Record Retention for Audits and Other Services
By Paula Young, CPA, EisnerAmper LLP –
March 21, 2019
There are many different rules that are related to record retention. A firm should look to the various rules that relate to them and develop a policy for their firm. Below are excerpts from some of the most common places that include record retention rules, especially for audits. Most firms seem to adopt retention periods of seven to 10 years to cover all bases.
AICPA - Auditing Standards (SAS)\Codification
AU-C Section 200: General Principles and Responsibilities
AU-C Section 230: Audit Documentation
.17 After the documentation completion date, the auditor should not delete or discard audit documentation of any nature before the end of the specified retention period. Such retention period, however, should not be shorter than five years from the report release date. (Ref: par. .A27–.A29)
.A27 Firms are required to establish policies and procedures for the retention of engagement documentation.13 Statutes, regulations, or the audit firm's quality control policies may specify a retention period longer than five years.
13 Paragraph .50 of QC section 10.
.A28 An example of a circumstance in which the auditor may find it necessary to modify existing audit documentation or add new audit documentation after the documentation completion date is the need to clarify existing audit documentation arising from comments received during monitoring inspections performed by internal or external parties.
.A29 Audit documentation is the property of the auditor, and some states recognize this right of ownership in their statutes. The auditor may make available to the entity at the auditor's discretion copies of the audit documentation, provided such disclosure does not undermine the effectiveness and integrity of the audit process.
AICPA - Quality Control Standards\Codification
QC Section 10: A Firm's System of Quality Control
Completion of the Assembly of Final Engagement Files
.49 The firm should establish policies and procedures for engagement teams to complete the assembly of final engagement files on a timely basis after the engagement reports have been released. (Ref: par. .A53–.A54)
Confidentiality, Safe Custody, Integrity, Accessibility, and Retrievability of Engagement Documentation
.50 The firm should establish policies and procedures designed to maintain the confidentiality, safe custody, integrity, accessibility, and retrievability of engagement documentation. (Ref: par. .A55–.A58)
Retention of Engagement Documentation
.51 The firm should establish policies and procedures for the retention of engagement documentation for a period sufficient to meet the needs of the firm, professional standards, laws, and regulations. (Ref: par. .A59–.A62)
Retention of Engagement Documentation (Ref: par. .51)
.A59 The needs of the firm for retention of engagement documentation and the period of such retention will vary with the nature of the engagement and the firm's circumstances (for example, whether the engagement documentation is needed to provide a record of matters of continuing significance to future engagements). The retention period may also depend on other factors, such as whether professional standards, law, or regulation prescribe specific retention periods for certain types of engagements or whether generally accepted retention periods exist in the absence of specific legal or regulatory requirements.
.A60 In the specific case of audit engagements, the retention period would be no shorter than five years from the report release date.3
3 Paragraph .17of AU-C section 230, Audit Documentation. [Footnote revised, October 2011, to reflect conforming changes necessary due to the issuance of SAS No. 122.]
.A61 Procedures that the firm may adopt for retention of engagement documentation include those that enable the requirements of paragraph .51 to be met during the retention period, such as, for example, procedures to
- enable the retrieval of, and access to, the engagement documentation during the retention period, particularly in the case of electronic documentation because the underlying technology may be upgraded or changed over time.
- provide, when necessary, a record of changes made to engagement documentation after the assembly of engagement files has been completed.
- enable authorized external parties to access and review specific engagement documentation for quality control or other purposes.
Ownership of Engagement Documentation
.A62 Unless otherwise specified by law or regulation, engagement documentation is the property of the firm. The firm may, at its discretion, make portions of, or extracts from, engagement documentation available to clients, provided that such disclosure does not undermine the validity of the work performed or, in the case of assurance engagements, the independence of the firm or its personnel.
New Jersey State Board of Accountancy Law
45:2B-66 Disposition of records
25. a. All statements, records, schedules, working papers, memoranda or other records made by a licensee or a partner, shareholder, officer, director, member, manager or employee of a licensee or firm, incident to, or in the course of, rendering services to a client in the practice of public accountancy, except the reports submitted by the licensee or firm to the client and except for records that are part of the client's records, shall be and remain the property of the licensee or firm, unless there is an express agreement between the licensee or firm and the client to the contrary. No such statement, record, schedule, working paper, or memorandum shall be sold, transferred, or bequeathed, without the consent of the client or the client's designated representative or assignee, to anyone other than one or more surviving partners, shareholders, members or new partners, new shareholders, or new members of the licensee or firm, or any combined or merged firm or successor in interest to the licensee or firm. Nothing in this section shall prohibit any temporary transfer of working papers or other material necessary in the course of carrying out quality reviews or as otherwise interfering with the disclosure of information pursuant to this act.
b. A licensee shall furnish to a client or former client, upon request and reasonable notice:
(1) A copy of the licensee's working papers or other records, to the extent that these would ordinarily constitute part of the client's records and are not otherwise available to the client; and
(2) Any accounting or other records belonging to the client, or obtained from or on behalf of the client, that the licensee or firm removed from the client's premises or received for the client's account. The licensee or firm may make and retain copies of such documents of the client when they form the basis for work done by the licensee or firm.
c. Nothing contained in this section shall require a licensee or firm to keep any working papers beyond the period prescribed in any other applicable statute.
Uniform Accountancy Act Model Rules
Rule 7-7 - Attest documentation and retention.
(a) Licensees shall comply with all professional standards for attest documentation applicable to particular engagements, including, but not limited to standards adopted by recognized standards setting bodies such as the Public Company Accounting Oversight Board (PCAOB), the Comptroller General of the United States, and the Auditing Standards Board.
(b) If the applicable standards do not otherwise specify, the retention period for attest documentation shall be five (5) years and shall be measured from the report date.
(c) If attest documentation is required to be kept for longer than provided in the applicable standards or Rule 7-7(b) because of a pending Board investigation or disciplinary action, attest documentation shall not be destroyed until the licensee has been notified in writing by the Board of the closure of a Board investigation or disciplinary proceeding.
Securities and Exchange Commission
Final Rule: Retention of Records Relevant to Audits and Reviews
17 CFR Part 210
[Release Nos. 33-8180; 34-47241; IC-25911; FR-66; File No. S7-46-02]
Summary: We are adopting rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements. Records to be retained include an accounting firm's workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.
Dates: Effective Date: March 3, 2003. Compliance Date: Compliance is required for audits and reviews completed on or after October 31, 2003.
For Further Information Contact: Samuel L. Burke, Associate Chief Accountant, D. Douglas Alkema, Professional Accounting Fellow, or Robert E. Burns, Chief Counsel, at (202) 942-4400, Office of the Chief Accountant, U.S. Securities and Exchange Commission, 450 Fifth Street, NW, Washington, DC 20549-1103.
Supplementary Information: We are adding rule 2-06 to Regulation S-X.
Paula M. Young
Paula M. Young, CPA, is a partner in the professional practice group at EisnerAmper LLP. She is a member of the NJCPA Professional Conduct Committee and Accounting & Auditing Standards Interest Group and has served as chairperson of both groups.