Audit Software in Kenya: A Buyer's Guide for Audit Firms and Internal Audit (2026)
How to choose audit software in Kenya: ICPAK quality assurance reviews, retention periods, the PFM internal audit cycle, hosting, types of provider, evaluation criteria, cost and red flags.
Short answer: "Audit software" in Kenya covers several different products: working papers, engagement and practice management, document custody, client request lists, time and billing, and internal audit management. Decide which of those jobs you need done, then test each vendor against what ICPAK's quality assurance reviewers, the PFM regulations and your regulator will ask to see, using scripted demos on your own files.
This guide is for managing partners and practice managers at ICPAK-licensed audit, tax and accounting firms, heads of internal audit and chief audit executives in government entities, banks, SACCOs and listed companies, and the IT and procurement teams who support them. It assumes you are replacing shared drives, spreadsheets and email, or an older system that no longer fits.
Creodata sells AuditEDMS, so we say plainly where it fits, and where it does not, near the end. The criteria before that are the ones we would use to choose any vendor. This is a practical guide, not legal or professional advice: confirm requirements with ICPAK, the National Treasury or your regulator.
What audit software does
Buyers often compare products that do different jobs. These are separate categories, and few products do all of them well.
| Category | What it does | Who uses it |
|---|---|---|
| Working papers | Audit methodology, risk assessment, lead schedules, tests and financial statement drafting | The engagement team, during the audit |
| Practice and engagement management | Tracks each engagement through its stages, from acceptance and engagement letter to sign-off and archive | Partners, managers, practice managers |
| Document custody | Holds client and auditee documents with who sent them and when, versions, retention dates and legal hold | Everyone; quality reviewers when they inspect |
| Requests for information (PBC lists) | Sends the client or auditee a list of what is needed, collects uploads and chases what is late | Seniors and managers |
| Time and billing | Timesheets, charge-out rates, fee notes, work in progress | Staff, managers, finance |
| Internal audit management | Audit universe, risk-based plan, engagements, findings and follow-up of management actions | Heads of internal audit, audit committees |
Many firms run two or three of these side by side, which is fine if they share one client and engagement record.
Who needs audit software in Kenya
Audit firms. Only a holder of an ICPAK practising certificate may practise as an accountant, which includes offering to audit books and accounts, and a firm needs an annual licence that runs to 31 December (Accountants Act, Cap. 531, ss.18, 19 and 22). Only practising certificate holders qualify as statutory auditors under the Companies Act, and partners sign assurance reports in their own name with their membership and licence numbers (LN 147 of 2022, reg 8). Every company must be audited unless it is a small company within the Companies Act thresholds; public companies, banks and insurers can never use that exemption.
Internal audit. The mandates come from public finance law and from sector regulators:
| Sector | What requires internal audit |
|---|---|
| National government entities | Internal audit to international best practice and an audit committee (PFM Act s.73); internal auditors follow the IIA's International Professional Practices Framework (PFM (National Government) Regulations 2015, reg 161) |
| County governments | The same duty (PFM Act s.155), with county audit committees of three to five members and an independent chair |
| Government Owned Enterprises | A board audit committee with a majority of independent directors, including the chair, overseeing internal audit (Government Owned Enterprises Act 2025) |
| Banks | A permanent internal audit function and a Board Audit Committee that approves the internal audit plan (CBK/PG/02) |
| Listed and public issuers | An internal audit function reporting directly to the audit committee (CMA Code 2015) |
| Deposit-taking SACCOs | An internal audit function led by a qualified accountant, reporting to the board's audit committee, which reviews findings at least every three months |
The Kenyan requirements that shape the choice
Most demos look alike until you test them against the rules you work under.
- ICPAK quality assurance reviews. The Accountants (Quality Assurance Review) Regulations, 2022 (LN 146 of 2022) put every practising member or firm on a three-year review cycle, and firms that serve Companies Act companies or listed companies, entities with gross revenue over KES 5 million, regulated entities, or work outsourced by the Auditor-General are reviewed annually. Review results inform the issue and renewal of annual licences. Your engagement letters must say your working papers may be reviewed, reviewers get unlimited access to records, and the Committee may ask for them electronically. The self-review tool even asks whether the firm uses audit software, and whether working papers show who did each procedure and when. Software should make those answers quick to produce.
- Standards adopted as issued. ICPAK has adopted the ISAs without modification, including effective dates, and LN 147 of 2022 adopts ISQM 1 and 2 by reference. ISQM 1 expects documented independence confirmations at least annually and an evaluation of the firm's system of quality management at least annually.
- File assembly. ISA 230 expects the final audit file to be assembled ordinarily within 60 days of the auditor's report. After that, nothing may be deleted before the retention period ends, and any change must record why, when and by whom. A system should count down from the report date and record changes after assembly.
- Retention periods that differ by record. Companies keep accounting records for at least seven years (Companies Act s.630) and directors' minutes for seven; tax documents are kept five years from the end of the reporting period, longer while an assessment or proceeding is open (Tax Procedures Act s.23). An accountant doing AML-covered work for a client keeps those records seven years (POCAMLA s.46). No Kenyan rule sets a period for a firm's own engagement working papers, so ISA 230's ordinary minimum of five years from the report applies. One retention period for every document will be wrong for some of them.
- Professional clearance. The IESBA Code (R320.8) requires a proposed auditor to ask the existing or predecessor auditor for any facts it needs before accepting; Kenyan firms call this professional clearance. We found no statutory deadline for the reply, so the wait is your firm's policy. The software should let you set it and should record whether a reply came.
- The public sector internal audit cycle. The national government regulations set an annual plan to the audit committee by 15 February, written confirmation of an oral preliminary report within seven days, the accounting officer's response and action plan within fourteen days, and quarterly reports within 14 days of quarter end (regs 170 to 173); the county regulations follow the same cycle. There is an annual effectiveness review and an external assessment every three to five years (reg 166). The Auditor-General has unhindered access to all internal audit reports (Public Audit Act s.33), and since 25 September 2026 an accounting officer who fails to implement a parliamentary committee's recommendations on the Auditor-General's findings faces a penalty (PFM (Amendment) Act 2026). PSASB publishes the Global Internal Audit Standards and a compliance monitoring tool for the public sector.
- Data protection and hosting. Under the Data Protection Act 2019 personal data is kept only as long as necessary unless law requires longer, and a breach is notified to the Data Commissioner within 72 hours. Transfers out of Kenya need appropriate safeguards (ss.48 and 49). For public-sector buyers, the Data Protection (General) Regulations 2021 (reg 26) require processing in Kenya, or a serving copy kept in Kenya, for listed purposes that include overseeing a system for administering public finances. Azure's only African regions are in South Africa, and a Kenyan region announced in 2024 was not in Microsoft's regions list in September 2026. Get your legal team's view before you choose a hosting model.
The types of audit software provider in Kenya
A search for audit software in Kenya returns thin listicles more than vendors. These are the kinds of supplier you will meet.
| Provider type | Examples seen in Kenyan searches | Typical strengths | Watch for |
|---|---|---|---|
| Working-paper software | CaseWare Africa; ICPAK's myAudit | ISA methodology, lead schedules, financial statements | Client document custody, request lists and billing are usually elsewhere |
| Enterprise internal audit and GRC suites | TeamMate+, Diligent HighBond, Ideagen Pentana, AuditBoard | Full lifecycle: universe, plan, working papers, findings, follow-up | Cost, implementation time, local support through partners |
| Regional GRC vendors | Trigarc (Kenya and East Africa) | Local regulator configuration, Microsoft 365 working papers, findings follow-up | Fit for an external audit firm's billing and client files |
| Global practice management and client portals | Karbon, TaxDome, Xero Practice Manager | Workflow, time, billing, portals | Kenyan fee note and VAT practice, data location |
| Request-list (PBC) tools | Suralink, AuditDashboard | Client document requests and chasers | Standalone: engagement stages and archive live elsewhere |
| Microsoft 365 document management | M-Files, Intapp, HubOne | Documents in the Microsoft stack | Built for general professional services, not audit stages |
| Kenyan enterprise document management vendors | Several own the "EDMS Kenya" search | Local presence, scanning, records management | Generic: no engagement lifecycle, clearance or archive clocks |
| Spreadsheets and shared drives | Most small firms | Low starting cost | No audit trail, key-person risk, slow to answer a reviewer |
Evaluation criteria
Weight the criteria before the first demo, and score every vendor on the same sheet.
| Area | What to test |
|---|---|
| Category fit | Which of the six jobs the product does, and how it works alongside the tools you keep |
| Quality review readiness | A per-engagement record of stages, evidence, dates and who completed each; exportable in electronic form for the Registration Committee |
| File assembly and retention | An archive clock from the report date; retention by document type (7, 5 and 7 years above); legal hold; changes after assembly logged |
| Clearance and acceptance | A clearance wait you set, with the reply recorded before the engagement letter; the signed engagement letter required before work starts |
| Requests for information | Client and auditee uploads without accounts; outstanding items visible; chasers |
| Internal audit cycle | Stages for the 7-day and 14-day steps; request lists to auditees; a findings register with agreed actions followed to implementation; the risk-based plan if you need it in the same tool |
| Time and fees | Timesheets by grade, fee notes with VAT, work in progress; whether it posts to your accounting system or eTIMS |
| Hosting and access | Where data is processed and stored; who at the vendor can reach it and how that is logged; fit with reg 26 if you are public sector |
| Commercials | Three-year cost, currency, implementation plan, references, exit and data export |
How to run the evaluation
- Agree the jobs with partners or the head of internal audit, IT and procurement, and long-list by category.
- Drop suppliers that fail a must-have.
- Run scripted demos on your own data, the same script for every vendor:
- an outgoing auditor who has not replied to your clearance letter by the end of your firm's waiting period;
- a client that uploads a trial balance, bank statements and a tax computation through a link, and the retention date each gets;
- an audit report signed today: show the file-assembly countdown, the reminders, and what the log shows when someone edits a document afterwards;
- an ICPAK reviewer asking for one engagement's history in electronic form;
- for county or national government internal audit, a request list with three late items and a preliminary report that must be confirmed in writing within seven days.
- Call references of your size, and ask what went wrong.
- Score independently, then calibrate as a panel, and keep the sheet with the decision.
What audit software costs in Kenya
Ask every shortlisted vendor to itemise the same lines over three years:
- Licence or subscription: per user, per engagement, per module, or flat.
- Implementation: configuration of your stages and templates, importing clients, migrating existing files, training.
- Hosting: the vendor's cloud, your own cloud subscription, or your own servers.
- Prerequisite licences: Microsoft 365 or other platforms the product depends on.
- Support and updates, including changes when standards or regulations move.
- Currency: US dollars or Kenya shillings, and who carries the exchange-rate risk.
- Internal effort: your staff's time during set-up and migration.
- Exit: the cost and format of getting your records out.
For AuditEDMS: the pilot is free for 90 days, by invitation, and pricing is on request. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.
Red flags
- A working-paper tool sold as a complete practice system, or the reverse, without saying which jobs stay in spreadsheets.
- Clearance is a tick-box with no date, no waiting period and no record of the reply.
- One retention period for every document, or retention that deletes files without a hold.
- Documents can be replaced after sign-off with no record of who, when or why.
- The vendor cannot produce one engagement's full history for a reviewer in minutes.
- A public-sector demo shows a generic workflow and cannot hold the regulations' seven-day and fourteen-day steps.
- Vague or changing answers on where data is processed, or on who at the vendor can access it.
- Must-haves answered with roadmap dates.
Where Creodata fits
Creodata is a Nairobi software company, and AuditEDMS covers the middle of the table above (engagement management, document custody, requests for information, and time and billing) and the engagement and follow-up part of internal audit management.
It keeps every client or auditee document in your own SharePoint, filed by client, engagement and document type with who sent it, when and how, versioned and checksummed, with retention dates by document type and legal hold. The statutory audit template runs 13 stages from tender to archive, with evidence gates that stop a stage completing until its document is filed, a clearance timer that waits the period you set and closes early only when the outgoing auditor's reply is recorded, and an archive clock from sign-off to your file-assembly deadline. Professional clearance comes before the engagement letter, so acceptance follows the request to the predecessor. An internal audit template, from notification to final report and archiving, is ready to use. Findings, including management letter points, are recorded with severity, recommendation, management's response and an agreed action with owner and due date; each action is followed to implementation and confirmed by someone other than the person who recorded it implemented, and a follow-up register shows what is open and overdue. A printable compliance view shows every stage, its evidence, dates and who completed it. Clients and auditees upload through expiring links with a one-time code and no account, against request lists with chasers. Timesheets, rates by grade, milestone fee notes with VAT, part payments and work in progress are included. Templates are configuration, set up with you during implementation.
AuditEDMS runs in your own Azure subscription, in the region you choose, with documents in your SharePoint; no client data sits in Creodata's cloud. Creodata operates it and holds standing management access to the deployment's managed resource group, and every action it takes is recorded in your Azure activity log.
What it does not do: it holds no working papers or audit methodology, so keep CaseWare, myAudit or whatever you use. It has no audit universe or risk-based annual plan, does not email action owners about their actions, and has no connection to an accounting system or eTIMS. If your internal audit function needs the plan and working papers in one system now, a full internal audit suite fits better today. See AuditEDMS in Kenya for how each Kenyan duty maps to a capability.
Frequently asked questions
Does ICPAK require audit firms to use audit software?
We found no such requirement. The self-review tool in the quality assurance regulations asks whether the firm uses audit software, and reviewers look for evidence of who did what and when, which is far easier to produce from a system than from shared drives.
Can a public-sector internal audit unit host audit data outside Kenya?
It depends on the data and its purpose. Regulation 26 of the Data Protection (General) Regulations 2021 requires processing in Kenya, or a serving copy in Kenya, for purposes that include overseeing public finance systems. Ask each vendor where data is processed and get legal advice before choosing.
See how AuditEDMS in Kenya meets these criteria, and request a pilot with your own engagements.