Working Papers, Practice Management or Document Custody: Which Audit Software Does What
What software auditors use, explained by category: working papers, practice management, document custody and internal audit management, what each holds, and how a firm combines them.
Short answer: Auditors usually run three kinds of software side by side. Working-paper software holds the audit itself: procedures, evidence of testing, review and the financial statements. Practice management software runs the firm: clients, jobs, time, work in progress and billing. Document custody keeps what clients send, with who sent it, when, and how long it must be kept. Internal audit teams add a fourth: audit management or GRC software.
This guide is for partners, practice managers and IT leads in audit, tax and accounting firms, especially firms of roughly 10 to 75 staff, and for heads of internal audit who are sorting out what their current tools do and where the gaps are. If you searched for "what software do auditors use" or "CaseWare alternative", this explains how the categories fit together before you compare products.
Creodata sells audit management software, AuditEDMS, so we say plainly which category it belongs to near the end, and which it does not. Vendors named below are examples of each category as they appear in searches and as they describe themselves on their own sites; we make no claims about their features. This is practical guidance, not professional advice.
Why the question is confusing
Vendors use the same words for different things. "Engagement management" can mean the audit file with its procedures and sign-offs, or the job in a practice-management system with its budget and invoices. "Audit software" can mean a working-paper package, a data-analytics tool, or an internal audit platform. And many products stretch across two categories.
The simplest way through is to ask what each tool is the system of record for. A firm needs one clear home for each kind of record, and to know which tool owns it.
The four categories
| Category | System of record for | Main users | Question it answers | Examples seen in searches |
|---|---|---|---|---|
| Working papers (audit file) | The audit: planning, risk assessment, procedures, evidence of testing, review notes, conclusions, often the financial statements | Engagement teams, managers, partners | "Did we do enough work, and is it reviewed?" | Caseware Working Papers, Draftworx |
| Practice management | The firm: clients, jobs, deadlines, time, work in progress, invoices, often client relationship records | Partners, practice managers, finance | "What is the firm working on, and is it paid for?" | Karbon, SmartPractice |
| Document custody and client requests | What the client or auditee sends: each document, its source, date, version and retention | Everyone who receives client documents | "What did we receive, from whom, when, and can we still prove it?" | M-Files and SharePoint for document management; AuditDashboard, Content Snare and ShareFile for client requests and file exchange |
| Internal audit management and GRC | The internal audit function: plans, engagements, findings, follow-up, risk and compliance registers | Heads of internal audit, risk and compliance teams | "What did we find, and was it fixed?" | Wolters Kluwer TeamMate+, Diligent, Optro (formerly AuditBoard), Ideagen Internal Audit (formerly Pentana Audit), BarnOwl |
Some products span categories. Caseware describes Caseware Working Papers as an engagement management solution for audits, reviews and financial reporting; Suralink describes itself as unifying client requests and automating workpaper preparation and review. Check each shortlisted product against the table, row by row, rather than by its label.
Working papers: the audit itself
Working-paper software is where the auditor documents the work. ISA 230 sets what the audit documentation must show, and a firm's methodology decides how. The software typically carries the methodology's programmes, lead schedules and trial balance, links evidence to procedures, records preparer and reviewer sign-offs, and often drafts the financial statements.
What it usually does not try to be is the firm's filing system for everything clients send, or its billing system. Documents are imported into the file as evidence when they are needed for a procedure, which is not the same as keeping a controlled record of everything that arrived.
Practice management: the firm
Practice management software runs the business side: the client list, the jobs for each client, deadlines, staff allocation, timesheets, work in progress, invoices and debtors. Many also add client relationship features, email templates and client portals.
For an audit firm, the gap is usually the audit-specific parts: evidence gates that stop an engagement moving on until, say, the signed engagement letter is on file; the predecessor-auditor clearance step; and the archive deadline after the auditor's report.
Document custody: what clients send, and how long it is kept
Document custody is the category firms most often do without, because a shared drive and email appear to cover it. The standards say otherwise:
- ISA 230 expects the final audit file to be assembled on a timely basis after the auditor's report, and the application material puts the limit at "ordinarily not more than 60 days".
- After assembly, documentation must not be deleted or discarded before the end of its retention period, which for audits is ordinarily no shorter than five years from the report date; any later change must record why, when and by whom.
- ISQM 1 lists safe custody, integrity, accessibility and retrievability of engagement documentation among what maintaining it may involve, and treats unauthorised alteration, deletion or permanent loss as compromising its integrity.
A custody system files every document against the client, engagement and document type, records who sent it and how it arrived, keeps versions rather than overwriting them, and sets a retention date. Client request tools cover the arrival side: a list of what was asked for, and a way for the client to upload against it.
For national retention periods, check your own law and your professional body's rules; they often run longer than five years.
Internal audit management and GRC
Internal audit departments work to the IIA's Global Internal Audit Standards, which took effect on 9 January 2025, and their tools reflect that: an audit universe and risk-based plan, engagements with work programmes, findings with criteria, cause and effect, and follow-up of management action plans. GRC suites add risk registers, compliance obligations and board reporting. For a standard-by-standard view, see what software can evidence under the Global Internal Audit Standards.
How a firm combines them
Most firms do not need one product that does everything. They need clear boundaries and clean handoffs.
| Organisation | A common combination | The handoffs to settle |
|---|---|---|
| Small practice, a few staff | Working-paper software, an accounting-practice tool or spreadsheet for time and billing, a shared drive | Where client documents are kept, and who checks the archive deadline |
| Audit, tax and accounting firm, 10 to 75 staff | Working-paper software; practice management or an engagement-lifecycle tool with time and fees; document custody with client uploads | Client documents filed once and referenced from the working papers; one client record across audit, tax and bookkeeping |
| Internal audit department | Internal audit management or GRC, or working papers plus an engagement and evidence tool; the organisation's document management | Where auditee evidence lands, and where findings and follow-up live |
Three handoffs matter most:
- From arrival to evidence. A document arrives, is filed with its source and date, and the working papers reference it rather than hold the only copy.
- From engagement to invoice. Time recorded against the engagement feeds work in progress and billing without re-keying.
- From sign-off to archive. The auditor's report date starts the file-assembly clock, and the file is then kept unchanged for its retention period.
What a "CaseWare alternative" search usually means
People search for a CaseWare alternative for different reasons, and the answer depends on which.
- If you want to replace your working-paper software, you need another working-paper package with a methodology you trust. Compare those on methodology, review workflow, financial statement output, cost and local support.
- If the pain is documents, chasing clients, deadlines or billing, changing working-paper software will not fix it. That is a practice management or document custody gap, and a tool in that category can run alongside the working papers you already have.
Many firms that search the phrase are in the second group.
Questions to ask before you buy
| Question | Why it matters |
|---|---|
| Which records will this tool be the system of record for? | Avoids two tools each holding half of the client file |
| Where are client documents stored, and who controls that storage? | Custody, retention and data protection all depend on it |
| Can the file be proved unchanged after assembly? | ISA 230 and inspection findings turn on this |
| Does it integrate with our working papers or accounting system, or sit beside them? | Sets expectations for re-keying and handoffs |
| How is time recorded, approved and billed? | Work in progress and yield depend on it |
| What happens to our data if we stop? | Exit terms matter as much as features |
Where Creodata fits
AuditEDMS belongs in the document custody category and adds the engagement lifecycle, requests for information, findings follow-up, and time and fees. It is not working-paper software and does not replace it.
-
Document custody. Every document is filed to your SharePoint by client, engagement and document type, recording who sent it, when and how it arrived; versioned and checksummed, never silently overwritten; retention dates by document type and legal hold.
-
Engagement lifecycle. Engagement templates with stages, gates and timers, with statutory audit, tax compliance and internal audit templates ready to use. A stage cannot be completed until the document it depends on is filed, a professional clearance timer before the engagement letter waits the configured period, and an archive clock counts down from sign-off to your file-assembly deadline.
-
Requests and uploads. Request lists per engagement, with chasers. Clients receive an expiring upload link, confirm their email with a one-time code and upload against your list, with no client account.
-
Time and fees. Weekly timesheets with approval and rates by grade; milestone billing with VAT, fee notes, part payments, and work in progress with yield.
-
Findings and follow-up. Findings, including management letter points, with severity, recommendation, management's response and an agreed action with owner and due date; each action followed to implementation and confirmed by someone other than the person who recorded it implemented; a follow-up register of open and overdue actions across engagements.
Internal audit teams use the same engine with the internal audit template, adjusted to their methodology at implementation, and the findings register; it does not have an audit universe or risk-based annual plan. AuditEDMS does not connect to CaseWare or to an accounting system today. It runs in your own Azure subscription with documents in your own SharePoint, and Creodata operates it through standing management access recorded in your Azure activity log. On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; pilots are by invitation.
Frequently asked questions
What software do auditors use?
Usually working-paper software for the audit file, plus something to run the firm (practice management) and somewhere to keep client documents (document management or custody). Internal auditors often use an internal audit management or GRC platform instead of, or as well as, working papers.
What is the best audit software for a small firm?
The one that covers your biggest gap. A small firm with a sound working-paper package but documents spread across inboxes needs custody and client requests more than a new audit file. Start from the records you cannot find quickly today.
Does practice management software hold audit working papers?
Usually not. Practice management tools hold jobs, time and invoices, and often client documents, but the audit procedures and review sit in working-paper software.
Is AuditEDMS a CaseWare alternative?
No. It works alongside working-paper software such as Caseware, keeping the client documents, engagement stages, requests, time and fees around the audit file.
See how AuditEDMS keeps client documents, the engagement lifecycle, requests and fees in one record beside your working papers: request a pilot.