The File Is the Audit: Why an Accounting Firm's Engagement Record Is Its Licence
The audit opinion a firm signs is worth exactly as much as the file behind it. When the Canadian Public Accountability Board or a provincial practice inspector arrives, they do not re-perform the audit; they read the engagement file. If the evidence, the risk assessments, the review notes, the judgments on estimates, and the partner and quality sign-offs are all present and internally consistent, the opinion stands. If the file is thin, contradictory, or visibly assembled after the fact, the firm has a problem that no amount of technical skill can repair once the archive deadline has passed. For an accounting firm, the working-paper file is not paperwork around the audit. It is the audit.
Every engagement generates a record that has to survive someone else's later scrutiny - a public-company audit, a private review, a due-diligence mandate, a tax file. Planning memos, materiality and risk assessments, audit evidence, confirmations, the analysis behind each significant estimate, consultation notes, and the engagement-quality reviewer's sign-off, all locked into an archive at completion. When those pieces are scattered across local drives, email threads, a document system nobody fully trusts, and the memory of a manager who has since rolled onto another client, the firm carries a quiet exposure: the conclusion may well be right, but the ability to demonstrate it is not guaranteed. Regulators, standard-setters, and plaintiffs all judge a firm on the same object - the file it can produce.
Recent context
The regulator has just made the stakes more visible. In its 2025 Annual Report, released in April 2026, the Canadian Public Accountability Board reported that it inspected 120 audit files and identified significant findings in 23% of them - down from 24% in 2024 and 34% in 2023 - and, for the first time, published inspection reports for individual firms. Even among the largest firms, significant findings appeared in 10 of 62 files inspected. The recurring themes were revenue, accounting estimates, and the supervision of group audits - areas where the conclusion turns entirely on whether the evidence and the reasoning were captured, in the file, at the time the work was done.
Documentation is the deliverable, not the tidy-up
The instinct is to treat working papers as after-the-fact housekeeping - something to square away once the real work is finished. Professional standards take the opposite view: if it is not in the file, it was not done. An estimate challenged three years later, a revenue cut-off questioned by an inspector, a fraud-risk judgment second-guessed by a plaintiff's expert - each is won or lost on whether the reasoning was recorded contemporaneously and can be retrieved intact. The falling CPAB finding rate is genuinely encouraging, but it is an average across firms; a single engagement with a gap in the file is a firm-level and partner-level risk regardless of the trend. And the pressure keeps rising: archive deadlines are strict, staff turnover is high, and the very same file may need to serve an inspector, a litigator, and a successor auditor years apart.
How XNM helps
XNM helps accounting and audit firms pull the engagement record into one auditable command centre - planning, risk assessments, evidence, confirmations, estimate analysis, consultations, and every review and sign-off, organized by engagement and locked when the file is complete. Where it helps, the XNM-Vision platform makes the current state of each file unmistakable, preserves the full trail of who did what and when, and keeps the archive defensible long after the opinion is signed - so a practice inspection, a peer review, or a claim meets a complete, time-stamped file rather than a reconstruction assembled from inboxes under pressure. The aim is not another repository to search; it is the single governed record that the engagement, the regulator, and any future dispute all depend on - and because it stands up in days rather than the many months a document overhaul usually takes, the discipline is in place before the next inspection cycle, not after it.
Practical takeaways
Treat the file as contemporaneous evidence. If the reasoning is not recorded when the work is done, it effectively did not happen; a file assembled after a demand letter is the weakest possible position.
Make the current state of every engagement visible. Partners need to see, at a glance, which files are complete, which are open, and which are past archive - not chase managers for status.
Keep the full sign-off trail, not just the conclusion. Who reviewed what, and when, is exactly what an inspector asks; that history has to survive turnover and the archive lock.
Prepare for inspection as a standing state, not an event. The firms that pass cleanly are the ones whose files are always inspection-ready, not the ones that scramble when CPAB calls.
Assume the file will be read years from now. Limitation periods are long and successor auditors ask; keep every engagement complete and retrievable so a future request meets a defence, not a gap.
FAQ
We already run a document-management system. Isn't that enough?
A repository tells you a file exists somewhere; it does not tell you whether the engagement is complete, whether every required review happened, or whether the archive was locked on time. The failures inspectors find live in that gap - between 'the working papers are stored' and 'the file demonstrably supports the opinion.' The value is a governed record where completeness, reviews, and sign-offs are visible together, not a folder you hope is current.
Isn't a low inspection-finding rate proof we're fine?
A firm-wide or industry average is reassuring, but you are not audited on the average - you are audited one file at a time. The exposure is the single engagement where a judgment was not documented, and that risk exists whether the trend is up or down. Getting each file right is how you make sure the one that gets pulled is the one that holds.
