When the Regulator Reads the File: What CPAB's 2025 Inspection Results Mean for Audit Firms

The opinion a public-accounting firm signs carries a simple guarantee: that the reasoning behind every conclusion is on file, in the right order, and readable by someone who was not in the room. When a regulator arrives, that guarantee is tested not by asking questions but by reading the document. The working-paper file is not the record of the audit. It is the audit.

This distinction — between a result that is right and a result that is demonstrably right — sits at the centre of every professional-standards inspection. And according to the Canadian Public Accountability Board's 2025 Annual Report, released in April 2026, it remains the fault line where firms are most exposed.

What the CPAB Data Actually Shows

CPAB inspected 120 audit files in 2025 and identified significant findings in 23% of them — down from 24% in 2024 and 34% in 2023. The direction is encouraging. The number is not, because a significant finding on a single engagement is a partner-level and firm-level exposure regardless of what the sector average says. In the same report, CPAB published individual firm inspection results for the first time, a transparency step that changes the reputational stakes for every public-accounting firm in the country.

The recurring themes — revenue recognition, accounting estimates, and group-audit supervision — are not new. What they share is that each turns on whether the reasoning was captured in the file at the time the work was done. A revenue judgment challenged by an inspector is not won by explaining what you knew; it is won by producing the contemporaneous documentation that proves what you knew and when.

Documentation Is the Deliverable, Not the Tidy-Up

Professional audit standards are unambiguous: if it is not in the file, it was not done. That position is not a bureaucratic posture — it is the operating assumption behind every inspection, every peer review, and every professional-liability claim. An estimate challenged three years after the opinion is signed, a revenue cut-off questioned by an inspector, a fraud-risk judgment scrutinized by a plaintiff's expert — each is argued on the record that existed at archive, not on anyone's recollection of what seemed obvious at the time.

The instinct in most practices is to treat working papers as clean-up work: something to square away once the real judgment calls are made. The inspection data suggests that instinct is still widespread enough to produce findings in nearly one in four files. Archive deadlines are strict. Staff turnover is high. A file assembled under pressure after a demand letter is the weakest position a firm can occupy.

The Scope of What a File Has to Survive

A single engagement file may need to serve a CPAB practice inspector, a provincial regulator, a peer reviewer, a litigant, and a successor auditor — sometimes years apart, sometimes simultaneously. Each arrives at the file with a different question, but the same underlying test: is this record complete, internally consistent, and clearly attributable to the people who did the work, at the time they did it?

Planning memos, materiality calculations, risk assessments, audit evidence, confirmations, estimate workpapers, consultation notes, quality-reviewer sign-offs — all of it needs to survive not just until the archive is locked but for the full statutory limitation period. When those pieces are distributed across local drives, email threads, and a document management system that nobody fully trusts, the firm's exposure is not hypothetical. It is the gap between what was done and what can be proven.

The Sign-Off Trail Is the Audit

One detail that surfaces repeatedly in inspection findings is the distinction between a conclusion and the trail that supports it. An opinion can be correct and still fail inspection if the engagement-quality reviewer's sign-off is not dated and tied to the specific issues it resolved, or if the partner's final sign-off cannot be read against the evidence it relied on. Who reviewed what, and when, is exactly the question inspectors ask — and that history has to survive staff turnover, system migrations, and the archive lock intact.

CPAB's first publication of individual firm results adds a dimension that did not previously exist at the public level: the reputation attached to an inspection finding is now searchable, and it attaches to the firm name, not only to an internal file reference. The firms that consistently pass cleanly treat inspection-readiness as a standing state of each active file, not an event that begins when a call arrives.

Practical Implications for Practice Leaders

• Record reasoning when the work is done, not after the archive deadline. A judgment documented contemporaneously is evidence; the same judgment reconstructed on demand is explanation.

• Maintain visibility into file completeness across the portfolio — not per-engagement heroics, but a systematic view of which files are on track and which are past archive without required sign-offs.

• Treat individual firm CPAB results as a competitive factor. Publication makes inspection outcomes visible to audit committees, institutional clients, and prospective hires — the reputational arithmetic changed in 2026.

• Plan for the file to be read by a stranger, years from now. Limitation periods are long; the file that exists at archive is the only defence available when a claim or second inspection arrives.

The falling CPAB finding rate is a real signal that the profession is improving. It is not a signal that any individual file is fine. The inspection data — 23 significant findings in 100 files — means the probability of a finding on any given engagement drawn at random is not negligible. The firms that protect their standing over time are the ones for whom that probability is effectively zero, because the record was always ready.

Source: XNM Technologies — "The File Is the Audit: Why an Accounting Firm's Engagement Record Is Its Licence" — xnm.ca

This content was generated by AI.