Audit work papers are owned by the accounting firm that prepared them, not the client whose books were audited, and federal law requires firms to keep the papers from a public company audit for at least seven years after the report is released. Private company audits fall under state board and AICPA rules, where five years is a common minimum, though many firms apply the seven-year period across every engagement. Willfully destroying audit records tied to a public company can be prosecuted as a felony.
Who Owns Audit Work Papers
The auditor owns the file. The AICPA Code of Professional Conduct puts it in one line: “Working papers are the member’s property, and the member is not required to make such information available.”1American Institute of Certified Public Accountants. AICPA Code of Professional Conduct Working papers include audit programs, analytical review schedules, statistical sampling results, and even items the client prepared at the auditor’s specific request that reflect the auditor’s testing work.
The client’s own records are a separate category. Invoices, contracts, bank statements, and general ledger printouts belong to the client. Those are inputs to the audit. What the auditor creates by testing those inputs — the confirmations, the sampling analyses, the memos explaining judgment calls — is the firm’s property.
Because the firm owns the papers, a client has no automatic right to a copy. State statutes, federal law, and the engagement letter itself can expand access beyond that default, and some state boards require CPAs to return certain client-supplied records on request.1American Institute of Certified Public Accountants. AICPA Code of Professional Conduct The baseline, though, is that the work papers stay with the firm.
How Long Work Papers Must Be Kept
For public company audits, the retention period is seven years. PCAOB Auditing Standard 1215 requires audit documentation to be retained for seven years from the report release date, meaning the date the auditor grants permission to use the report with the company’s financial statements.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation If no report is issued, the clock runs from the date fieldwork was substantially completed. If the engagement was abandoned, it runs from the date the engagement ceased.
The seven-year rule originated in Section 802 of the Sarbanes-Oxley Act, which directed the SEC to write retention regulations for auditors. The SEC implemented it through Rule 2-06 of Regulation S-X, covering work papers plus all related memoranda, correspondence, communications, and records containing conclusions, opinions, analyses, or financial data.3Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews
Private company audits are outside Sarbanes-Oxley and outside PCAOB standards. Retention is governed instead by AICPA professional standards and individual state board of accountancy rules, and a five-year minimum is common. Many firms extend the seven-year period to every engagement anyway. It avoids the mess of misclassifying a file, and it protects the firm if a private client later goes public through an IPO or a merger.
One thing overrides any of these calendars. If litigation or a regulatory investigation is reasonably anticipated, a litigation hold takes effect and nothing potentially relevant can be destroyed until the matter is fully resolved, even if the standard retention period has expired. Destroying records after a hold is triggered can lead to court sanctions and adverse inferences.
The 14-Day Assembly Deadline
The retention clock starts at the report release date, but there is a second, tighter deadline that governs the file itself. PCAOB AS 1215 requires that a complete and final set of audit documentation be assembled and archived no later than 14 days after the report release date.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation That 14-day window is the documentation completion date.
After that date passes, nothing in the file can be deleted or discarded. Additions are still permitted, but each addition has to record the date it was added, the name of the person who added it, and the reason for the addition.2Public Company Accounting Oversight Board. AS 1215 – Audit Documentation The rule is designed to block after-the-fact rewriting of the audit story. Every change after the completion date leaves a permanent trail.
When the Firm Has to Turn Papers Over
Owning the papers is not the same as being free to share them, and it is not the same as being free to refuse. The AICPA’s Confidential Client Information Rule (Rule 1.700.001, formerly Rule 301) prohibits a member from disclosing confidential client information without the client’s consent, and that consent should be in writing.4Journal of Accountancy. AICPAs Revised Confidentiality Rule and Sec 7216
Several situations override that default:
- A valid subpoena or summons.4Journal of Accountancy. AICPAs Revised Confidentiality Rule and Sec 7216
- Applicable statutes and government regulations, including SEC and PCAOB inspections and enforcement demands. Sarbanes-Oxley gave the PCAOB broad authority to inspect registered firms and demand production of audit documentation, and confidentiality is not a defense.
- Peer review. Most state boards require CPA firms to undergo peer review, typically every three years, covering the accounting and auditing practice not subject to PCAOB permanent inspection. Firms have to cooperate, which means producing the relevant work papers.5AICPA. AICPA Standards for Performing and Reporting on Peer Reviews
- Successor auditor review. When a client changes auditors, PCAOB AS 2610 sets the process: the new firm asks the client to authorize the predecessor to allow a review of prior work papers. The predecessor may require a signed consent and acknowledgment letter first, and access is typically limited to areas the successor identifies as relevant.6Public Company Accounting Oversight Board. AS 2610 – Initial Audits Communications Between Predecessor and Successor Auditors
Criminal and Civil Penalties
Section 802 of the Sarbanes-Oxley Act created 18 U.S.C. § 1520, which makes it a federal crime to knowingly and willfully violate the audit record retention requirements. The penalty is a fine, imprisonment of up to 10 years, or both.7Office of the Law Revision Counsel. United States Code Title 18 Section 1520 Because the maximum imprisonment exceeds one year, the offense is a felony under federal law.
A broader statute reaches further. Under 18 U.S.C. § 1519, anyone who knowingly alters, destroys, or falsifies any record with the intent to obstruct a federal investigation or any matter within the jurisdiction of a federal agency faces up to 20 years of imprisonment.8Office of the Law Revision Counsel. United States Code Title 18 Section 1519 Section 1519 is not limited to audit records; it covers any document destruction aimed at impeding federal oversight.
Civil enforcement has bite as well. In 2024, the SEC charged 26 firms for widespread failures to maintain and preserve required electronic communications, with combined civil penalties of $392.75 million. Individual penalties ranged from $400,000 to $50 million depending on the scope of the violations and whether the firm self-reported.9U.S. Securities and Exchange Commission. Twenty-Six Firms to Pay More Than $390 Million Combined to Settle SECs Charges for Widespread Recordkeeping Failures Firms that came forward on their own received significantly lower penalties, a pattern the SEC highlighted to encourage self-reporting.