I have been looking for a requirement for how long work papers need to be retained for Internal Audit. Practice Advisory 2330.A2-1: Retention of Records just states the CAE should develop a written procedure, but does not state the actual time. I know for external auditors the PCAOB requires they be kept for seven years, but I cannot find anything pertaining to Internal Audit specifically.
Does anyone know where I can find documentation on this?
Records retention policy for internal audit should follow your company’s policy. It’s a legal matter, not one for the IIA (which is why the PA doesn’t state a specific period). If you are a public company, you may have to distinguish between work done as part of your SOX testing (since it supports SEC filings) and other internal audit reports. You very well may have different retention timelines for each.