Audit Documentation and Working Papers: SA 230 Guide for CAAP

In a bank branch audit, audit documentation and working papers are the only proof that the auditor actually did the work. If a conclusion is not written down, reviewers treat it as if it never happened. This CAAP guide covers what SA 230 and SQC 1 require, how a bank audit file is built, and how long it must be kept.

📁 What SA 230 Means by Audit Documentation

SA 230, Audit Documentation, defines documentation as the record of audit procedures performed, relevant audit evidence obtained, and conclusions reached. The older term "working papers" survives in practice, and exams use both interchangeably. The collection of these records for one engagement is the audit file.

The standard applies a single benchmark: documentation must be sufficient to let an experienced auditor with no previous connection to the engagement understand the nature, timing and extent of procedures, the results obtained, and the significant matters and judgements involved. That test is the most frequently examined line in the whole standard.

For every item tested, the auditor must record identifying characteristics — the branch code and account number for an advance sampled, the voucher number and date for an expense, the range of documents inspected. Vague notes such as "advances verified, found in order" fail, because a reviewer cannot re-perform the work.

Documentation also has to show who did the work and when it was completed, plus who reviewed it and when the review happened. Under tight statutory deadlines, this sign-off trail is what separates a defensible file from an indefensible one. Records of significant discussions with branch management belong in the same file.

💡 Exam Tip: If a question asks the "test" for sufficiency of documentation, the answer is always the experienced auditor test — not materiality, not sample size.

🗂️ Permanent File Versus Current File

Bank audit files are conventionally split into two. The permanent file carries information of continuing relevance across years — the branch's sanctioning powers, the bank's loan policy, delegation charts, copies of the previous three years' audit reports and Long Form Audit Report replies, and the branch's licence and category. The current file holds evidence specific to the year under audit.

Getting this split right matters because a large part of branch audit efficiency comes from not re-collecting stable information. It also matters in the exam, where candidates are asked to classify a given document into one of the two files.

Anything in the permanent file must be reviewed yearly and updated when the underlying policy changes. A stale permanent file is worse than none, because the auditor may test compliance against a superseded delegation chart. See the notes on Preparations of Final Accounts of Banks to see which closing returns land in the current file.

⏱️ Assembly, Retention and Ownership

Timing rules come from SQC 1, Quality Control for Firms, and are heavily tested. The final audit file must be assembled within 60 days of the date of the auditor's report. After assembly, the auditor must not delete or discard documentation before the end of its retention period.

The retention period under SQC 1 is not less than seven years from the date of the auditor's report, or the date of the group auditor's report where later.

Changes made after assembly are permitted only in narrow circumstances, and the auditor must record the specific reason for the change, when and by whom it was made, and who reviewed it. If new facts emerge after the report date that cause the auditor to perform new procedures or reach new conclusions, the file must document the circumstances, the procedures performed, the evidence obtained, and the effect on the report.

Ownership is settled: working papers are the property of the auditor, not of the bank. The auditor may, at discretion, share extracts with the client, but that does not substitute for the bank's own records. Confidentiality obligations continue after the engagement ends. For related closing balances the auditor tests, see Cash Balance with RBI and Other Banks.

⚠️ Common Mistake: Candidates swap the two numbers. Assembly is 60 days; retention is 7 years. Both run from the date of the auditor's report.

🏦 Documenting IRAC, MOC and LFAR at a Branch

A bank branch file has three signature workpapers. First, the advances sample sheet showing each account selected, sanctioned limit, drawing power computation, security value, overdue position and the asset classification concluded, with reasons where the auditor's view differs from the branch's. This is the paper that supports the classification and provisioning outcome tested in the provisioning norms for bank advances.

Second, the Memorandum of Changes working, which must trace every proposed change to a specific workpaper reference, quantify the impact on advances, provisions, income and classification, and be signed by both the auditor and the branch manager. An MOC without a cross-reference to evidence is an assertion, not a finding.

Third, the LFAR support file. Each questionnaire answer needs an evidence reference; auditors who draft LFAR replies from memory at the end routinely contradict their own main-report conclusions. Build the answers as fieldwork proceeds, and cross-reference each one to the workpaper that supports it.

Documentation of the audit's planning stage is equally examinable: the overall audit strategy, the audit plan, materiality computation, risk assessment at assertion level, and any significant changes made during the engagement with reasons. This overlaps with the framework in the standards on auditing for bank audits and with the periodic checking done in concurrent audit in banks.

💻 Electronic Working Papers and Frequent Deficiencies

Most bank audits now run on CBS extracts, so documentation standards extend to the digital trail. The auditor must record the source and date of every data extract, the filters applied, control totals reconciled to the branch trial balance, and the tool used. An unlabelled spreadsheet that ties to nothing is not audit evidence.

SQC 1 requires firms to protect electronic files through access controls, version control, backups and restricted editing after assembly. Where analytics scripts drive sample selection, the script and its parameters belong in the file, as developed in Data Analytics and Continuous Controls Monitoring.

The deficiencies flagged most often in peer review are consistent: checklists ticked with no underlying evidence, no record of the reviewer, missing rationale where the auditor departed from the branch's classification, and post-assembly edits with no reason recorded. Confirm current supervisory expectations on the Reserve Bank of India site, which hosts the master directions governing bank audit.

Valuation-heavy areas need extra care because judgement drives the number; the same discipline applies to treasury workpapers such as mark to market valuation of derivatives, where inputs and the pricing source must be preserved. The income-side equivalent is set out in Audit Aspect of Profit and Loss of Account.

📌 Remember: Oral explanations from branch staff are not documentation. If it is not in the file, with a reference, it does not exist.

🧠 Practice MCQs: Audit Documentation and Working Papers

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

Build the habit before the exam

Treat every practice question as a workpaper: procedure, evidence, conclusion. Track the syllabus through the Certified Accounting and Audit Professional hub and keep rate facts current with the RBI rates page.