Audit software for Uganda's licensed firms and the internal auditors in every vote.
One record for each engagement, whether it is a statutory audit for a client of an ICPAU-licensed firm or an internal audit in a ministry, a local government or a bank. Client and auditee documents are filed to your own SharePoint with a receipt, the audit runs from tender to archive with its gates and clocks, auditees answer request lists online without an account, and time and fee notes sit beside the work, ready for the file ICPAU's reviewers will open.
Ready for an ICPAU audit quality review, and for a vote's quarterly internal audit cycle.
An ICPAU review opens selected engagement files and tests them against ISQM 1, ISQM 2, ISA 220 and the ethics code, and the grade it gives follows the firm for three years. In government, the Public Finance Management Act puts an internal auditor in every vote, working to a risk-based plan and reporting every quarter. Uganda leaves several retention periods to other laws or to the standards, so the table shows where each one comes from and where AuditEDMS keeps the proof.
Give ICPAU's reviewers access to the firm's policies and selected engagement files, tested against ISQM 1, ISQM 2 and ISA 220 (Accountants Act 2013 ss.36 and 37)
A printable compliance view per engagement showing every stage, its evidence, its dates and who completed it; every action in the audit trail
Assemble the final file after the auditor's report and keep it unaltered for its retention period (ISA 230, applied as issued in Uganda)
Signing the accounts starts an archive clock to your deadline (45 days by default, 60 at most), with reminders and escalation; files are versioned and checksummed, never silently overwritten
Keep tax records five years after the tax period, longer while proceedings run (Tax Procedures Code Act Cap. 343 s.15), and a Tier 4 microfinance client's books for seven years (Tier 4 Microfinance Institutions and Money Lenders Act 2016 s.75)
Retention dates set by document type, so each record carries its own period even where the Companies Act names none; legal hold keeps a file while an objection or appeal is open
Ask the outgoing auditor for relevant facts before accepting the appointment (IESBA Code R320.8, which ICPAU applies)
A professional clearance stage before the engagement letter, which waits your configured period and closes early only when the reply is recorded
Run each vote's internal audit to a risk-based annual workplan and report quarterly to the Accounting Officer and the audit committee (Public Finance Management Act 2015 ss.47 to 49)
Each engagement in the workplan runs through stages set to the Internal Auditor General's manual, with request lists to the auditee and evidence filed against it; findings and management's agreed actions are followed up in a findings register, whose open and overdue actions, with dashboards and CSV reports, feed the quarterly report
Process or store personal data outside Uganda only where the destination gives equivalent protection or the data subject consents (Data Protection and Privacy Act 2019 s.19)
Everything runs in your own Azure subscription, in the region you choose, with documents in your own SharePoint and sign-in through your Entra ID policies
This maps software capability to obligations; it is not professional advice. AuditEDMS does not hold the risk-based annual workplan itself or an audit universe; findings and the follow-up of management's actions are in its findings register.
For Uganda's licensed firms, and for internal audit in government, finance and listed companies.
Every partner of a recognised firm holds a certificate of practice, the firm's licence is renewed each year after Council inspection, and every company appoints its auditor at the annual general meeting.
Each vote has an internal auditor reporting quarterly to its Accounting Officer and audit committee, working to the standards and manuals of the Internal Auditor General, who reports to the Secretary to the Treasury. The Auditor General then audits all public accounts.
ICPAU's own summary of the law lists an internal audit mandate for each, and requires heads of internal audit in public interest entities to be ICPAU members.
Each appoints an internal auditor who reports to a board audit committee of at least two members meeting quarterly (Financial Institutions Act 2004).
The CMA's Corporate Governance Regulations 2025 require an internal auditor with a direct line to the audit and risk committee.
Their books must be kept for at least seven years.
Frequently asked questions.
How long must a Ugandan audit firm keep its records?
Uganda has no single period. The Companies Act requires proper books of account in English but names no retention period (Cap. 106 s.150). Tax records are kept five years after the end of the tax period, longer if proceedings start (Tax Procedures Code Act s.15), and a Tier 4 microfinance institution keeps its books for at least seven years. No Ugandan rule sets a period for the auditor's own working papers, so ISA 230 and ISQM 1's benchmark of at least five years from the auditor's report applies. In AuditEDMS each document type carries its own retention date, and legal hold stops a file leaving while a dispute is open.
What does an ICPAU audit quality review look at?
ICPAU reviews every licensed firm at least once every three years. The review covers firm-wide policies and a sample of engagement files, tests them against ISQM 1, ISQM 2, ISA 220 and the ethics code, and ends in a Class 1, 2A, 2B or 3 grade. AuditEDMS gives the reviewer each sampled engagement's compliance view: when the engagement letter was signed, when clearance closed, who signed off each stage, and when the file was archived.
Does it follow the PFMA internal audit cycle in a vote?
It runs the engagements. Each audit in the vote's workplan runs on the internal audit template, ready to use and adjusted to the Internal Auditor General's manual at implementation: from notification and entrance meeting through fieldwork and the draft report to management responses, the final report and archiving, each dated and signed off with its evidence. Management's agreed actions are followed to verified implementation in the findings register. The risk-based workplan itself is not in AuditEDMS today; the quarterly report to the Accounting Officer draws on the follow-up register, the dashboards and CSV exports.
Can a bank or SACCO internal audit team use it?
Yes: stages, requests to branches and departments, evidence custody, time and sign-offs, and a findings register. For the quarterly board audit committee pack, the follow-up register lists every open action with its owner and due date, and which are overdue; the pack itself is still your own report.
Does it handle fee notes and VAT?
Yes. At implementation AuditEDMS is set up for Uganda: fees in shillings, VAT at the standard 18 percent, and a tax template that files with the URA. Billing milestones raise draft fee notes at the stages you choose, with VAT on each, part payments, and work in progress and yield from approved time. Fee notes stay in AuditEDMS: they are not EFRIS invoices, and AuditEDMS does not post to an accounting system.
Where is the data hosted, and what does the Data Protection and Privacy Act ask?
In your own Azure subscription, in the region you choose, with documents in your own SharePoint. Azure has no region in East Africa today; the nearest are South Africa North in Johannesburg and South Africa West in Cape Town. Section 19 of the Act allows personal data to be processed or stored outside Uganda where the destination gives equivalent protection or the data subject consents, and controllers renew their registration with the Personal Data Protection Office each year. Take the choice of region into your own assessment; we can walk through the deployment with you.
Do we keep our working-paper software?
Yes. AuditEDMS is not working-paper software and does not connect to any today. It keeps what surrounds the working papers: the client's documents with a receipt for each, the engagement's stages and clocks, the request lists, the time and the fee notes.
What does it cost?
On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot runs free for 90 days, by invitation. The deployment's Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff, and implementation is quoted separately.