Audit reports should include the workpapers as a reference for the audit conclusions.

The internal auditor's workpapers are the primary reference for reported control deficiencies.

Ad-hoc communications with management of the area under review should be excluded from the workpapers.

Both draft and final versions of workpapers should be saved at the end of the engagement.