Audit software for Zambia's audit firms and internal audit units.
Client and auditee documents in your own SharePoint with a receipt for each, the statutory audit from tender to archive with clearance and archive clocks, request lists that clients and public bodies answer online, and timesheets and fee notes, for ZICA-registered firms and for internal audit units working under the Public Finance Management Act 2018.
Built for ZICA's practice review and the PFM Act's internal audit reporting.
ZICA has adopted the ISAs without modification, and its practice review tests a firm's engagement documentation against them. The Public Finance Management Act 2018 gives internal auditors access to every public body's records and sets their quarterly reporting line. Each duty below maps to a capability, so the evidence sits where a reviewer will look for it. One duty, where personal data is stored, is not something software settles on its own, and the table says so.
Assemble the audit file promptly after the report and keep it unchanged (ISA 230, adopted by ZICA without modification)
An archive clock from sign-off to your firm's deadline (45 days by default, ceiling 60), with reminders and escalation; versioned, checksummed files and an audit trail of any later change
Keep company records for ten years and tax records for six (Companies Act 2017 s.356; Income Tax Act s.55)
Retention dates by document type, so a client's ledgers and a tax computation carry different periods; legal hold for a file under dispute
Ask the predecessor auditor for relevant facts before accepting an audit (IESBA Code R320.8, adopted without modification)
A clearance stage before the engagement letter, which waits the period your firm sets and closes early only when the reply is recorded
Let ZICA's practice review inspect and copy any record, and pass an independent audit quality review at least every three years (Accountants Act 2008 s.31; ZICA practice matters)
Every stage, gate and approval recorded against the engagement with who and when, and a printable compliance view per engagement to hand the reviewer
Evaluate the firm's system of quality management each year (ISQM 1 para 53)
Each engagement's printable history of stages, gates, evidence and sign-offs, for the file reviews that feed the evaluation; the evaluation and independence confirmations stay with the firm
Give internal auditors access to all records of a public body, and report quarterly to the Controller of Internal Audit, the Controlling Officer and the audit committee (PFM Act 2018 ss.14 to 17)
Engagement stages carrying your manual's steps, dated and signed off; request lists to the department or spending agency; the evidence filed against the engagement; a findings register whose open and overdue actions feed the quarterly report
Store personal data on a server or data centre in Zambia unless an exception is prescribed; keep sensitive personal data in Zambia (Data Protection Act 2021 s.70)
Not settled by the software. AuditEDMS runs in the Azure region you choose, and Azure has no region in Zambia. Confirm the position with the Data Protection Commissioner before choosing a region
This maps software capability to obligations; it is not professional or legal advice. AuditEDMS follows management's action plans to implementation in its findings register, but it does not hold an audit universe or a risk-based annual audit plan, and it does not track key audit partner rotation.
For Zambia's audit firms, and for internal audit in public bodies and banks.
Only persons registered to practise as auditors may be appointed, a firm's report is signed by a qualified partner, and at least one partner is ordinarily resident in Zambia (Companies Act 2017 ss.254 to 256). A company appoints its auditor within three months of incorporation unless it is an exempt small private company.
The Companies (Amendment) Act 2025, assented on 23 December 2025, defines a public interest entity and sets cooling-off periods of five, three and two years after the seven-year limit on key audit roles. Publicly accountable entities also report under IFRS S1 and S2 for periods from 1 January 2025 (ZICA Circular 4/2023).
The Auditor-General may sub-contract audits to ZICA-registered firms (Public Audit Act 2016 s.10), and local authority accounts are audited every year (Local Government Act 2019 s.44).
The Controller of Internal Audit runs risk-based financial, compliance, performance, ICT and forensic audits across government, and internal auditors may see all records of any public body. Each public body's audit committee meets at least quarterly and reviews audit plans, controls and audit reports; central government committees include a ZICA member.
Once the Banking and Financial Services Act 2026 commences, records must be kept at least ten years after the relationship or transaction ends and protected against deliberate or accidental change or deletion.
Frequently asked questions.
Does AuditEDMS replace our working-paper software?
No. Working-paper tools hold the audit file itself; AuditEDMS holds what surrounds it: the client's documents with a receipt for each, the engagement from tender to archive with its gates and clocks, the request lists, the time and the fee notes. A firm keeps its working-paper tool and runs AuditEDMS alongside it. AuditEDMS does not connect to any working-paper or accounting software today.
How long must a Zambian audit firm keep client records?
It depends on the record. A company must keep its accounting records, financial statements and the other records the Companies Act requires for at least ten years (Companies Act 2017 ss.30 and 356), and tax books and supporting documents for six years from the last entry (Income Tax Act s.55). An auditor's own file is kept for the firm's retention period, ordinarily at least five years from the auditor's report under ISA 230, which ZICA has adopted without modification. AuditEDMS sets a retention date by document type, so each record carries its own period.
Does it work for internal audit units reporting to the Controller of Internal Audit?
Yes. The internal audit template is ready to use and adjusted to your manual at implementation: notification, planning memorandum, entrance meeting, request for audit information, fieldwork, exit meeting, draft report, management responses, final report and archiving, each dated and signed off with its evidence. Request lists go to the department or spending agency, and replies are filed against the engagement. Findings and management's agreed actions go into the findings register, and the follow-up register lists open and overdue actions for the quarterly report to the Controller, the Controlling Officer and the audit committee. The report itself, and the annual audit plan, stay outside AuditEDMS.
Where is the data hosted?
In your own Azure subscription, in the region you choose, with documents in your own SharePoint. Azure has no region in Zambia: its only African regions are South Africa North in Johannesburg and South Africa West in Cape Town. The Data Protection Act 2021 requires personal data to be processed and stored on a server or data centre in Zambia unless the Minister prescribes an exception, and sensitive personal data always stays in Zambia (s.70). Audit files hold personal data. Confirm your position with the Data Protection Commissioner before choosing a region, and talk to us before you commit.
How often will ZICA review our firm?
ZICA expects practitioners to have an independent audit quality review at least once every three years, and to run in-house reviews between them; the reviews evaluate engagement documentation against the ISAs. Under the Accountants Act, the practice review may inspect and copy any book, document or record under your control, client confidentiality notwithstanding (s.31). A printable compliance view of each engagement, and an audit trail of who did what and when, shortens that visit.
Does it track key audit partner rotation for public interest entities?
No. The seven-year limit on key audit roles for a public interest entity, and the cooling-off periods that follow, came in with the Companies (Amendment) Act 2025. AuditEDMS records who completed each stage and approval on an engagement, but it does not count consecutive years per partner or warn when a limit approaches. Keep your rotation schedule where you keep it today.
Does it handle fee notes and VAT?
Yes. At implementation AuditEDMS is set up for Zambia: fees in kwacha, VAT at the standard 16 percent, a tax template that files with the ZRA, and accounting records kept ten years as the Companies Act 2017 requires. Billing milestones raise draft fee notes at the stages you choose (40, 40 and 20 percent of the fee by default), with VAT on each, part payments, and work in progress and yield from approved time. Fee notes stay in AuditEDMS; it does not post to an accounting system or to ZRA.
How much does it cost?
On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.