Audit Software in Uganda: A Buyer's Guide for Audit Firms and Internal Audit (2026)
How to choose audit software in Uganda: ICPAU audit quality reviews, retention, the PFMA internal audit cycle, data protection, types of provider, evaluation criteria, cost and red flags.
Short answer: In Uganda, choose audit software by the evidence you will be asked for: the engagement files ICPAU's audit quality reviewers select at least once every three years, the quarterly internal audit reports every vote owes its Accounting Officer and audit committee, and the records you must keep. Decide which kind of audit software you need first, then test vendors on your own files.
This guide is for managing partners and practice managers at ICPAU-licensed firms, heads of internal audit and chief audit executives in ministries, local governments, banks, insurers, SACCOs and listed companies, and the IT and procurement teams who support them. Few people search for audit software by Uganda's name; most compare global products, so this guide puts the Ugandan rules back into the comparison.
Creodata sells AuditEDMS, so we say plainly where it fits, and where it does not, near the end. The criteria before that are the ones we would use to choose any vendor. This is a practical guide, not legal or professional advice: confirm requirements with ICPAU, the Internal Auditor General or your regulator.
What audit software does
"Audit software" is used for at least six different categories of product. Compare like with like.
| Category | What it does | Who uses it |
|---|---|---|
| Working papers | Audit methodology, risk assessment, testing, lead schedules, financial statements | The engagement team |
| Practice and engagement management | Moves each engagement through its stages, from acceptance to sign-off and archive | Partners, managers, practice managers |
| Document custody | Keeps client and auditee documents with who sent them and when, versions, retention dates and legal hold | Everyone; reviewers when they inspect |
| Requests for information (PBC lists) | Sends a list of what is needed, collects uploads, chases late items | Seniors, managers, internal auditors |
| Time and billing | Timesheets, charge-out rates, invoices or fee notes, work in progress | Staff, managers, finance |
| Internal audit management | Audit universe, risk-based annual workplan, engagements, findings and follow-up | Heads of internal audit, audit committees |
Most firms end up with two or three of these working together. The question is which jobs each product does, and whether they share one record of the client and the engagement.
Who needs audit software in Uganda
Audit firms. Under the Accountants Act, 2013 (now Cap. 294), no one may practise accountancy, which includes auditing financial statements, without an ICPAU certificate of practice. A firm is recognised only if all its partners hold certificates, and certificates and firm licences expire on 31 December each year. A firm is licensed or renewed only after ICPAU Council inspection and approval. Only ICPAU members, and for a firm every partner, may be appointed a company's auditor, and every company appoints an auditor at each annual general meeting (Companies Act, Cap. 106).
Internal audit. The Public Finance Management Act, 2015 places an internal auditor in every vote, preparing a risk-based annual workplan and reporting quarterly to the Accounting Officer and the audit committee, under standards and manuals set by the Internal Auditor General. ICPAU's summary of the legal framework lists further mandates:
| Sector | What requires internal audit |
|---|---|
| Central government votes | PFMA 2015: an internal auditor in every vote; the Minister sets up audit committees |
| Local governments and KCCA | Local Governments Act, Cap. 138 s.90, and the KCCA framework, as listed by ICPAU |
| Banks and other financial institutions | An internal auditor reporting to a board audit committee of at least two members that meets quarterly (Financial Institutions Act, Cap. 57) |
| Insurers, SACCOs, retirement benefit scheme trustees | The Insurance Act, the Cooperative Societies Act and the URBRA Regulations 2020, as listed by ICPAU |
| Listed companies and market intermediaries | An internal auditor with a direct line to the audit and risk committee (CMA (Corporate Governance) Regulations 2025) |
Heads of finance and internal audit in public interest entities must also be ICPAU members.
The Ugandan requirements that shape the choice
A word on citations first: the 7th Revised Edition of the Principal Laws, in force since 1 July 2024, renumbered chapters and some sections. Expect vendor material and older manuals to cite either numbering.
- ICPAU audit quality reviews. A Quality Assurance Board, one of whose six members represents the Auditor General, monitors audit quality. ICPAU reviews every licensed firm at least once every three years, covering firm-wide policies, selected engagement files, ISQM 1, ISQM 2, ISA 220 and ethics, and grades firms Class 1, 2A, 2B or 3. There is no independent audit oversight body; ICPAU runs the reviews. Software should let you produce a selected engagement's full history, and the firm-level evidence behind it, without a week of gathering.
- Standards as issued. Uganda follows the ISAs as issued and the IESBA Code. ISQM 1, ISQM 2 and ISA 220 (Revised) applied from 15 December 2022, and the audit quality reviews test them.
- File assembly. ISA 230 expects the final audit file to be assembled ordinarily within 60 days of the auditor's report; after that nothing may be deleted before the retention period ends, and any change must record why, when and by whom.
- Retention you have to set yourself. We found no Ugandan statute or ICPAU rule that sets a retention period for audit working papers, so the ISQM 1 benchmark of ordinarily at least five years from the auditor's report applies, and firms must give ICPAU access to files during reviews. The Companies Act requires proper books of account kept in English in Uganda but sets no period. Tax records, which may be electronic, are kept five years after the end of the tax period, longer if proceedings start (Tax Procedures Code Act, Cap. 343). Tier 4 microfinance institutions keep books at least seven years. Because so much is policy, retention periods must be settings you control, by document type.
- Predecessor auditor communication. The IESBA Code (R320.8) requires a proposed auditor to ask the existing auditor for any facts it needs before accepting the engagement. We found no Ugandan deadline for the reply, so the waiting period is your firm's policy; the software should hold it and record the reply.
- The public sector internal audit cycle. Each vote's internal auditor works to a risk-based annual workplan and reports quarterly to the Accounting Officer and the audit committee, under the Internal Auditor General's standards and manuals. The Auditor General audits all public accounts (Constitution, Article 163). Test that engagements, auditee requests and quarterly reporting follow your manual's steps.
- Data protection and hosting. Under the Data Protection and Privacy Act, 2019 (s.19), processing or storing personal data outside Uganda needs equivalent protection in the destination country or the data subject's consent, and data controllers register with the Personal Data Protection Office annually. Azure has no region in Uganda; its only African regions are in South Africa. Any cloud-hosted audit system is likely to store client files outside the country, so settle the legal basis before you choose.
If you also audit or operate in Kenya, see our buyer's guide to audit software in Kenya; the rules differ.
The types of audit software provider in Uganda
Searches for audit software in Uganda return almost nothing Uganda-specific, so buyers meet the same global and regional suppliers as their neighbours.
| Provider type | Examples seen in East African searches | Typical strengths | Watch for |
|---|---|---|---|
| Working-paper software | CaseWare Africa | ISA methodology, financial statements | Client documents, requests and billing are handled elsewhere |
| Enterprise internal audit and GRC suites | TeamMate+, Diligent HighBond, Ideagen Pentana, AuditBoard | Full internal audit lifecycle, including findings and follow-up | Cost; support in Uganda, often through partners in Nairobi or elsewhere |
| Regional GRC vendors | Trigarc, which lists Bank of Uganda configuration | East African regulator settings, findings follow-up | Fit for an audit firm's billing and client files |
| Resellers of foreign products | ERP partners reselling US internal audit tools in Uganda | Local contact | Whose software it is, who supports it, and the roadmap |
| Global practice management and PBC tools | Karbon, TaxDome, Suralink | Workflow, portals, request lists | Built around US or UK practice; data location |
| Spreadsheets and shared drives | Common in small firms and votes | Low starting cost | No audit trail; slow to answer a reviewer |
Evaluation criteria
| Area | What to test |
|---|---|
| Category fit | Which of the six jobs the product does, and what stays in other tools |
| Audit quality review readiness | One engagement's stages, evidence, dates and sign-offs, printable or exportable; firm-wide ISQM 1 evidence alongside |
| File assembly and retention | An archive clock from the report date; retention periods you set by document type; legal hold; changes after assembly logged |
| Acceptance and clearance | A predecessor-auditor waiting period you set, with the reply recorded before the engagement letter; engagement letter before fieldwork |
| Requests for information | Clients and auditees upload without accounts; late items chased |
| Public sector internal audit | Engagement stages that follow the Internal Auditor General's manual; time against the annual workplan; quarterly reporting |
| Data protection | Where data is stored; the section 19 basis for any storage abroad; breach handling |
| Local fit | Ugandan tax and invoicing practice in billing; defaults that are settings, not another country's rules in code |
| Commercials | Three-year cost, currency, implementation plan, references, exit and export |
How to run the evaluation
- Agree the jobs with partners or the head of internal audit, IT and procurement.
- Long-list by category and drop suppliers that fail a must-have.
- Run scripted demos on your own data, the same script for each vendor:
- ICPAU notifies you of an audit quality review: produce two selected engagement files, with acceptance, clearance, sign-off and archive evidence, in the meeting;
- a predecessor auditor who has not replied by the end of your waiting period;
- a client uploads five years of tax records electronically through a link, and each gets a retention date you chose;
- a vote's internal audit engagement: a request list to a department with two late items, and the quarter's work ready for the Accounting Officer and audit committee;
- the vendor shows where each of those files is stored.
- Call references of similar size, and ask what went wrong.
- Score independently, then calibrate as a panel, and file the scoring sheet.
What audit software costs in Uganda
Ask each shortlisted vendor to itemise the same lines over three years:
- Licence or subscription: per user, engagement, module or flat.
- Implementation: configuring stages and templates to your methodology or the public sector manual, importing clients, migrating files, training.
- Travel, if the vendor's team is based outside Uganda.
- Hosting: the vendor's cloud, your cloud subscription, or your own servers.
- Prerequisite licences, such as Microsoft 365.
- Support and updates, including standards changes.
- Currency: US dollars or Uganda shillings, and who carries the exchange-rate risk.
- Internal effort and exit costs.
For AuditEDMS: on Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.
Red flags
- The vendor cannot show a selected engagement's complete history, as an ICPAU reviewer would ask for it.
- Retention periods are fixed in code, or copied from another country's rules and presented as Ugandan requirements.
- Files can be replaced after the report with no record of who, when or why.
- A public-sector demo ignores the vote's workplan and quarterly reporting.
- The vendor cannot say where data is stored, or what makes storage outside Uganda lawful for you.
- A reseller cannot say who writes, supports and updates the software.
- Must-haves answered with roadmap dates.
Where Creodata fits
Creodata is a Nairobi software company, and AuditEDMS covers engagement management, document custody, requests for information, and time and billing for audit, tax and accounting firms, and an internal audit template with a findings register and follow-up for internal audit.
It files every client or auditee document to your own SharePoint by client, engagement and document type, with who sent it, when and how, versioned and checksummed, with retention dates by document type and legal hold. The statutory audit template runs 13 stages from tender to archive, with evidence gates, a clearance timer before the engagement letter that waits the period you set and closes early only when the outgoing auditor's reply is recorded, and an archive clock from sign-off. A printable compliance view shows every stage, its evidence, its dates and who completed it, which is what a quality reviewer asks for. Clients and auditees upload through expiring links with a one-time code and no account, against request lists with chasers. Findings, including management letter points, are recorded with severity, recommendation, management's response and an agreed action with owner and due date; each action is followed to implementation and confirmed by someone other than the person who recorded it implemented, and a follow-up register shows what is open and overdue across engagements. That register feeds the quarterly report to the Accounting Officer and the audit committee; action owners are recorded by name and are not emailed by the system. Timesheets, milestone billing with VAT, part payments and work in progress are included. Retention periods, the clearance wait and the archive deadline are settings; the internal audit template is ready to use and adjusted to your manual at implementation, and other stage templates are set up with you then. At implementation it is set up for Uganda: fees in shillings, VAT at 18 percent, a URA filing stage, and retention periods that follow Ugandan rules.
AuditEDMS runs in your own Azure subscription, in the region you choose, with documents in your SharePoint; no client data sits in Creodata's cloud. Azure has no Ugandan region, so plan for your data protection basis. Creodata operates the deployment and holds standing management access to its managed resource group, and every action it takes is recorded in your Azure activity log.
What it does not do: it holds no working papers or audit methodology, has no audit universe or risk-based annual workplan, and does not connect to an accounting system or URA's systems. See AuditEDMS in Uganda for how each Ugandan duty maps to a capability.
Frequently asked questions
How long must a Ugandan audit firm keep working papers?
We found no statute or ICPAU rule setting a period, so the ISQM 1 benchmark of ordinarily at least five years from the auditor's report is the usual floor. Set a longer period where a client's own records require it, such as seven years for Tier 4 microfinance institutions.
Can internal audit data be stored outside Uganda?
The Data Protection and Privacy Act allows it where the destination gives equivalent protection or the data subject consents. Decide the basis with your legal team, and ask each vendor exactly where data is stored.
See how AuditEDMS in Uganda meets these criteria, and request a pilot with your own engagements.