SSA 230 and the 60-day file, step by step.

SSA 230 para 14 requires the auditor to put the audit documentation into an audit file and to complete the administrative work of assembling the final file on a timely basis after the date of the auditor's report. Para A21 explains that firms set time limits for this, and that an appropriate limit is ordinarily not more than 60 days after the report date.

At firm level, SSQM 1 makes timely assembly of engagement documentation after the report date, and its proper keeping, one of the quality objectives of the firm's system (para 31(f)). Its guidance expects the firm to set the time limit where law or regulation does not, and gives the same 60-day guide (para A83). So the deadline that binds your team is the one in your firm's own policy, which should ordinarily be no longer than 60 days.

The 60 days run from the date of the auditor's report. Under SSA 700 (Revised) para 49, that date can be no earlier than the date on which the auditor has obtained sufficient appropriate evidence, including evidence that the financial statements have been prepared and that those with authority have taken responsibility for them. All the audit work belongs before that date; assembly comes after it.

Firms that automate the deadline should check that the report date in the system is the date on the signed report. ACRA notes that reminders and locks only work if they are triggered by the correct date.

Assembly is administrative. It does not involve new audit procedures or new conclusions (A22). During assembly a team may:

• remove drafts and papers that later versions replaced;
• put the papers in order, file them and add cross-references;
• tick off the checklists that cover closing the file;
• write up evidence the team already had, and had agreed among themselves, before the report date.

In practice: if a team finds it needs to do more work after the report date, that is no longer assembly. It falls under the rules below.

New work after the report date. If, in exceptional circumstances, the auditor performs new or further procedures or reaches new conclusions after the report date, whether or not the file has been assembled, the file records the circumstances, the procedures, the evidence, the conclusions and their effect on the report, and when and by whom the changes were made and reviewed (para 13).

Once the file is assembled, nothing in it may be removed before the retention period ends (para 15). Any other change or addition records the specific reasons, and when and by whom it was made and reviewed (para 16).

The firm's policies set the retention period. For audits, SSA 230 and SSQM 1 say it is ordinarily no shorter than five years from the date of the auditor's report or, if later, the date of the group auditor's report (SSA 230 A23; SSQM 1 A85). Law, regulation or a firm's own needs can require longer.

For electronic files, the firm's policies should also protect the file's integrity, control who can access it and keep it readable for the whole period.

In its Audit Regulatory Report 2024, ACRA notes that archiving lapses and personal independence breaches are consistently among firms' top non-compliances, and that some firms did not deal with repeat offenders in appraisals or discipline. It describes practices some firms use to stop the lapses:

• an internal deadline shorter than 60 days, so files are closed before the team moves on;
• reminders before the due date, sent automatically by some firms;
• locking the file automatically on the due date;
• checking that the report dates driving these controls are correct.

These are Nebis's suggestions.

1. Write the deadline into your SSQM 1 policies, shorter than 60 days, and say who owns it.
2. Record the report date the day the report is signed, and drive the deadline from it.
3. Track every open file's deadline in one place, with reminders.
4. Lock the file at assembly, and log any later change with its reason, who made it and who reviewed it.
5. Test the control as part of your monitoring, and treat repeated lapses as a performance matter.

In the Nebis workspace the archive deadline is counted from the report date and shown on the dashboard with a countdown. At archive, the file becomes read-only, and the engagement is packed as the final papers in PDF and Excel, every evidence file as uploaded and the audit trail, with a manifest that lets anyone verify a copy. The pack can be read without Nebis.

The audit workspace · Security and data · SSQM module