ISA 230 states: “The auditor should adopt appropriate procedures for maintaining the confidentiality and safe custody of the working papers and for retaining them for a period sufficient to meet the needs of the practice and in accordance with legal and professional requirements of record retention.” By contrast, the proposed International Standard on Quality Control, ISQC 1, addresses the issue of document retention in the context of the firm’s system of quality control. The high-level guidance in ISQC 1 states: “The firm retains this documentation for a period of time sufficient to permit those performing monitoring procedures to evaluate the firm’s compliance with its system of quality control, or for a longer period if required by law or regulation.”
The firms therefore should establish policies and procedures designed to maintain the confidentiality, safe custody, integrity, accessibility and irretrievability of documentation, for example:
• Passwords to restrict access to electronic documentation to authorized users
• Back-up routines
• Confidential storage of hard copy documentation.
Local laws are likely to specify retention periods. These are unlikely to be shorter than five years. In the PPADA (2015) the procurement records should be kept for 6 years.
