Internal Audit Documentation

Internal Audit Documentation: SIA 330 Requirements and Working Papers

Internal Audit Documentation is an essential part of every internal audit assignment. It provides a written or electronic record of the audit procedures performed, evidence obtained, observations identified and conclusions reached by the internal auditor.

Proper documentation helps demonstrate how an audit conclusion was reached and enables another experienced reviewer to understand the work performed without requiring significant additional explanations.

The Institute of Chartered Accountants of India (ICAI) deals with internal audit documentation under Standard on Internal Audit (SIA) 330 – Internal Audit Documentation. The present SIA 330 superseded the earlier SIA 3 on Documentation.

Businesses undertaking an Internal Audit should therefore establish a systematic process for preparing, reviewing, maintaining and retaining internal audit working papers.

What is Internal Audit Documentation?

Internal Audit Documentation refers broadly to the records maintained by an internal auditor regarding:

  • audit procedures performed;
  • audit evidence obtained;
  • information and explanations reviewed;
  • tests and analytical procedures carried out;
  • significant audit findings;
  • observations identified;
  • professional judgments exercised;
  • discussions with management; and
  • conclusions reached during the audit.

Documentation may be maintained electronically or in physical form.

Under SIA 330, internal audit documentation should be sufficiently complete to support the findings and conclusions arising from the audit assignment.

For a basic understanding of the function itself, read our guide on What is Internal Audit?.

Objectives of Internal Audit Documentation

Internal Audit Documentation is not merely a collection of papers and records. It provides evidence of how the internal audit assignment was actually conducted.

The principal objectives are to:

  • validate internal audit findings;
  • support audit observations and conclusions;
  • provide evidence supporting the work performed;
  • facilitate supervision and review of internal audit work;
  • demonstrate compliance with applicable internal audit standards;
  • create an appropriate audit trail;
  • assist in subsequent audits and follow-up reviews; and
  • enable an experienced reviewer to understand the basis of the auditor’s conclusions.

ICAI’s SIA 330 specifically emphasizes documentation that supports findings, facilitates supervision and review and demonstrates conformity with applicable ICAI pronouncements.

Importance of Internal Audit Working Papers

Internal audit working papers form the backbone of the audit file.

A properly maintained audit file helps establish:

What was audited
The business process, transaction, location, department or control reviewed.

Why it was audited
The audit objective and identified risks.

What procedures were performed
Testing, sampling, analytical review, discussions, walkthroughs and other procedures.

What evidence was obtained
Documents, reports, confirmations, system records and management explanations.

What was found
Exceptions, control weaknesses, non-compliances and other observations.

How the auditor concluded
The professional judgment and reasoning supporting the final observation.

The documentation should therefore allow a reviewer to understand the complete audit trail.

Scope of SIA 330 – Internal Audit Documentation

SIA 330 applies to internal audit assignments and deals with key requirements relating to the preparation, collection, review and retention of internal audit documentation.

The nature and extent of documentation may vary depending upon:

  • size and complexity of the organisation;
  • nature of the audit assignment;
  • risks involved;
  • materiality of the matter;
  • complexity of the business process;
  • nature of audit evidence;
  • extent of professional judgment involved; and
  • significance of identified exceptions.

ICAI’s current standards framework lists SIA 330 among the standards governing the conduct of internal audit assignments.

What Should Internal Audit Documentation Contain?

Internal audit files may contain different types of documents depending upon the nature and scope of the engagement.

Typical documentation may include:

  • Internal Audit Charter;
  • engagement letter;
  • audit scope and objectives;
  • audit plan and programme;
  • risk assessment;
  • process narratives;
  • questionnaires;
  • internal control checklists;
  • flowcharts;
  • process walkthroughs;
  • sample selection;
  • supporting invoices and documents;
  • reconciliations;
  • management information reports;
  • agreements and contracts;
  • analytical procedures;
  • audit evidence;
  • management representations;
  • audit observations;
  • management responses;
  • working paper review notes;
  • internal audit reports; and
  • follow-up documentation.

The existing page also appropriately identifies items such as internal audit charter, internal control questionnaires, checklists, audit programmes, MIS reports and relevant agreements as documentation that may form part of the audit file.

You may also refer to our Internal Audit Checklist for the key areas normally examined during an internal audit.

Internal Audit Documentation Process

A systematic documentation process improves audit quality and makes review considerably easier.

Determine the Audit Objective and Scope

Before documentation begins, the internal auditor should clearly understand:

  • objectives of the engagement;
  • scope of work;
  • processes being reviewed;
  • applicable risks;
  • audit criteria; and
  • expected reporting requirements.

This should be consistent with the overall Internal Audit Process.

Prepare the Audit Programme

The audit programme should establish the procedures required to address identified risks and audit objectives.

Where a risk-based methodology is followed, the procedures should be aligned with the organisation’s major risks. Read more about our Risk Based Internal Audit guide.

Collect Appropriate Audit Evidence

The internal auditor should obtain sufficient and relevant evidence supporting the work performed.

Evidence may include:

  • invoices;
  • contracts;
  • system reports;
  • bank records;
  • reconciliations;
  • management reports;
  • external confirmations;
  • physical verification records;
  • emails and correspondence; and
  • representations from management.

Document Audit Procedures

The working papers should clearly record:

  • nature of procedure performed;
  • timing of the procedure;
  • extent of testing;
  • population tested;
  • samples selected;
  • evidence obtained;
  • exceptions noted; and
  • conclusion reached.

Where sampling is used, the basis of sample selection should also be documented. See our detailed guide on Sampling in Internal Audit.

Document Findings and Conclusions

Every material audit observation should normally be traceable to supporting working papers.

The documentation should establish the relationship between:

Audit procedure → Evidence → Finding → Risk/Impact → Recommendation → Conclusion

This improves both the reliability of the audit and the quality of the final report.

Identification of Preparer and Reviewer

Internal audit working papers should clearly identify the persons responsible for preparing and reviewing them.

Relevant details may include:

  • name of the person performing the procedure;
  • date of completion;
  • name of the reviewer;
  • date of review;
  • scope of review;
  • source of information;
  • cross-reference to supporting papers; and
  • evidence of review and approval.

The existing page already recognizes the importance of identifying the preparer, reviewer, dates, source of information and appropriate cross-referencing.

Review and Supervision of Audit Documentation

Internal audit documentation should undergo appropriate review.

The reviewer should assess whether:

  • audit procedures have been properly performed;
  • sufficient evidence has been obtained;
  • findings are supported by working papers;
  • conclusions are reasonable;
  • significant matters have been appropriately documented; and
  • the documentation complies with applicable standards.

ICAI’s Internal Audit Checklist similarly stresses review of work papers and documentation sufficient to allow the reviewer to understand the work performed and conclusions reached.

Documentation of Exceptional Circumstances

Where exceptional circumstances arise during the audit, the working papers should record the circumstances and how they were dealt with.

Documentation may include:

  • description of the exceptional circumstance;
  • additional procedures performed;
  • additional evidence obtained;
  • judgments exercised;
  • resulting changes to audit conclusions;
  • person making the changes;
  • reviewer of those changes; and
  • date of modification or review.

This creates a transparent audit trail and reduces uncertainty during subsequent reviews.

Completion of Internal Audit Documentation

Internal audit working papers should be completed on a timely basis.

According to ICAI guidance linked with SIA 330, audit work paper files should normally be completed before issuance of the final internal audit report, and pending administrative matters should be completed within 60 days from the release of the final report.

The purpose of this requirement is not merely administrative. Timely documentation generally produces a more accurate record because the procedures, evidence and professional judgments are still fresh in the auditor’s mind.

Retention and Custody of Internal Audit Documentation

An organisation or internal audit function should establish a written policy regarding:

  • retention period;
  • custody of working papers;
  • authorised access;
  • confidentiality;
  • electronic storage;
  • data security;
  • document modification;
  • destruction of records; and
  • access by third parties.

The retention period may depend upon applicable laws, contractual obligations, organisational policies and professional requirements.

Access to internal audit documentation should ordinarily be restricted to authorised personnel because audit files may contain confidential financial, commercial, employee and control-related information.

Internal Audit Documentation and Audit Evidence

Audit evidence and audit documentation are closely related but should not be treated as exactly the same concept.

Audit evidence is the information used by the auditor to reach a conclusion.

Audit documentation is the record showing the procedures performed, evidence examined and conclusions reached.

Therefore, invoices, contracts, reports or confirmations may constitute audit evidence, while the working paper explaining how those documents were tested and what conclusion was reached forms part of audit documentation.

Internal Audit Documentation and Audit Charter

An Internal Audit Charter establishes the authority, responsibility, purpose and scope of the internal audit function.

The audit charter therefore provides an important foundation for internal audit documentation because individual audit assignments should remain consistent with the mandate and authority provided to the internal audit function.

Internal Audit Documentation Checklist

Before closing an internal audit file, the auditor should check whether:

  • audit objectives and scope are documented;
  • audit programme is available;
  • significant risks are recorded;
  • procedures performed are documented;
  • samples selected are identifiable;
  • evidence is cross-referenced;
  • findings are supported;
  • management responses are recorded;
  • conclusions are documented;
  • preparer and reviewer are identifiable;
  • review notes have been resolved;
  • final report agrees with working papers; and
  • documentation is appropriately stored and retained.

Common Mistakes in Internal Audit Documentation

Some common documentation weaknesses include:

  • insufficient audit evidence;
  • incomplete working papers;
  • absence of cross-references;
  • undocumented professional judgments;
  • observations not supported by evidence;
  • failure to identify preparer or reviewer;
  • inadequate review;
  • excessive documentation without relevance;
  • poor organisation of electronic audit files; and
  • incomplete closure of working papers.

Good documentation should therefore be relevant, reliable, complete and capable of supporting the conclusions reached.

Frequently Asked Questions

What is Internal Audit Documentation?

Internal Audit Documentation is the written or electronic record of procedures performed, evidence obtained and conclusions reached during an internal audit assignment.

Which ICAI standard deals with Internal Audit Documentation?

ICAI’s SIA 330 – Internal Audit Documentation deals specifically with documentation requirements. The earlier SIA 3 on Documentation has been superseded by SIA 330.

What are internal audit working papers?

Internal audit working papers are documents recording the procedures performed, evidence examined, findings identified and conclusions reached during an audit assignment.

Why is internal audit documentation important?

It provides evidence supporting audit findings, enables supervision and review, creates an audit trail and helps demonstrate that the audit was performed in accordance with applicable requirements.

Who should review internal audit documentation?

Working papers should be reviewed by an appropriately experienced person responsible for supervising or reviewing the internal audit assignment.

Can Internal Audit Documentation be maintained electronically?

Yes. Internal audit documentation may be maintained electronically, subject to appropriate controls over security, confidentiality, access, modification and retention.

How quickly should internal audit files be completed?

The substantive audit working papers should be completed as the audit progresses. Under ICAI guidance, pending administrative matters relating to the final working-paper file should be completed within 60 days after release of the final audit report.

Professional Internal Audit Services in India

Effective internal audit requires much more than completing checklists. It requires an organised approach to risk assessment, testing, evidence collection, documentation, reporting and follow-up.

EzyBiz India assists Indian and foreign-owned businesses with Internal Audit Services in India, including risk-based audits, internal control reviews, compliance audits, process audits and management reporting.

For a wider overview of our assurance practice, visit our Audit and Assurance Services in India.

Related Services

Prepared By

Anil Agrawal, Chartered Accountant
EzyBiz India Consulting LLP, New Delhi
Chartered Accountant with experience in audit, taxation, regulatory compliance and business advisory services.

Last Updated: August 2026

Disclaimer:

This article is intended for general informational and educational purposes only and should not be considered professional or legal advice. Internal audit requirements may vary depending on the nature, size and circumstances of an organisation and applicable laws and regulations. Readers should refer to the latest standards, guidance and pronouncements issued by the Institute of Chartered Accountants of India (ICAI) and obtain professional advice before acting on the information contained in this article.