Audit documentation — PCAOB AS 1215 (issuer audits) and AICPA AU-C 230 (non-issuer audits)
This page is generated from the requirement table the AiSSAY engine ships for this framework. When the engine produces an evidence pack, each row below gets a status computed from the operator's own records at that moment. This page shows the table, not anyone's results.
Informational mapping prepared by the operator's own tooling. Not a legal opinion, not a certification, and not a substitute for advice of counsel. It organizes the operator's records against the cited requirements; whether those records satisfy the requirements is a determination for the operator, counsel, and the examiner.
AS 1215 as amended by AS 1000: the documentation completion date is 14 days after the report release date, phased in for fiscal years beginning on or after 15 December 2024 or 2025 depending on firm size (it was 45 days). QC 1000 takes effect 15 December 2026; amendments adopted 9 September 2026 await SEC approval. The technology-assisted analysis amendments to AS 1105 and AS 2301 apply to fiscal years beginning on or after 15 December 2025.
The requirement table
8 rows: 6 mechanism, 1 organizational, 1 named gap
| Requirement | Mechanism, duty or gap | Type |
|---|---|---|
| AS 1215.06 — documentation shows who performed the work and who reviewed it, and when | each run records its steps with timestamps; a named reviewer's countersign is sealed beside it with its own time; reads are signed when the reader supplies an identity key | mechanism |
| AS 1215.14 — retain audit documentation for seven years from the report release date | per-record retain-until dates, set when a record is sealed (default seven years); deletion before that date is refused without a recorded override; legal hold blocks deletion outright | mechanism |
| AS 1215.15 — assemble the complete file by the documentation completion date | every record is dated in the chain as it is sealed, and a full export gives the complete set for a period at any time. Meeting the deadline is the firm's. | mechanism |
| AS 1215.16 — after completion nothing is deleted or discarded; anything added records when, by whom and why | append-only hash chain: a correction is a new record referencing the original, every addition carries its time and actor, and a deletion leaves a tombstone; an early deletion records its override and reason | mechanism |
| AS 1105 and AS 2301 — evaluate the reliability of electronic information and follow up items the analysis flags | each run's figures are recomputed exactly and reconciled against the sources they cite; discrepancies are raised as findings and flagged for review. The follow-up is the auditor's. | mechanism |
| AU-C 230 — retain documentation at least five years, and record who changed what after assembly, when and why | the same retention and append-only mechanisms; the default seven years exceeds the five-year floor | mechanism |
| QC 1000 — the firm's system of quality control, and its documentation | organizational: the quality control system is the firm's. The records are evidence it can cite, not the system itself. | organizational |
| Reliance on this tool's records as audit evidence — independent evaluation of its controls | NOT IMPLEMENTED. No penetration test, no third-party review of the cryptography and no independent report on this software's controls exist yet. Anyone relying on these records as evidence must evaluate the tool themselves, and this row says so first. | named gap |
How a status is earned
- Evidenced
- a deterministic check ran against your records and the counts support the row. A store holding no relevant records reads unevidenced — a true statement, not a passing one. Empty never counts as clean.
- Delegated
- the mechanism is enforced by a system you already trust — a store sealed by your own key manager delegates access control to it, and the pack says the enforcing log is your key manager's, not ours. The pack names the endpoint the key manager was reached at. An AWS endpoint other than AWS's own default for the region reads delegated to that endpoint, with a request that you confirm it is your key management service. One backend — AWS KMS — has run against the real AWS KMS service; no other backend has.
- Test seam
- sealed by an in-process test backend — a stub, or a stand-in for the AWS client — and the status names which. No key manager enforces access. The seam is built and tested, and the pack refuses to call that delegation.
- Partially evidenced
- the mechanism is built and some of your runs carry its evidence, but not all — usually because they were sealed before the mechanism existed. The pack says how many runs are in each group, and never counts the missing ones as passing.
- Organizational
- the requirement is a procedure only people can perform. The pack names it as yours instead of dressing a policy up as a mechanism.
- Named gap
- the pack cannot evidence it — either the mechanism is not built, or no software can supply it — and it says which. The gap is printed, because a reviewer should read it here rather than discover it.
No status is typed in by hand: every status is recomputed from the store each time a pack is produced, the requirement and mechanism text is written and reviewed as part of the engine, and the dependency evidence comes from our release scan. A failing mechanism can never be read as evidence that the control works.