Audit Software in Tanzania: A Buyer's Guide for Audit Firms and Internal Audit (2026)
How to choose audit software in Tanzania: NBAA's practising by-laws and quality visits, working-paper retention, the 14-day clearance rule, public sector internal audit, data protection, cost and red flags.
Short answer: In mainland Tanzania, NBAA's practising by-laws set unusually specific rules for audit files: working papers kept at least five years from the end of the accounting period, a fourteen-day window for the outgoing auditor to respond, and quality visits scored out of 100. Choose audit software that can prove each of those on your own files, and know which kind of audit software you are buying.
This guide is for managing partners and practice managers at NBAA-registered audit firms, heads of internal audit and chief internal auditors in ministries, regions, local government authorities, agencies and banks, and the IT and procurement teams who support them. It covers mainland Tanzania; Zanzibar has its own laws, which we have not reviewed here.
Creodata sells AuditEDMS, so we say plainly where it fits, and where it does not, near the end. The criteria before that are the ones we would use to choose any vendor. This is a practical guide, not legal or professional advice: confirm requirements with NBAA, the Internal Auditor General or your regulator.
What audit software does
Several different categories of product are sold as audit software. Knowing which one a vendor sells tells you what to test.
| Category | What it does | Who uses it |
|---|---|---|
| Working papers | Audit methodology, risk assessment, testing, lead schedules, financial statements | The engagement team |
| Practice and engagement management | Tracks each engagement through its stages, from acceptance to sign-off and archive | Partners and managers |
| Document custody | Holds client and auditee documents with who sent them and when, versions, retention dates and legal hold | Everyone; NBAA reviewers when they visit |
| Requests for information (PBC lists) | Sends a list of what is needed, collects uploads, chases what is late | Seniors, managers, internal auditors |
| Time and billing | Timesheets, rates, invoices, work in progress | Staff, managers, finance |
| Internal audit management | Audit universe, risk-based plan, engagements, findings and follow-up | Chief internal auditors, Audit Committees |
A single product rarely does all six well. Most firms combine a working-paper tool with something that runs the engagement, the client's documents and the fees.
Who needs audit software in Tanzania
Audit firms. NBAA is established under the Accountants and Auditors (Registration) Act, Cap. 286 R.E. 2023, and financial statements must be audited by a certified public accountant in public practice (s.33(1)). Under the Companies Act, Cap. 212 R.E. 2023, every company appoints an auditor, and the auditor and every partner of an audit firm must be certified public accountants; small private companies may be exempt on conditions set by regulation. Under the Accountants and Auditors (Practising) By-Laws, 2023 (GN 487), audit opinions are signed in the name of an NBAA-registered firm, showing each audit partner's name, registration number and signature, and no partner may sign without a valid certificate of practice, which lasts three years.
Internal audit.
| Sector | What requires internal audit |
|---|---|
| Ministries, regions, local government authorities and agencies | The Public Finance Act, Cap. 348 R.E. 2023 creates an Internal Auditor General in the finance ministry, reporting to the Paymaster General, who sets internal audit policies, standards and manuals and evaluates Audit Committees |
| Each Accounting Officer's institution | An Internal Audit Service unit, and an Audit Committee of three to five members in every ministry, department or agency (Public Finance Regulations 2001; check for later amendments) |
| Banks and financial institutions | An Audit Committee with at least two independent members with accounting, auditing or financial expertise, and independent audit functions (Banking and Financial Institutions (Corporate Governance) Regulations, 2021, GN 767) |
The Controller and Auditor General audits the public sector under Article 143 of the Constitution and the Public Audit Act 2008.
The Tanzanian requirements that shape the choice
Section numbers below follow the R.E. 2023 revised editions, which renumbered some sections; older manuals may cite the earlier numbers.
- NBAA quality visits. NBAA's functions include audit quality review (Cap. 286 s.4(l)), and it may review a firm's practice (s.29). Under by-law 25, NBAA may visit an audit firm at least once every three years and scores it Excellent (81 to 100), Very Good, Good or Poor (0 to 40); a Poor firm is under review for a year, and repeated failure leads to sanctions. Firms submit their latest audit quality review report to NBAA. There is no independent oversight authority; NBAA runs review and discipline. Software should let you produce any engagement's history and evidence during a visit.
- Working papers behind every opinion. By-law 15(3) says a signed audit opinion shall be supported by audit working papers. That puts a premium on knowing, for each signed opinion, where its file is and that it is complete.
- Working-paper retention. Audit firms keep all audit working papers in an accessible form for at least five years from the end of the accounting period (by-law 21). That period runs from a different date from ISA 230's benchmark, which counts from the auditor's report, so check how each vendor computes retention dates.
- Other retention periods. Companies keep books of account in English or Kiswahili in Tanzania and preserve them for six years from the date they are made up (Companies Act s.154). Tax records are kept five years, and until any objection or appeal is finally decided (Tax Administration Act, Cap. 438 R.E. 2023, s.43). Retention must be set by document type.
- Professional clearance with a fourteen-day rule. Under by-law 20, the outgoing auditor must give the incoming auditor access to audit information when asked in writing, and if there is no reply within fourteen days the incoming auditor may decide on professional judgement whether to accept. This builds on the IESBA Code's requirement (R320.8) to ask the predecessor for relevant facts. The software should date the written request, count the fourteen days, and record either the reply or the judgement made without one.
- Standards and file assembly. Tanzania adopted the ISAs without modification in 2004 and the IESBA Code as issued; ISQM 1 and 2 took effect on 15 December 2022, with the first ISQM 1 evaluation due within a year. ISA 230 expects the final file to be assembled ordinarily within 60 days of the auditor's report, with any later change recorded: why, when and by whom.
- Financial statements to NBAA. Engagement letters must state that audited financial statements go to NBAA, and the auditor submits them electronically (by-laws 26 and 27). Keep the submission evidence on the engagement file.
- Public sector internal audit. Internal audit follows the policies, standards and manuals the Internal Auditor General sets, and Audit Committees are evaluated against them. Test that engagement stages, requests to auditees and reports follow the manual your institution uses.
- Data protection and hosting. The Personal Data Protection Act and its 2023 Regulations have been in force since 1 May 2023; controllers and processors must register with the Personal Data Protection Commission, and transfers across borders are governed by ss.31 and 32, with the PDPC issuing a cross-border data transfer permit. Azure has no region in Tanzania; its only African regions are in South Africa. Any cloud-hosted system is likely to hold data outside the country, so settle the transfer position with your legal team first.
For neighbouring markets, see our buyer's guides for Kenya and Uganda.
The types of audit software provider in Tanzania
Searches for audit software by Tanzania's name return little; the suppliers you meet are global and regional.
| Provider type | Examples seen in East African searches | Typical strengths | Watch for |
|---|---|---|---|
| Working-paper software | CaseWare Africa | ISA methodology, financial statements | Documents, requests and billing live elsewhere |
| Enterprise internal audit and GRC suites | TeamMate+, Diligent HighBond, Ideagen Pentana, AuditBoard | Full internal audit lifecycle | Cost; local support usually through partners outside Tanzania |
| Regional GRC vendors and resellers | Trigarc; ERP partners reselling foreign internal audit tools in Tanzania | East African presence, regulator settings | Who writes and supports the software; fit for an audit firm |
| Global practice management and PBC tools | Karbon, TaxDome, Suralink | Workflow, portals, request lists | Built for other markets; data location |
| Spreadsheets and shared drives | Common in firms and public bodies | Low starting cost | No audit trail; hard to evidence during an NBAA visit |
Evaluation criteria
| Area | What to test |
|---|---|
| Category fit | Which of the six jobs the product does, and what stays elsewhere |
| NBAA visit readiness | Each engagement's stages, evidence, dates and sign-offs, printable; the signed opinion linked to its file |
| Retention | Periods set by document type; working-paper retention from the end of the accounting period; legal hold |
| Clearance | A fourteen-day wait from a dated written request, with the reply or the judgement recorded |
| File assembly | An archive clock from the report date; changes after assembly logged |
| Requests for information | Uploads from clients and auditees without accounts; chasers for late items |
| Public sector internal audit | Stages following the Internal Auditor General's manual; evidence ready for the Audit Committee |
| Data protection | Where data is stored; the PDPC transfer position; registration support |
| Commercials | Three-year cost, currency, implementation plan, references, exit and export |
How to run the evaluation
- Agree the jobs with partners or the chief internal auditor, IT and procurement.
- Long-list by category and drop suppliers that fail a must-have.
- Run scripted demos on your own data, the same script for each vendor:
- a written clearance request to an outgoing auditor sent fourteen days ago with no reply: show what the system records and how the partner's decision is documented;
- an NBAA quality visit next week: produce three signed opinions with their complete files;
- a year-end of 31 December and a report signed in April: show the working-paper retention date the system sets, and why;
- a client uploading books of account and tax records through a link, each with its own retention period;
- a ministry internal audit engagement with a request list to a department and three late items.
- Call references of similar size, and ask what went wrong.
- Score independently, then calibrate as a panel, and keep the scoring sheet with the decision.
What audit software costs in Tanzania
Ask each shortlisted vendor to itemise the same lines over three years:
- Licence or subscription: per user, engagement, module or flat.
- Implementation: configuring stages and templates, importing clients, migrating files, training.
- Travel, if the vendor's team is outside Tanzania.
- Hosting: the vendor's cloud, your cloud subscription, or your own servers.
- Prerequisite licences, such as Microsoft 365.
- Support and updates when standards or by-laws change.
- Currency: US dollars or Tanzania shillings, and who carries the exchange-rate risk.
- Internal effort and exit costs, including exporting your files.
For AuditEDMS: on Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.
Red flags
- Retention counted only from the report date, with no way to match by-law 21.
- A clearance step that cannot record the date of the written request, the fourteen-day expiry, or a decision made without a reply.
- No link between a signed opinion and its working papers and evidence.
- Files that can be changed after assembly without a record of who, when and why.
- A public-sector demo with no stages for your manual or your Audit Committee.
- Vague answers about where data is stored or whether a PDPC transfer permit is needed.
- A reseller who cannot say who builds and supports the product.
Where Creodata fits
Creodata is a Nairobi software company, and AuditEDMS covers engagement management, document custody, requests for information, and time and billing for audit, tax and accounting firms, with an internal audit template and a findings register with follow-up for internal audit.
It files every client or auditee document to your own SharePoint by client, engagement and document type, recording who sent it, when and how, versioned and checksummed, with retention dates by document type and legal hold. The statutory audit template runs 13 stages from tender to archive, with evidence gates and a clearance timer that waits the period you set (fourteen days by default) and closes early only when the outgoing auditor's reply is recorded. Clearance comes before the engagement letter, so the decision to accept follows the reply, or the fourteen days where none comes, as by-law 20 describes. An archive clock runs from sign-off to your file-assembly deadline. A printable compliance view shows every stage, its evidence, dates and who completed it. Clients and auditees upload through expiring links with a one-time code and no account, against request lists with chasers. Findings, including management letter points, are recorded with severity, recommendation, management's response and an agreed action with owner and due date; each action is followed to implementation and confirmed by someone other than the person who recorded it implemented, and a follow-up register shows what is open and overdue across engagements. Action owners are recorded by name and are not emailed by the system. Timesheets, milestone billing with VAT, part payments and work in progress are included. Periods are settings; the internal audit template is ready to use and adjusted to your institution's manual at implementation, and at implementation it is set up for Mainland Tanzania: fees in shillings, VAT at 18 percent (one rate per firm, so TRA's 16 percent rate for unregistered individuals paying electronically cannot yet be applied to a fee note), a TRA filing stage, working papers kept five years and books six.
AuditEDMS runs in your own Azure subscription, in the region you choose, with documents in your SharePoint; no client data sits in Creodata's cloud. Azure has no Tanzanian region, so settle the transfer position first. Creodata operates the deployment and holds standing management access to its managed resource group, and every action it takes is recorded in your Azure activity log.
What it does not do: no working papers or audit methodology, no audit universe or risk-based plan, no connection to an accounting system or to TRA's systems, and no electronic submission to NBAA. See AuditEDMS in Tanzania for how each duty maps to a capability.
Frequently asked questions
How long must a Tanzanian audit firm keep working papers?
At least five years from the end of the accounting period, in an accessible form, under by-law 21 of the 2023 practising by-laws. Client records carry their own periods, such as six years for company books of account.
What if the outgoing auditor does not reply?
Under by-law 20, if there is no reply within fourteen days of a written request, the incoming auditor may decide on professional judgement whether to accept. Keep the request, the date and the reasoning on file.
See how AuditEDMS in Tanzania meets these criteria, and request a pilot with your own engagements.