Review of report and workpaper records management practices

Status: Live

If audits are outsourced, the organization will determine the locations of audit reports and work papers to include determining the time period the work papers will be maintained and how access is allowed to the electronically stored work papers. [UCF ID 01195]

Supporting and supported controls

This control directly supports:

Review of external auditor outsourcing contracts and engagement letters [UCF Control ID 01189]

There are no supporting controls.

Authority documents complied with:

FFIEC IT Examination Handbook – Audit, August 2003, Pg 22, Exam Tier I Obj 11.2; EU 8th Directive (European SOX), Art 27

Banking and Finance Guidance

The external auditor contract should include the location of internal audit reports and work papers and should specify the period of time the work papers must be kept. [Pg 22, Exam Tier I Obj 11.2, FFIEC IT Examination Handbook – Audit, August 2003]

EU Guidance

When an audit of a consolidated group of accounts is undertaken, the group auditor must review and maintain documentation of the audit work performed by all auditors or audit firms. The group auditor must retain copies or have unrestricted access to all the information and reports of each auditor or audit firm. [Art 27, EU 8th Directive (European SOX)]