PCAOB AS 1215 Audit Documentation: What Good Workpapers Should Contain
How External Auditors Can Prepare Clear, Complete, and Defensible Audit Documentation
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | PCAOB Auditing Standards, Audit Evidence, and Audit Quality
One of the most important skills an external auditor must develop is the ability to prepare high-quality audit workpapers.
An auditor may perform appropriate procedures, identify significant risks, evaluate complex accounting estimates, and reach reasonable conclusions. However, if the workpapers do not adequately document the procedures, evidence, and reasoning, the audit file may fail to demonstrate that the engagement complied with PCAOB auditing standards.
This is why PCAOB AS 1215, Audit Documentation, is fundamental to audit quality.
AS 1215 establishes requirements for preparing, reviewing, completing, and retaining audit documentation.
Its purpose extends far beyond creating an administrative record of completed procedures.
Audit documentation provides the foundation for the auditor's conclusions, supports supervision and engagement quality reviews, and enables independent evaluation of the work performed.
Good workpapers do not simply record what the auditor did. They explain why the work was necessary, what evidence was obtained, what the evidence means, and how the auditor reached a defensible conclusion.
Corporate Compliance Seminars offers specialized training on these requirements through its PCAOB AS 1215: Audit Documentation CPE event.
1. What Is PCAOB AS 1215?
PCAOB AS 1215 establishes the general audit documentation requirements for engagements performed under PCAOB standards.
The standard applies to financial statement audits, audits of internal control over financial reporting, and reviews of interim financial information conducted under the applicable PCAOB requirements.
It addresses the documentation needed to demonstrate compliance with auditing standards and support the auditor's conclusions.
Audit documentation may include:
Audit programs and planning memoranda.
Risk assessment documentation.
Financial statement analyses.
Control testing workpapers.
Substantive testing schedules.
Confirmations and correspondence.
Accounting research memoranda.
Evidence supporting significant judgments.
Documentation of identified exceptions.
Supervisory reviews and engagement conclusions.
These records collectively demonstrate how the auditor obtained sufficient appropriate evidence to support the audit opinion.
AS 1215 does not replace the specific documentation requirements found in other PCAOB auditing standards.
Instead, it establishes requirements that apply throughout the engagement.
2. The Experienced Auditor Test
One of the most important requirements appears in AS 1215.06A.
Audit documentation must contain sufficient information to enable an experienced auditor with no previous connection to the engagement to understand the nature, timing, extent, and results of the procedures performed, the evidence obtained, and the conclusions reached.
The documentation must also identify who performed and reviewed the work and the relevant completion and review dates.
This creates a practical test for audit quality.
Imagine that an experienced auditor from another office is assigned to review the engagement.
The reviewer has not attended the planning meetings, interviewed management, or participated in the audit procedures.
Can that reviewer understand what was done and why?
Can the reviewer identify the evidence supporting the conclusions?
Can the reviewer follow the audit trail without asking the original preparer to explain missing information?
If not, the documentation may be inadequate.
The workpaper must be capable of standing on its own.
3. The Ten Essential Elements of a Good Audit Workpaper
Although AS 1215 does not prescribe one universal workpaper template, the following elements provide a practical structure for preparing documentation that addresses its requirements.
1. Workpaper identification
Each workpaper should clearly identify the client, engagement period, subject matter, and workpaper reference.
For example:
Client: ABC Manufacturing Corporation
Fiscal year: December 31, 2026
Audit area: Accounts Receivable
Workpaper reference: AR-04
Procedure: Accounts Receivable Confirmation Testing
Clear identification supports organization, review, and cross-referencing.
2. Audit objective
The workpaper should explain what the auditor is attempting to accomplish.
For example:
"Determine whether selected accounts receivable balances exist at the reporting date and evaluate the results of confirmation procedures."
An audit objective connects the procedure to a financial reporting assertion.
Without a clearly defined objective, the reviewer may not understand why the procedure was performed.
3. Risk and assertion being addressed
The workpaper should identify the relevant risk of material misstatement and financial statement assertion.
For example:
Risk: Fictitious or overstated accounts receivable balances.
Assertion: Existence.
Relevant PCAOB standards include AS 2110, AS 2301, and AS 1105.
This connection demonstrates how the procedure responds to the auditor's risk assessment.
4. Nature, timing, and extent of procedures
The workpaper should describe what was performed, when the procedure was performed, and how much testing was completed.
For example:
"Selected 30 customer balances from the December 31 accounts receivable aging report using the firm's documented selection methodology and performed confirmation procedures."
The documentation should identify the population, selection methodology, and items selected sufficiently to permit the work to be understood and evaluated.
5. Source of information
The workpaper should identify where the information came from.
Examples include the general ledger, accounts receivable aging, customer confirmations, bank statements, vendor invoices, and independently obtained external evidence.
When information is produced by the company, the auditor must consider the applicable requirements for evaluating its accuracy and completeness.
A spreadsheet received from management should not automatically be treated as reliable audit evidence.
6. Evidence obtained
The workpaper should identify the evidence supporting the audit procedure.
For example:
Customer confirmation responses.
Shipping documents.
Customer contracts.
Subsequent cash receipts.
General ledger transaction details.
The auditor should provide appropriate references to supporting documentation.
7. Results and exceptions
The workpaper should clearly describe the results of testing.
If exceptions were identified, the auditor should explain their nature and significance.
For example:
"Two confirmation differences were identified. Both were investigated through examination of subsequent receipts and supporting shipping records."
The documentation should explain how the exceptions were resolved and whether additional procedures were necessary.
8. Auditor's conclusion
The workpaper should contain a conclusion that is supported by the evidence.
For example:
"Based on the procedures performed and the evidence obtained, no material exceptions were identified in the selected items relating to the existence assertion."
A conclusion should not be broader than the evidence supports.
9. Preparation and review information
AS 1215 requires documentation identifying who performed and reviewed the work and the relevant dates.
Electronic audit platforms may capture this information through workflow and review records.
10. Cross-references
The workpaper should connect to related documentation.
Examples include the audit planning memorandum, risk assessment, lead schedules, supporting evidence, and summary of audit differences.
Effective cross-referencing helps reviewers understand how the audit procedures support the engagement's overall conclusions.
4. Example: A Well-Documented Audit Workpaper
Consider a hypothetical audit of ABC Manufacturing Corporation.
The auditor is assigned to test accounts receivable existence.
Workpaper component | Example documentation |
Reference | AR-04 |
Objective | Evaluate the existence of selected year-end receivables |
Risk | Overstatement of accounts receivable |
Assertion | Existence |
Population | December 31 accounts receivable aging |
Procedure | Confirm selected customer balances |
Selection | 30 balances selected using documented methodology |
Evidence | Confirmation responses and applicable alternative evidence |
Exceptions | Two differences identified and investigated |
Conclusion | Conclusion based on the completed testing and resolution of differences |
Preparation and review | Names and dates documented |
The table provides a useful outline.
However, it is not a substitute for retaining the supporting evidence, documenting the individual selections, explaining the differences, and supporting the final conclusion.
The complete workpaper should allow the reviewer to understand the actual testing performed.
5. Why "No Exceptions Noted" Is Not Enough
One of the most common weaknesses in audit documentation is the use of unsupported conclusions.
An auditor may write: "No exceptions noted."
But what does that statement mean?
What was examined?
How many transactions were tested?
What criteria were applied?
Were the source documents reliable?
Did the auditor evaluate contradictory information?
A conclusion without sufficient supporting documentation does not demonstrate that the required procedures were performed.
A better approach is to describe the work performed, identify the evidence, summarize the results, and then state the conclusion.
For example:
"Examined the supporting documentation for the 25 selected disbursements identified in AP-06. Compared invoice amounts, vendor names, purchase approvals, and payment details to the general ledger. No deviations from the specified testing criteria were identified."
This explanation is more informative because it describes the procedure and the basis for the result.
The supporting schedules must still identify the individual transactions and retain or reference the relevant evidence.
6. Documenting the Link Between Risk and Audit Procedures
PCAOB AS 1215.09A addresses documentation of risk assessment procedures and responses to risks of misstatement.
The audit file should demonstrate how the auditor's procedures respond to the identified risks.
For example, consider a company with a significant risk of premature revenue recognition.
The risk assessment identifies the possibility that management could record revenue before satisfying the applicable recognition criteria.
The auditor designs procedures to examine contractual terms, transaction timing, and supporting evidence.
The workpapers should demonstrate the connection among:
Identified risk → Relevant assertion → Audit response → Evidence obtained → Results → Conclusion
This connection is critical.
A reviewer should not have to guess why the auditor selected a particular procedure.
Audit documentation should tell a coherent story about how the engagement addressed the identified risks of material misstatement.
7. Documenting Internal Control Testing
For an integrated audit, documentation of internal control testing is especially important.
The auditor must distinguish between evaluating control design and testing operating effectiveness.
Control design
The auditor evaluates whether the control, if operated as prescribed, is capable of preventing or detecting the relevant misstatement.
Operating effectiveness
The auditor evaluates whether the control operated as designed, including whether it was performed by an appropriately authorized and competent individual.
Consider a monthly bank reconciliation control.
The control description states that the accounting manager reviews and approves reconciliations.
A weak workpaper might state: "Reviewed reconciliations. All signed."
A stronger workpaper would document the reconciliations selected, evidence of preparation and review, the nature and precision of the review, significant reconciling items, and the auditor's evaluation of whether the control operated effectively.
A signature may demonstrate that someone approved a document. It does not necessarily demonstrate that the review was sufficiently precise to detect a material misstatement.
8. Documenting Audit Sampling
Audit sampling requires more than identifying the number of items tested.
The workpaper should explain the population, sampling objective, selection method, items selected, procedures performed, exceptions, and evaluation of results.
Where applicable, the auditor should document the rationale for sample size and how the results affect the audit conclusion.
For example, an auditor testing purchasing controls might select 40 purchase transactions.
The workpaper should identify the population and selection method and provide enough detail to identify the items tested.
If three exceptions are identified, the auditor should evaluate their significance.
The conclusion should reflect the applicable audit sampling requirements and the actual results.
A statement that three exceptions are immaterial simply because the dollar amounts are small may be inappropriate when the objective is to test a control.
Control deviations must be evaluated in the context of the control objective, associated risk, and planned reliance.
9. Contradictory Evidence Must Be Documented
AS 1215.08 contains an especially important requirement.
The auditor must retain information relating to significant findings or issues that is inconsistent with or contradicts the final conclusions.
This means an auditor cannot simply retain the evidence supporting a preferred conclusion while disregarding significant contradictory information.
Consider an audit of an accounting estimate.
Management provides a valuation model supporting a $25 million asset value.
However, the auditor obtains independent market information suggesting a substantially lower valuation.
The audit file should address that contradictory evidence.
It should explain the additional procedures performed, the evaluation of the conflicting information, and the basis for the final conclusion.
This requirement reinforces professional skepticism.
Audit documentation should demonstrate how the auditor resolved significant conflicting evidence, not merely how the auditor supported management's position.
10. Significant Findings Require More Extensive Documentation
AS 1215 requires documentation of significant findings or issues, actions taken to address them, and the basis for the conclusions reached.
Examples may include significant audit adjustments, accounting estimates involving substantial judgment, unusual transactions, identified fraud risks, and important disagreements over accounting treatment.
The extent of documentation should reflect the risk, complexity, significance, and professional judgment involved.
A routine recalculation may require relatively straightforward documentation.
A complex goodwill impairment analysis may require substantial documentation of assumptions, methodologies, contradictory evidence, specialist involvement, and the auditor's conclusions.
The principle is straightforward:
The more significant the judgment, the more important it is to document the reasoning supporting the conclusion.
11. Audit Workpapers Must Support Supervision and Review
Audit documentation serves multiple purposes.
It supports the audit team's work, engagement supervision, engagement quality review, and external inspection.
PCAOB AS 1201 addresses supervision of the audit engagement.
AS 1215 establishes documentation requirements that allow reviewers to understand the work performed and conclusions reached.
A reviewer should be able to determine whether procedures were responsive to assessed risks, whether sufficient appropriate evidence was obtained, and whether exceptions were adequately evaluated.
The engagement partner's responsibility is not satisfied merely because workpapers have been electronically signed off.
The audit documentation must support the conclusions underlying the audit opinion.
12. Workpaper Completion and the 45-Day Requirement
PCAOB AS 1215 establishes requirements for completing the audit documentation file.
For engagements subject to the standard's 45-day documentation completion requirement, the complete and final set of audit documentation must be assembled within 45 days after the report release date.
The report release date is generally the date the auditor grants permission to use the auditor's report in connection with the issuance of the company's financial statements.
The distinction between audit completion and file assembly is important.
Before the report release date, the auditor must complete the necessary audit procedures and obtain sufficient evidence to support the auditor's report.
The post-release documentation completion period is not additional time to perform audit procedures that should have been completed before the report was released.
It is intended for completing the assembly of the final documentation file.
Auditors should also review applicable amendments and effective dates, including changes affecting engagement review completion and documentation assembly.
13. The Seven-Year Retention Requirement
AS 1215 generally requires audit documentation to be retained for seven years from the report release date, unless a longer period is required by law.
Different starting points apply when no report is issued or the engagement is not completed.
After the documentation completion date, audit documentation cannot simply be discarded or replaced without regard to the standard's requirements.
When documentation is added after that date, the auditor must comply with the applicable requirements for identifying and explaining the addition.
The audit file must preserve a reliable record of the work performed and conclusions reached.
Firms should establish document retention procedures that address electronic records, access controls, security, backup, and preservation of audit evidence.
14. Common Audit Documentation Weaknesses
Auditors should be alert to recurring workpaper weaknesses.
Weakness | Why it matters |
Missing audit objective | The purpose of the procedure is unclear |
No connection to assessed risk | The audit response may not be demonstrably appropriate |
Unidentified population | The reviewer cannot evaluate the scope of testing |
Unsupported sample selection | The selection method cannot be assessed |
Missing source documentation | Evidence cannot be independently evaluated |
Unexplained exceptions | Significant findings may remain unresolved |
Unsupported conclusions | The workpaper does not demonstrate the basis for the result |
Missing preparer or reviewer information | Accountability and supervision are not adequately documented |
Inadequate cross-references | The audit trail is difficult to follow |
Failure to address contradictory evidence | Significant information may have been disregarded |
These weaknesses may affect audit quality even when the auditor believes the underlying work was performed appropriately.
15. Using AI to Improve Audit Documentation
Artificial intelligence may help auditors organize workpapers, summarize source documents, draft preliminary narratives, and identify missing documentation elements.
For example, an auditor could use an approved AI tool to review a draft workpaper for missing references to the audit objective, risk, procedures, evidence, exceptions, and conclusion.
AI may also assist in comparing workpaper narratives with standardized firm documentation requirements.
However, AI cannot independently establish that procedures were performed or evidence was obtained.
AI-generated summaries may omit important details or introduce inaccuracies.
Auditors must verify AI-assisted content against the actual work performed and supporting evidence.
Confidential client information must also be protected in accordance with applicable professional requirements and firm policies.
AI can help organize audit documentation, but it cannot replace the auditor's responsibility for its accuracy and completeness.
16. A Practical Workpaper Quality Checklist
Before submitting a workpaper for review, the auditor should confirm that the documentation answers the following questions:
Is the audit objective clearly stated?
Is the relevant risk or assertion identified?
Are the procedures sufficiently described?
Is the source of information documented?
Can the items tested be identified?
Is the evidence retained or appropriately referenced?
Are exceptions clearly explained and evaluated?
Is significant contradictory evidence addressed?
Does the conclusion follow from the evidence?
Are the preparer, reviewer, and applicable dates documented?
This checklist is a practical quality tool, not a substitute for the full requirements of AS 1215 or other applicable PCAOB standards.
17. The Most Important Lesson: Workpapers Must Demonstrate Audit Quality
Good audit documentation should be understandable, traceable, and defensible.
It should allow an independent reviewer to follow the auditor's reasoning from the identified risk through the procedures performed and evidence obtained to the final conclusion.
A workpaper that merely contains a checklist and a signature may not provide sufficient documentation.
A workpaper that explains the audit objective, procedures, results, exceptions, and reasoning provides a much stronger foundation for supervision and review.
High-quality documentation also makes audits more efficient.
It reduces unnecessary follow-up questions, helps engagement teams identify incomplete procedures, and supports continuity between audit periods.
Most importantly, it demonstrates that the audit opinion is supported by sufficient appropriate evidence.
Conclusion: If the Workpaper Cannot Explain the Audit, It Is Not Good Enough
PCAOB AS 1215 establishes essential requirements for preparing and retaining audit documentation.
The standard emphasizes the need to document procedures performed, evidence obtained, significant findings, and conclusions reached.
The workpapers must enable an experienced auditor with no previous connection to the engagement to understand the audit work.
This requirement should guide how auditors prepare every significant workpaper.
The objective is not to create the largest possible audit file.
It is to create a clear, complete, and reliable record of the work necessary to support the auditor's conclusions.
The best audit workpapers tell the story of the audit: what risk was identified, what work was performed, what evidence was obtained, what problems were encountered, and why the auditor's conclusion is justified.
That is the foundation of effective audit documentation and high-quality external auditing.
Earn 1 CPE Credit: PCAOB AS 1215 Audit Documentation
Corporate Compliance Seminars offers a focused training event for auditors and accounting professionals who want to strengthen their understanding of PCAOB audit documentation requirements.
This interactive webinar examines the standard's requirements for documenting audit procedures, obtaining and retaining evidence, preparing effective workpapers, and maintaining documentation quality.
What participants will learn
The purpose and scope of PCAOB AS 1215.
Requirements for documenting audit procedures and evidence.
How to prepare clear, organized, and reviewable workpapers.
Documentation quality and supervisory review considerations.
Audit documentation retention requirements.
Practical applications of the standard in external audit engagements.
CPE event details
CPE credits: 1
Field of study: Auditing
Program level: Basic
Prerequisites: None
Advance preparation: None
Delivery format: Live online, Group Internet-Based
Schedule: Tuesdays, approximately every eight weeks
Time: 1:00–2:00 p.m. Central Time
Private group sessions: Available for two or more attendees.
Who should attend?
External auditors, CPA firm associates, senior auditors, audit managers, accounting professionals, and internal auditors interested in strengthening audit documentation practices.
Register today
Develop the documentation skills necessary to support audit conclusions, improve engagement reviews, and strengthen compliance with PCAOB auditing standards.
Visit Corporate Compliance Seminars for additional training in PCAOB auditing standards, audit evidence, internal controls, COSO, and external audit tradecraft.
Comments