Document ID: chunk:federal_register_of_legislation:F2020C00630:reg:25:p26
Version: federal_register_of_legislation:F2020C00630
Segment Type: reg
Provision Reference: reg 25 (pt 26/31)
Character Range: 83301–86478

limits are prescribed in law or regulation, paragraph 45 requires the firm to establish time limits that reflect the need to complete the assembly of final engagement files on a timely basis.  In the case of an audit, for example, such a time limit would ordinarily not be more than 60 days after the date of the auditor's report.

A55.         Where two or more different reports are issued in respect of the same subject matter information of an entity, the firm's policies and procedures relating to time limits for the assembly of final engagement files address each report as if it were for a separate engagement.  This may, for example, be the case when the firm issues an auditor's report on a component's financial information for group consolidation purposes and, at a subsequent date, an auditor's report on the same financial information for statutory purposes.

Confidentiality, Safe Custody, Integrity, Accessibility and Retrievability of Engagement Documentation (Ref: Para. 46)

A56.         Relevant ethical requirements establish an obligation for the firm's personnel to observe at all times the confidentiality of information contained in engagement documentation, unless specific client authority has been given to disclose information, or there are responsibilities under law, regulation or relevant ethical requirements to do so.[5]  Specific laws or regulations may impose additional obligations on the firm's personnel to maintain client confidentiality, particularly where data of a personal nature are concerned.

A57.         Whether engagement documentation is in paper, electronic or other media, the integrity, accessibility or retrievability of the underlying data may be compromised if the documentation could be altered, added to or deleted without the firm's knowledge, or if it could be permanently lost or damaged.  Accordingly, controls that the firm designs and implements to avoid unauthorised alteration or loss of engagement documentation may include those that:

           * Enable the determination of when and by whom engagement documentation was created, changed or reviewed;

           * Protect the integrity of the information at all stages of the engagement, especially when the information is shared within the engagement team or transmitted to other parties via the Internet;

           * Prevent unauthorised changes to the engagement documentation; and

           * Allow access to the engagement documentation by the engagement team and other authorised parties as necessary to properly discharge their responsibilities.

A58.         Controls that the firm designs and implements to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation may include the following:

           * The use of a password among engagement team members to restrict access to electronic engagement documentation to authorised users.

           * Appropriate back‑up routines for electronic engagement documentation at appropriate stages during the engagement.

           * Procedures for properly distributing engagement documentation to the engagement team members at the start