The File Is the Audit: Why Inspection Readiness Is a Records Problem
Three years after the opinion was signed, a practice inspector pulls the engagement file and starts asking questions no one on the original team remembers the answer to. Why was this estimate accepted? Where is the evidence that the fraud risk was addressed? Who reviewed the group-audit component, and against what? The partners who did the work have moved firms or moved on. What defends the firm now is not their memory; it is the file. In an audit practice, the engagement file is not documentation of the work - it is the work, re-examined years later by someone who was never in the room.
A Partner or Director of Risk and Quality does not carry one engagement; they carry a portfolio of them, each a stack of working papers, planning memos, risk assessments, evidence, review notes, and sign-offs that has to hang together and reproduce the conclusion long after the engagement closes. Retention obligations run for years; CPAB and provincial practice inspectors sample without much warning; and the standard for a passing file is not 'the audit was probably fine' but 'a knowledgeable, independent reviewer can follow the evidence to the opinion.' When that record is spread across an audit tool, a document management system, personal drives, and email, inspection readiness stops being a state the firm is in and becomes a fire drill it survives.
Recent context
The bar is public and it is rising. CPAB's 2025 Annual Report shows that of 120 audit files inspected in 2025, 23% still had significant findings - an improvement from 24% in 2024 and 34% in 2023, but still nearly one file in four. Recurring themes cut straight to the record: how technology and AI-enabled tools are used and evidenced in the audit, fraud-risk identification and response, group audits, and the evaluation of accounting policies. Every one of those is, at inspection, a question of what the file can show - not what the team believed at the time.
The file has to reproduce the judgment, not just store it
Audit quality is judged retroactively, by whether the file lets an outsider re-derive the conclusion. That is a higher bar than storage. A working paper that exists but does not connect the risk to the procedure to the evidence to the sign-off leaves a gap an inspector will find - and a gap discovered years later cannot be filled, because the audit is over and the standard forbids after-the-fact edits. The recurring CPAB themes - estimates, revenue, group components, and now the use of AI tools - are all places where judgment is dense and the file has to carry the reasoning, not just the result. A firm that treats the engagement file as a live, governed record while the work is happening walks into an inspection able to reproduce its judgment on demand. A firm that treats it as a folder to tidy up at archiving faces the opposite: a reconstruction under a deadline, from people who may no longer be there.
How XNM helps
XNM helps an audit practice keep the engagement record in one auditable command centre - planning, risk assessments, working papers, evidence, review notes, and approvals, organized by engagement and locked down at completion with the version history intact. Where it fits, XNM-Vision keeps each file complete and reproducible: the current, sign-off-ready set is unmistakable, superseded working papers are preserved rather than overwritten, and retention runs on the file automatically so nothing ages out before it should. When CPAB or a provincial inspector selects an engagement, the firm produces a coherent, time-stamped record instead of assembling one - and because it stands up in days rather than the long roll-out a records program usually takes, quality leadership gets that visibility across the whole portfolio in time for this inspection cycle, not the next.
Practical takeaways
Treat the engagement file as the deliverable it will be inspected as. The opinion is signed once; the file is judged for years - build it to reproduce the judgment, not just to hold the papers.
Lock the file at completion and keep the version trail. Post-archiving edits are the fastest way to fail an inspection; freeze the record and preserve what was superseded rather than overwriting it.
Make the evidence chain followable end to end. Risk to procedure to evidence to sign-off should read as one connected line; the gaps an inspector finds are the links that were left implicit.
Run retention on the file, not on someone's calendar. Retention periods are long and firm-wide; automate them so no engagement ages out early or lingers past obligation.
Assume the reviewer was never in the room. The people who did the work will move on; the file has to make the audit reproducible for someone who joins it years later.
FAQ
We use a leading audit platform. Doesn't that make us inspection-ready?
An audit tool structures the current engagement well; inspection readiness is a portfolio-and-time problem it does not fully solve. Findings surface where evidence lives outside the tool, where a file was edited after archiving, or where a component or estimate cannot be traced through to the opinion. Readiness is the state of the whole record over its full retention life - complete, locked, and reproducible - not just a tidy workspace during the engagement.
Findings are improving. Isn't the problem taking care of itself?
The trend is genuinely better - 34% to 23% in two years - but nearly one inspected file in four still had a significant finding, and the recurring themes are exactly the hardest-to-document judgments. Improvement at the profession level does not protect an individual firm whose sampled file cannot reproduce its conclusion. The firms that stay off the findings list are the ones whose records are ready before the sample is drawn, not after.
The bottom line
In assurance, the file is the audit - and it is inspected long after the opinion is signed, by someone who will only ever see the record. The firms that pass are not necessarily the ones with the best judgment in the moment; they are the ones whose judgment is still legible years later, in a file that is complete, locked, and reproducible. Practice inspection does not test what the team knew. It tests what the record can show.
