Audit File Assembly and Retention: the 60-Day Rule and Each Country's Retention Periods

Short answer: ISA 230 expects the final audit file to be assembled ordinarily within 60 days of the auditor's report. Nothing may then be deleted before the retention period ends: ordinarily at least five years from the report. National rules can be stricter: six years in Nigeria, ten in the UAE, and a 60-day rule in South Africa. Where several periods apply, keep the document for the longest.

This guide is for partners, quality managers and practice administrators who set their firm's archiving policy. It covers the international standards, the national rules we found in nine markets, and how to turn them into a retention schedule.

Creodata sells practice software for audit firms, so we say plainly where we fit near the end. The periods below come from the laws and rules we read in September 2026; where we found no rule, we say so. This is a summary for planning, not professional or legal advice: confirm the position with your institute or regulator.

What the standards require

Two IAASB standards set the baseline: ISA 230 for the engagement file, and ISQM 1 for the firm's system around it.

ISA 230, Audit Documentation

• Assembly on a timely basis (para 14). The auditor assembles the audit documentation in an audit file and completes the administrative process of assembling the final file on a timely basis after the date of the auditor's report.
• The 60-day benchmark (para A21). An appropriate time limit is "ordinarily not more than 60 days after the date of the auditor's report".
• Assembly is administrative (para A22). No new procedures or new conclusions.
• No deletion before the period ends (para 15). Once the file is assembled, the auditor must not delete or discard documentation of any nature before its retention period ends.
• Five years as the ordinary minimum (para A23). For audits, the retention period ordinarily is no shorter than five years from the date of the auditor's report, or of the group auditor's report if that is later.
• Changes after assembly are recorded (para 16 and A24). The auditor records the specific reasons, and when and by whom the change was made and reviewed. Inspection comments are the usual trigger.

ISQM 1, Quality Management for Firms

• A quality objective for documentation (para 31(f)). Engagement documentation is assembled on a timely basis after the report date, and is appropriately maintained and retained to meet the firm's needs and to comply with law, regulation, ethics and professional standards.
• What "maintained" means (paras A83 and A84). Safe custody, integrity, accessibility and retrievability, possibly through IT applications. Integrity is compromised if documentation is altered, supplemented or deleted without authorisation, or permanently lost.
• No period of its own (para A85). ISQM 1 does not set a period. Law, regulation or professional standards may; otherwise the firm sets one, and for audits it is ordinarily at least five years from the report.
• The date. Firms had to design and implement their ISQM 1 systems by 15 December 2022. ISQM 1 replaced ISQC 1.

The international position: close the file within 60 days, keep it at least five years, and make any later change visible.

Retention periods by country

The table gives the rule for the auditor's working papers, and alongside it the periods for company accounting records and tax records, because a firm handling client documents meets all three. "None found in our review" means we did not find a national rule in the texts we read, not that none exists.

• Nigeria requires an audit file for each statutory audit, closed "not later than 60 days after the date of signing of the Audit report"; its six years cover memoranda, correspondence and electronic records.
• South Africa's Rule 4 also keeps documentation of the firm's system of quality management for at least five years.
• The UAE period survives the firm: partners stay responsible for the papers even if the firm's licence is cancelled.
• Tanzania counts from a different date. By-law 21 runs from the end of the accounting period, not the report date, so for most audits it ends sooner than ISA 230's five years from the report. Keep the later of the two.
• Kenya gives reviewers wide access. Firms must tell clients in engagement letters that working papers may be reviewed, give reviewers unlimited access to records, and may be asked for them electronically.

The longest applicable period wins

Several rules often apply to the same document. A Rwandan bank audit by a BNR-accredited firm meets ISA 230's five years and BNR's ten. A Tanzanian audit meets five years from the end of the accounting period and five years from the report.

Keeping a document for the shorter period breaks the longer rule; keeping it for the longer breaks neither. So take, for each type of document, the longest period that applies, counted from the latest start date. Where a period is extended by pending proceedings, as in Kenya, Uganda, Tanzania, South Africa and the UAE, the clock does not start to run out until the matter ends.

Client records are not the auditor's file

The company and tax periods in the table bind the client, not the audit firm. A Zambian company keeps its own records for ten years; that does not make its auditor's working papers a ten-year file. Equally, ISA 230's five years does not tell a client how long to keep its ledgers.

They meet because firms hold copies of client documents that arrive against a request list. Decide which form part of the audit file, and so take its retention period, and which you hold as a service to the client, with a period your engagement terms set. Tax and bookkeeping work may bring records with their own statutory periods; give them their own line in the schedule.

Setting retention in practice

1. Retain by document type, not by folder. One period for everything will be wrong for something. Give each type its own line: the signed report and financial statements; the audit file; engagement letters and acceptance records; clearance correspondence; client documents on the file; tax work for clients; and the firm's quality management documentation. Record the period, the start event and the rule behind it.

2. Start the assembly clock at the report date. Count down from the date the report is signed, not from when someone remembers. Set the firm's deadline inside the ceiling: if your policy is 45 days, the 60-day limit in ISA 230, IRBA Rule 4 and the FRC regulations is a backstop rather than a target.

3. Lock the file after assembly. Once the file is assembled, restrict editing to a named few and make every change visible. Integrity, in ISQM 1's terms, means nothing is altered, added or deleted without authorisation.

4. Record every change after assembly. ISA 230 asks for the specific reason, who made the change, when, and who reviewed it. An inspection comment that leads to an added memo is the common case. A version history that keeps the earlier version and names the person is the simplest evidence.

5. Use legal hold. A claim, investigation, tax objection or regulator's enquiry suspends disposal for the documents it touches, whatever the schedule says. The UAE rule makes this explicit by running the period from the final judgment. A hold should be set by a named person, record why, and be released only by a named person.

6. Decide disposal, do not let it happen. When a period ends, someone confirms there is no hold, open matter or longer rule, and records the decision. Data protection laws, such as Kenya's, also expect personal data not to be kept longer than necessary unless the law requires it.

Where Creodata fits

Creodata is a Nairobi software company. AuditEDMS, our practice software for audit firms, keeps each engagement's record from tender to archive and the client documents around it. It does not replace your working-paper software: the audit file itself stays in the tool your team uses for working papers, and its retention follows that tool's settings. AuditEDMS holds what surrounds it.

• An archive clock. Signing the accounts starts a countdown to your file-assembly deadline: 45 days by default, with a ceiling of 60 to match ISA 230's ordinary maximum, reminders to the manager and escalation to the partner. The date the archive stage completed is recorded.
• Retention dates by document type. Every client document is filed to your own SharePoint by client, engagement and document type, recording who sent it, when and how, and gets a retention date by type. Retention periods are settings your administrator changes, not code. For each of the nine countries in this guide, the defaults are set for the country at implementation: five years for engagement documentation and seven for company records in South Africa, six and six in Nigeria, and ten years for working papers and seven for corporate tax records in the UAE; in Zambia, ten years for company accounting records, and in Ghana six for client accounting records. In Uganda, Tanzania and Rwanda the packs set five years for working papers, with accounting records at seven, six and ten years respectively.
• Legal hold. A document can be placed on legal hold, and the hold is recorded against it alongside its retention date.
• An audit trail. Documents are versioned and checksummed, never silently overwritten, and every action is written to an audit trail. A printable compliance view shows each stage, its evidence, dates and who completed it.

AuditEDMS sets retention dates and holds; it does not delete documents when a period ends. Disposal remains a decision your firm takes and records. See AuditEDMS for audit firms.

Frequently asked questions

What is the audit file assembly period?

Under ISA 230 para A21, ordinarily not more than 60 days after the date of the auditor's report. South Africa's IRBA Rule 4 and Nigeria's FRC Audit Regulations 2020 set 60 days as a rule, and a firm may set a shorter deadline in its own policy.

How long must audit working papers be kept?

Ordinarily at least five years from the auditor's report under ISA 230 and ISQM 1, unless national law sets longer: six years in Nigeria and ten in the UAE, for example. See the table above.

Can we change the audit file after the 60 days?

Yes, but only with a record of the specific reasons, when and by whom the change was made and reviewed (ISA 230 para 16). Nothing may be deleted before the retention period ends.

---

See how AuditEDMS for audit firms runs the archive clock, retention dates by document type and legal hold: request a pilot.