Audit software for South Africa's registered auditors and internal audit units, built around the archive deadline.
An archive clock from sign-off to IRBA's 60-day file assembly limit, client and auditee documents in your own SharePoint with a receipt for each, the statutory audit from tender to archive, request lists that clients and auditees answer online, and findings followed up to implementation, for IRBA-registered firms and for internal audit units under the PFMA, the MFMA and the Treasury Regulations.
Built for IRBA's inspections and Rule 4's 60-day limit.
ISA 230 says a file is ordinarily assembled within 60 days of the report. IRBA's Rule 4 removes the "ordinarily": for audits of periods beginning on or after 15 December 2024, assembly "shall not exceed 60 calendar days after the date of the engagement report". Archiving of engagement files was one of the five themes of IRBA's 2024 inspections. Each duty below maps to a capability, so the evidence sits where an inspector will look for it.
Assemble the final engagement file within 60 calendar days of the report (IRBA Rule 4(a); ISA 230 paras 14 and A21)
An archive clock from sign-off to your firm's deadline (45 days by default, with a ceiling of 60), with reminders to the manager and escalation to the partner
Keep engagement documentation for at least five years from the report, and record any change after assembly: why, when and by whom (IRBA Rule 4(b); ISA 230 paras 15 and 16)
Versioned, checksummed documents that are never silently overwritten; retention dates by document type; legal hold; every action written to an audit trail
Let IRBA inspect the practice and copy working papers, correspondence and other documents at any time (Auditing Profession Act s.47)
Every stage, gate and approval recorded against the engagement with who and when, and a printable compliance view per engagement to hand the inspector
Evaluate the system of quality management at least annually and keep its documentation for five years (ISQM 1 para 53; IRBA Rule 4(c))
Each engagement's printable history of stages, gates, evidence and sign-offs, for the file reviews that feed the evaluation; the evaluation and independence confirmations stay with the firm
Ask the existing or predecessor auditor for relevant facts before accepting an audit (IESBA Code R320.8); the Companies Act limits an individual auditor to five consecutive years (s.92)
A clearance stage before the engagement letter, which waits the period your firm sets and closes early only when the reply is recorded
Keep company records for seven years and tax records for five years from submission (Companies Act s.24; Tax Administration Act s.29)
Retention dates by document type, so a client's ledgers and a tax return carry different periods; legal hold for a file under audit, objection or appeal
Run internal audit in departments and public entities, and in municipalities with a risk-based plan and an internal audit programme each year, reporting to an audit committee (Treasury Regulation 3.2; MFMA s.165)
Each engagement in the plan runs through stages set to your methodology, dated and signed off, with request lists to the auditee and the evidence filed against it; findings and management's agreed actions are followed to verified implementation in a findings register, whose open and overdue actions go to the audit committee. The risk-based plan itself stays outside AuditEDMS
Send personal information abroad only under POPIA's conditions, such as adequate law or a binding agreement (POPIA s.72)
You choose the Azure region; documents stay in your own SharePoint and Azure; Entra ID sign-in under your own multi-factor policies
This maps software capability to obligations; it is not professional or legal advice, and it is not a claim of POPIA compliance. AuditEDMS follows management's agreed actions to implementation in its findings register; it does not hold an audit universe or the risk-based annual plan.
For South Africa's audit and accounting practices, and for internal audit wherever the law requires it.
Public companies must be audited, and so must private companies above the public interest score thresholds or holding fiduciary assets of more than R5 million (Companies Act s.30). IRBA inspects the practice and can copy its working papers, and Rule 4's 60-day limit now applies to audits of periods beginning on or after 15 December 2024. Mandatory audit firm rotation was set aside in 2023, but an individual may audit a company for no more than five consecutive years, so changes of engagement partner are routine.
Companies below the audit thresholds may be independently reviewed under regulation 29. A practice that serves the same clients across review, tax and accounting work needs one client file, with seven-year company records and five-year tax records kept to their own dates.
Every institution under the Treasury Regulations must have an internal audit function, under the control and direction of an audit committee, and may contract it out in part or in whole (PFMA s.38; Treasury Regulations 3.1 and 3.2). On material irregularities, the Auditor-General can make recommendations, impose binding remedial action and issue a certificate of debt where that action is not taken.
Each must have an internal audit unit that prepares a risk-based audit plan and an internal audit programme every year and reports to the audit committee (MFMA ss.165 and 166).
Each elects an audit committee of at least three members at every annual general meeting, with the Banks Act rules applying alongside for banks (Companies Act s.94). King V's Principle 12 expects assurance functions that "promote an effective internal control environment", with a board-approved internal audit charter and a risk-based internal audit plan.
- AuditEDMS in Kenya
- AuditEDMS in Uganda
- AuditEDMS in Tanzania
- AuditEDMS in Rwanda
- AuditEDMS in Nigeria
- AuditEDMS in the UAE
- AuditEDMS in Ghana
- AuditEDMS in Zambia
Frequently asked questions.
Does AuditEDMS replace CaseWare, Draftworx or AuditMate?
No. Those hold working papers and draft the annual financial statements; AuditEDMS holds what surrounds them: the client's documents with a receipt for each, the engagement from tender to archive with its gates and clocks, the request lists and the time. A firm keeps its working-paper tool and runs AuditEDMS alongside it. AuditEDMS does not connect to any of them today.
What does IRBA Rule 4 mean for our archiving?
For audits of financial statements for periods beginning on or after 15 December 2024, assembling the final engagement file may not take more than 60 calendar days from the date of the report, and the documentation is kept for at least five years from that date (Board Notice 512 of 2023). ISA 230 still governs what assembly is: administrative work only, no new procedures, and any later change recorded with the reason, the date and the person. AuditEDMS starts an archive clock at sign-off, so set the sign-off to the report date and the deadline inside 60 days.
Is AuditEDMS accounting practice management software?
Partly. It covers the engagement lifecycle, the client file, requests for information, timesheets with rates by grade, work in progress and internal approvals. It is built around custody and archiving rather than general practice administration: it does not track CIPC or SARS deadlines for each client, and it does not post to an accounting system. Firms that need those keep their existing tools for them.
How long must a South African firm keep client records?
It depends on the record. A company keeps its accounting records, annual financial statements and directors' and audit committee minutes for seven years (Companies Act s.24). Tax records are kept for five years from the date the return was submitted, and longer while a SARS audit, objection or appeal is under way (Tax Administration Act ss.29 and 32). The auditor's own engagement file is kept for at least five years from the report under IRBA Rule 4. AuditEDMS sets a retention date by document type, so each record carries its own period.
Does it follow the PFMA and MFMA internal audit cycle?
It runs the engagements and follows up their findings. The internal audit template is ready to use and adjusted to your methodology at implementation: notification, planning memorandum, entrance meeting, request for audit information, fieldwork, exit meeting, draft report, management responses, final report and archiving. Each is dated and signed off with its evidence. Findings and management's agreed actions go into the findings register, which follows each action to verified implementation and lists what is open and overdue for the audit committee. The risk-based annual plan the MFMA requires is not in AuditEDMS today.
How often will IRBA inspect our firm?
The Auditing Profession Act lets IRBA inspect a registered auditor's practice at any time, and requires it to inspect or review the practice of an auditor of a public company at least every three years (s.47). In 2024/25 IRBA carried out 20 firm-wide inspections and 72 engagement inspections at 25 firms. Inspectors may copy working papers and correspondence, and confidentiality is no ground to refuse them.
Where is the data hosted?
In your own Azure subscription, in the region you choose, with documents in your own SharePoint. Azure has two regions in South Africa: South Africa North in Johannesburg, with three availability zones, and South Africa West in Cape Town, whose access is restricted to scenarios such as disaster recovery. Creodata operates the deployment from Nairobi with standing management access to its managed resource group, and every action it takes is recorded in your Azure activity log. POPIA allows personal information to go to a third party abroad only under conditions such as adequate law, a binding agreement or the data subject's consent (s.72), so include that access in your assessment with your information officer; ask us how the deployment fits it.
Does it handle South African VAT and SARS?
The deployment is set up for South Africa at implementation: fee notes in rand with VAT at 15 percent, a tax compliance template whose last stage is "Filed with SARS", and retention of five years for engagement files (IRBA Rule 4), seven years for company records and five for tax records. AuditEDMS does not file with SARS or post to an accounting system, and it does not track SARS deadlines for each client.
How much does it cost?
On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.