TPX & Co., Chartered Accountants is a large audit firm. It maintains audit documentation both electronically and in physical form (hard files).…

(a) In accordance with SQC 1,” Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information and Other Assurance and Related Services Engagements” the firm should establish policies and procedures designed to maintain confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation. In the given situation, the physical files are neither scanned and incorporated in the electronic files nor cross-referenced to the electronic files. Inability to do so shows that firm has not established policies and procedures to maintain integrity of engagement documentation. Lack of ensuring the same makes it difficult to demonstrate completeness of audit files and whether these were assembled within 60 days timeframe stipulated in SQC 1. Where engagement documentation is in paper, electronic, or other media, the integrity, accessibility or retrievability of the underlying data may be compromised if the documentation could be altered, added to or deleted without the firm's knowledge, or if it could be permanently lost or damaged. One of the reasons for designing and implementing appropriate controls for engagement documentation in this regard is the protection of the integrity of information at all stages of engagement. For the practical reasons, original paper documentation may be electronically scanned for inclusion in engagement files. In that case, the firm implements appropriate procedures requiring engagement teams to: (a) Generate scanned copies that reflect the entire content of the original paper documentation, including manual signatures, cross-references and annotations; (b) Integrate the scanned copies into the engagement files, including indexing and signing off on the scanned copies as necessary; and (c) Enable the scanned copies to be retrieved and printed as necessary. It has also been stated that there are many instances where audit working papers do not contain details as to whether information was obtained from the client or prepared by the engagement team. It is important to identify the source of the document and the information used as audit evidence to ensure its reliability. It could have potential risks of non-compliance with standards on auditing.