Maintenance, Archival and Submission of Audit Files to NFRA · NF-22/52/2025-NFRA

राष्ट्रीय वित्तीय रिपोर्टिंग प्राधिकरण National Financial Reporting Authority ***** 7वीं मंजिल, हिन्दुस्तान टाइम्स हाउस कस्तूरबा गांधी मार्ग, नई दिल्ली

दिनांक: 16 दिसंबर 2025

NF-22/52/2025-NFRA

Circular

To

All Statutory Auditors of Public Interest Entities (PIEs) covered under Rule 3 of NFRA Rules, 2018

Sub: Maintenance, archival and submission of Audit File to National Financial Reporting Authority (NFRA) – reg.

In the course of performing its statutory functions, NFRA requires the audit firm¹ to provide audit files as evidence of the work done by the audit firm in respect of specific audit engagements. During the course of performance of its monitoring, enforcement and oversight activities, NFRA has observed certain deficiencies in the audit firms’ submission of audit files to NFRA, and their compliance with the requirements of maintenance and archival of audit files as per Standards on Auditing (SAs) and Standard on Quality Control (SQC 1).

Requirements of Professional Standards

2. The Standards on Auditing (SAs)² including the Standard on Quality Control (SQC 1) define and provide guidance as to what constitutes an audit file and its evidentiary value in respect of the audit process undertaken by an auditor in support of his audit opinion/report. Accordingly, audit firms are required to design policy, procedures and controls around maintaining the sanctity of audit files, ensuring their completeness and timely archival, including controls around authorised access to archived files.

Components and attributes of an Audit file

3. Paragraph 6 (b) of SA 230 defines an Audit File as “One or more folders or other storage media, in physical or electronic form, containing the records that comprise the audit documentation for a specific engagement”. Paragraphs 2, 3 and 5 of SA 230 describe the nature and purposes of audit documentation, and the objectives of the auditor to prepare documentation as: (a) sufficient and appropriate record of the basis for the auditor’s report; and (b) evidence that the audit was planned and performed in accordance with SAs and applicable legal and regulatory requirements. Paragraph 6 defines audit documentation (terms such as

“working papers” or “workpapers” are also sometimes used), as the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached.

4. Paragraph 13(b) of SA 200 and Paragraph 5 in SA 500 defines audit evidence as the information used by the auditor in arriving at the conclusions on which the auditor’s opinion was based.

5. Paragraphs 8 and 10 of SA 230 require mandatory documentation of the nature and extent of the audit procedures performed, the audit evidence obtained, significant professional judgments, and the discussions of important matters with management, those charged with governance, and others.

Timely Completion, Archival, Retention and Access of Audit File

6. The SAs also provide that the audit file has to be assembled by an auditor and archived in a specific timeframe to establish integrity of the audit process. In support, paragraphs 14 and 15 of SA 230 require the mandatory assembly of the final audit file after the date of the audit report on a timely basis and its mandatory retention for the specified period.

7. Paragraph 75 of SQC 1 Engagement Documentation: Completion of the Assembly of Final Engagement Files stipulates the need to complete the assembly of final engagement files on a timely basis after the engagement reports have been finalised. In the case of an audit, such a time limit is ordinarily not more than 60 days after the date of the auditor’s report (also refer paragraph A21 of SA 230).

8. The retention of audit documentation is provided for in paragraphs 82 and 83 of SQC 1. These provisions state that the firm should establish policies and procedures for the retention of engagement documentation for a period sufficient to meet the needs of the firm or as required by law or regulation. The retention period may also depend on other factors, such as whether local law or regulation prescribes specific retention periods for certain types of engagements, or whether there are generally accepted retention periods in the jurisdiction in the absence of specific legal or regulatory requirements. In the specific case of audit engagements, the retention period ordinarily is no shorter than seven years from the date of the auditor’s report, or, if later, the date of the group auditor’s report (also refer paragraph A23 of SA230).

9. Paragraph 85 of SQC 1 deals with ownership of engagement documentation and states that unless otherwise specified by law or regulation, engagement documentation is the property of the firm.

10. Paragraph 77 of SQC 1 requires the firm establish policies and procedures designed to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation. Paragraph 79 of SQC 1 goes on to caution that integrity, accessibility or retrievability of the underlying data may be compromised if the documentation could be altered, added to or deleted without the firm’s knowledge, or if it could be permanently lost or damaged, irrespective of whether engagement documentation is in paper, electronic or other media.

11. In this regard, it is also relevant to refer to paragraph 81 of SQC 1, which provides for retention of all original paper documentation if some such documentation is to be included in engagement files by converting it into electronic files. paragraph 81 of SQC 1 states that,

“For practical reasons, original paper documentation may be electronically scanned for inclusion in engagement files. In that case, the firm implements appropriate procedures requiring engagement teams to:

(a) Generate scanned copies that reflect the entire content of the original paper documentation, including manual signatures, cross-references and annotations;

(b) Integrate the scanned copies into the engagement files, including indexing and signing off on the scanned copies as necessary; and

(c) Enable the scanned copies to be retrieved and printed as necessary.

The firm considers whether to retain original paper documentation that has been scanned for legal, regulatory or other reasons.”

(emphasis supplied)

Observed delays in submission of Audit files to NFRA, beyond reasonable time

12. In view of the requirements in the professional standards outlined above, it is mandatory that audit documentation is completed contemporaneously by the audit firms and archived within the specified timeframe. Therefore, audit firms require only a short period of time for submitting the audit files to NFRA, when required. Based on NFRA's oversight and monitoring activities, in several matters it has been observed that some auditors of entities falling under Rule 3 of the NFRA Rules 2018 i.e. Public Interest Entities (PIEs), sometimes seek an unreasonable extension of time for submitting audit files to NFRA. While in the interest of natural justice, such extensions have been granted time and again, the elongated timelines sought by audit firms affect the overall timely consideration of the matter at NFRA.

13. Such extensions have, it appears, also been utilised in a few observed instances to convert physical files to electronic formats or vice versa, before sending the files to NFRA and even for preparation of fresh/additional audit documentation (after the expiry of prescribed timeline for assembly and archival of audit files) solely for submission to NFRA.

Footnotes

1. In some places the terms 'auditor' or 'auditors' are used in place of the terms 'audit firm', 'audit firms', 'firm' or 'firms' to align with the drafting convention of SAs/SQC 1 ↩

2. Standard on Auditing (SA) 230, Audit Documentation & Standard on Auditing (SA) 500 Audit Evidence ↩