—IIA 2024 · Domain V
Working papers an assessor could re-perform.
Standard 14.6 sets a clear test for engagement documentation: an informed, competent person should be able to re-perform the work and reach the same results. Add supervision that's evidenced on the file and records that are protected and retained, and you have the core of a defensible working paper.
—What the Standards Require
The requirements, in plain terms.
Standard 14.6
Engagement Documentation
Documentation sufficient for an informed, competent person to re-perform the work and reach the same results; reviewed by the supervisor, approved by the CAE, retained per law and policy.
Standard 12.3
Oversee and Improve Engagement Performance
Engagements are supervised, workpapers are checked to support the conclusions, and evidence of that supervision is kept on file.
Standard 5.2
Protection of Information
Protect the confidentiality, privacy and ownership of information, including the custody, retention and disposal of engagement records.
—In Practice
What it looks like when it's done well.
The re-performance test
A working paper passes when someone outside the team can follow it: what was tested, against which criteria, using which evidence, reaching which conclusion. Evidence stored in personal folders or inboxes fails that test even when the work was sound.
Supervision on the page
Standard 12.3 asks for evidence of supervision, not just supervision. Review notes, their resolution and sign-off belong on the working paper, with a date and a name.
Records you can protect
Engagement records are sensitive. Knowing where they're held, who can see them and when they're disposed of is part of the Standards (5.2), not just IT policy.
—Evidence of Conformance
What an assessor will ask to see.
Working papers linking criteria, evidence, testing and conclusion (14.6)
Supervisor review notes and their resolution on file (12.3)
CAE approval of engagement documentation (14.6)
A defined retention and access policy for engagement records (5.2, 14.6)
How ControlVista Supports It
VistaField — Fieldwork & Evidence
VistaField keeps walkthroughs, testing, evidence and working papers in one workspace, with interim review notes and three-stage preparer → reviewer → approver sign-off — on infrastructure you control.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
How much documentation is enough under the IIA 2024 Standards?
Enough for an informed, competent person to re-perform the work and reach the same results — that is the test in Standard 14.6.
Does supervision need to be documented?
Yes. Standard 12.3 expects evidence of supervision to be retained, and Standard 14.6 expects documentation to be reviewed by the supervisor and approved by the CAE.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.