Audit software for Kenya's audit firms and internal audit teams.
Client and auditee documents in your own SharePoint with a receipt for each, the statutory audit from tender to archive with clearance and archive clocks, request lists that clients and auditees answer online, findings followed up to implementation, and timesheets and fee notes, for ICPAK-licensed firms and for internal audit units under the PFM Act, CBK, CMA and SASRA rules.
Built for ICPAK's quality reviews and the PFM Act's internal audit cycle.
ICPAK has adopted the ISAs as issued, with their effective dates, and runs the quality assurance reviews that test a firm's files against them. The PFM Act and its regulations set the internal audit cycle for every national and county government entity. Each duty below maps to a capability, so the evidence sits where a reviewer will look for it.
Assemble the audit file promptly after the report and keep it unchanged (ISA 230, adopted by ICPAK)
An archive clock from sign-off to your firm's deadline (45 days by default, ceiling 60), with reminders and escalation; versioned, checksummed files and an audit trail of any later change
Keep company accounting records for seven years and tax records for five (Companies Act s.630; Tax Procedures Act s.23)
Retention dates by document type, so a client's ledgers and a tax computation carry different periods; legal hold for a file under dispute
Ask the predecessor auditor for relevant facts before accepting an audit (IESBA Code R320.8, the step Kenyan firms call professional clearance)
A clearance stage before the engagement letter, which waits the period your firm sets and closes early only when the reply is recorded
Give ICPAK's reviewers unlimited access to records, and show who performed each procedure and when (Quality Assurance Review Regulations 2022, Third and First Schedules)
Every stage, gate and approval recorded against the engagement with who and when, and a printable compliance view per engagement to hand the reviewer
Evaluate the firm's system of quality management each year (ISQM 1 para 53)
Each engagement's printable history of stages, gates, evidence and sign-offs, for the file reviews that feed the evaluation; the evaluation itself stays with the firm
Run public sector internal audit under the IPPF, with an annual plan to the audit committee by 15 February, written confirmation of preliminary findings within seven days, and the Accounting Officer's action plan within fourteen (PFM (National Government) Regulations 2015, regs 161, 170 to 172)
Engagement stages carrying those steps, dated and signed off; request lists to the auditee; the evidence filed against the engagement; a findings register holding each finding, the Accounting Officer's agreed action with its owner and due date, and its follow-up to verified implementation. The annual plan itself stays outside AuditEDMS
Keep personal data only as long as needed, protect it, and notify a breach within 72 hours (Data Protection Act 2019, ss.39 and 43)
Documents stay in your own SharePoint and Azure; Entra ID sign-in with your multi-factor policies; retention dates by document type
This maps software capability to obligations; it is not professional advice. AuditEDMS follows each agreed action to implementation in its findings register, and a follow-up register shows what is open and overdue; it does not hold an audit universe or a risk-based annual plan.
For Kenya's audit firms, and for internal audit wherever the law requires it.
Statutory auditors must hold a practising certificate (Companies Act s.777), and every company must be audited unless it is a small company under the s.711 thresholds. Public companies, banks and insurers never are.
Each must have internal audit following international best practice and an audit committee, with the Internal Auditor-General's Department setting the scope of internal audit (PFM Act ss.73 and 155). County audit committees have three to five members with an independent chair. The Auditor-General has unhindered access to every internal audit report, and since 25 September 2026 an accounting officer who fails to implement a parliamentary committee's audit recommendations faces a penalty.
Every GOE board must have an audit committee, with a majority of independent directors, overseeing internal audit (Government Owned Enterprises Act 2025).
CBK's corporate governance guideline requires a permanent internal audit function and a Board Audit Committee that approves the internal audit plan and meets at least quarterly (CBK/PG/02).
The CMA Code requires an internal audit function reporting directly to the audit committee, and an annual governance audit.
A SACCO must establish an internal audit function led by a qualified accountant reporting to the board's audit committee, which reviews findings at least once every three months.
Frequently asked questions.
Does AuditEDMS replace CaseWare or ICPAK's myAudit?
No. Those hold audit working papers; AuditEDMS holds what surrounds them: the client's documents with a receipt for each, the engagement from tender to archive with its gates and clocks, the request lists, the time and the fee notes. A firm keeps its working-paper tool and runs AuditEDMS alongside it. AuditEDMS does not connect to either today.
How long must a Kenyan audit firm keep client records?
It depends on the record. A company must keep its accounting records for at least seven years (Companies Act s.630) and tax documents for five years from the end of the reporting period (Tax Procedures Act s.23). An auditor's own file is kept for the firm's retention period, ordinarily at least five years from the auditor's report under ISA 230 and ISQM 1. An accountant carrying out AML-covered work for a client keeps those records for seven years (POCAMLA s.46). AuditEDMS sets a retention date by document type, so each record carries its own period.
Does it follow the PFM regulations' internal audit cycle?
The internal audit template is ready to use and adjusted to your manual at implementation: notification, planning memorandum, entrance meeting, request for audit information, fieldwork, exit meeting, draft report, management responses, final report and archiving. Each is dated and signed off with its evidence. Findings and the Accounting Officer's action plans go into the findings register, which follows each action to verified implementation and shows what is overdue. The annual plan is not in AuditEDMS today.
Can SACCOs and banks use it for internal audit?
Yes: stages, document requests to branches or departments, evidence custody, time and sign-offs, and a findings register. For the audit committee's quarterly review of findings, the follow-up register lists every open action with its owner and due date, and which are overdue.
Where is the data hosted?
In your own Azure subscription, in the region you choose, with documents in your own SharePoint. Azure's nearest regions to Kenya today are South Africa North in Johannesburg and South Africa West in Cape Town. The Data Protection Act allows personal data to leave Kenya with appropriate safeguards (ss.48 and 49), but the Data Protection (General) Regulations require processing in Kenya, or a serving copy kept in Kenya, for systems that administer public finances (LN 263 of 2021, reg 26). A public-sector internal audit unit should settle that question with its data protection officer before choosing a region; ask us how the deployment fits your assessment.
How often will ICPAK review our firm?
Every practice is on a three-year review cycle under the Accountants (Quality Assurance Review) Regulations, 2022, and a firm that audits companies, listed or regulated entities, entities with gross revenue over KES 5 million, or work outsourced by the Auditor-General is reviewed every year. The results inform the renewal of your annual licence, and your engagement letters must tell clients that working papers may be reviewed. The Regulations' self-review tool asks whether the firm uses audit software, and whether working papers show who performed each procedure and when.
Does it handle fee notes and VAT?
Yes. Billing milestones raise draft fee notes at the stages you choose (40, 40 and 20 percent of the fee by default), with VAT on each, part payments, and work in progress and yield from approved time. Fee notes stay in AuditEDMS; it does not post to an accounting system or to eTIMS.
How much does it cost?
The pilot is free for 90 days, by invitation, and pricing is on request. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.