Bus. & Prof. Code, § 5097

(a) Audit documentation shall be a licensee’s records of the procedures applied, the tests performed, the information obtained, and the pertinent conclusions reached in an audit engagement. Audit documentation shall include, but is not limited to, programs, analyses, memoranda, letters of confirmation and representation, copies or abstracts of company documents, and schedules or commentaries prepared or obtained by the licensee.

(b) Audit documentation shall contain sufficient documentation to enable a reviewer with relevant knowledge and experience, having no previous connection with the audit engagement, to understand the nature, timing, extent, and results of the auditing or other procedures performed, evidence obtained, and conclusions reached, and to determine the identity of the persons who performed and reviewed the work.

(c) Failure of the audit documentation to document the procedures applied, tests performed, evidence obtained, and relevant conclusions reached in an engagement shall raise a presumption that the procedures were not applied, tests were not performed, information was not obtained, and relevant conclusions were not reached. This presumption shall be a rebuttable presumption affecting the burden of proof relative to those portions of the audit that are not documented as required in subdivision (b). The burden may be met by a preponderance of the evidence.

(d) Audit documentation shall be maintained by a licensee for the longer of the following:

(1) The minimum period of retention provided in subdivision (e).

(2) A period sufficient to satisfy professional standards and to comply with applicable laws and regulations.

(e) Audit documentation shall be maintained for a minimum of seven years which shall be extended during the pendency of any board investigation, disciplinary action, or legal action involving the licensee or the licensee’s firm. The board may adopt regulations to establish a different retention period for specific categories of audit documentation where the board finds that the nature of the documentation warrants it.

(f) Licensees shall maintain a written documentation retention and destruction policy that shall set forth the licensee’s practices and procedures complying with this article.