Audit checklist: every stage of a financial statement audit

How to use this checklist

Treat each stage as a gate: the engagement moves on only when every required item is done, or a partner waives it with a reason that stays on file. That is the discipline inspectors look for, and it is what turns a checklist from a form into evidence.

Tailor it per client. Remove areas that don't apply (no inventory, no foreign operations) by recording why, rather than deleting them silently.

1. Acceptance and continuance (ISA 210, ISA 220, ISQM 1)

• Independence and ethics confirmed by every team member, including any threats and safeguards.
• Client integrity, management competence and risk assessed; acceptance approved by the engagement partner.
• Predecessor auditor communication done for first-year audits.
• Engagement letter agreed and signed: scope, responsibilities, reporting framework, fees.
• Engagement quality review need assessed (listed entities, high-risk engagements).

2. Planning (ISA 300, ISA 320)

• Overall audit strategy and audit plan documented and approved.
• Materiality, performance materiality and the clearly-trivial threshold set, with the basis recorded.
• Team briefing held; roles, timetable and review responsibilities agreed.
• Client document request (PBC) list sent with due dates.
• Use of experts, component auditors or internal audit planned where relevant.

3. Risk assessment (ISA 315, ISA 240, ISA 550, ISA 570)

• Understanding of the entity, its environment, its IT and its internal control documented.
• Risks of material misstatement identified at financial statement and assertion level; significant risks flagged.
• Fraud risk discussion held with the team; revenue recognition and management override addressed.
• Related parties identified and going concern indicators considered.
• Responses designed: tests of controls where relying on controls, substantive procedures for every material area.

4. Fieldwork by area

5. Completion (ISA 450, ISA 560, ISA 580)

• Summary of uncorrected misstatements evaluated against materiality and discussed with management.
• Subsequent events reviewed up to the date of the report.
• Going concern conclusion documented.
• Written representations obtained from management.
• Financial statements and disclosures checked against the framework (a disclosure checklist).
• Every review note cleared; preparer and reviewer sign-offs on the final version of each working paper.
• Engagement quality review completed before the report is dated, where required.

6. Reporting and file assembly (ISA 700, ISA 230)

• Auditor's report drafted, reviewed and signed by the engagement partner.
• Communication with those charged with governance (ISA 260) and of control deficiencies (ISA 265).
• Audit file assembled and locked within 60 days of the report date; changes after that are additions with reasons.

Running the checklist in Stowbill

In Stowbill each stage above is a partner-approved gate: the engagement can't move on while a required item is open, waivers need a partner and a reason, sign-offs are tied to the exact version reviewed, and the file locks automatically 60 days after the report date. The activity trail is hash-chained, so the record of who did what can't be quietly changed.

Templates for ISA statutory audits and the Pakistan (ICAP) statutory audit are included, and you can version your own with partner approval.

Questions