I am often surprised by the engagement my social media posts generate by internal auditors around the world. Ours is a profession where benchmarking and networking are an important path to enhancement of our internal audit functions. So, when a colleague asked me to post a LinkedIn poll to gauge internal audit workpaper retention practices, I naturally agreed. I anticipated it would generate some interest and comments, but I was not expecting the response I received. The poll was viewed more than 25,000 times, and generated more than 2,200 votes. In addition, it generated more than 85 thoughtful comments and responses from practitioners around the world.
Before delving into the topic of workpaper retention, it’s important to explore what is meant by internal audit workpapers. The IIA provides guidance for its members on documenting evidence in its “Implementation Guide 2330.” Specifically, The IIA notes that:
“Engagement workpapers are used to document the information generated throughout the engagement process, including planning; testing, analyzing, and evaluating data; and formulating engagement results and conclusions. Workpapers may be maintained on paper, electronically, or both. Use of internal audit software may enhance consistency and efficiency.”
In polling practitioners on workpaper retention, I asked a very simple question: “How long should internal audit workpapers be retained after the conclusion of the audit?” Here were the responses:
The responses and comments to the poll were interesting on the surface, but a closer analysis reveals just how little consensus there is on this topic. More than 850 respondents said retain them for more than five years while over 40 respondents said “don’t keep them at all.” Everyone else landed in between. More importantly, the comments from more than 80 respondents clearly indicate that workpaper retention presents a compliance risk for internal auditors that is more commonly encountered in the areas we audit than in our own operations.
Many of those who commented correctly noted that workpaper retention policies should be guided by three requirements:
In addition to the foregoing, the comments to the LinkedIn poll raised a number of other noteworthy points:
The question was also raised regarding how long review notes should be retained for a set of engagement workpapers. There was no consensus on this, but it is my opinion that evidence of supervisory or other workpaper reviews become an integral part of the workpapers. I believe evidence of workpaper reviews should be retained as long as the workpapers are retained.
In the final analysis, I was quickly reminded of the complexities of the topic of workpaper retention that I had long forgotten. As a CAE earlier in my career, I had to consider all of the foregoing issues and more when designing and implementing workpaper retention policies for my audit teams.
Finally, it’s important to remember that record retention is a complex regulatory and legal issue. I am not an attorney, and the information contained in this blog is provided for informational purposes only. Nothing in the blog should be construed as legal advice on document retention by internal auditors. Readers should not act or refrain from acting on the basis of any content included in this blog without seeking legal or other professional advice.
Maybe next time, I will post a poll on a less contentious topic.
Richard, you should ask those who want to retain them to the next audit how often they are actually used! As for retaining until corrective action is completed, that indicates a potential failure to convince management that THEY want to make the change.
Keep it up, Richard
While it is good to state that IA shall be guided by Organizational Retention policies, it is also important to deliberate as to ” who” is professionally responsible whether IA as a function or the CAE as an independent professional but who is an employee and who may not have access to records if he moves to another organization.
Richard, I was surprised by your comment to retain evidence of supervisory and other workpaper reviews in the audit workpapers. Perhaps I should not be surprised, given that QAR procedures would look for such evidence. My surprise comes from my external audit experience from many years back where we always shredded workpaper review notes and document drafts after the audit was finalized. I have carried this practice into my internal audit / SOX compliance work. In my experience, electronic workpaper platforms typically require sign-offs as programmed into the system, but I had thought the review comments themselves were purged when workpapers are finalized. You have given me another topic on which to survey people in my network, as I am interested in the extent of evidence being retained. As always, thanks for your insights.