specific as well as those that cover multiple federal institutions, only Information and Records Management has the delegated authority to dispose of audit records of enduring value.
Information and Records Management disposes of audit files at the end of their retention periods, according to agreements with Library and Archives Canada.
Retention periods assigned to all records may be extended or suspended when records are subject to:
OAG Audit 1192 provides information on retrieval and access when technology is upgraded or changed over time.