Ready Accounting Firm White Logo
Prepare for audit: your practical South African guide
Back to Blog

Prepare for audit: your practical South African guide

July 26, 2026
AI Webhook

Prepare for audit: your practical South African guide

Professional woman organizing audit documents

Audit preparation is the process of organizing your financial records, involving the right people, and communicating clearly so that an audit runs smoothly and produces no nasty surprises. Whether you are facing a SARS audit, a statutory audit under the Companies Act, or an internal review, the steps are largely the same: understand the scope, pull your documents together, reconcile your numbers, and keep the lines of communication open. Done well, audit prep is not a last-minute scramble. It is a discipline you build into your accounting cycle throughout the year.

Here is what that looks like in practice:

  • Confirm the audit type and scope as soon as you receive notification
  • Appoint one person internally to act as the auditor liaison
  • Gather all financial records: bank statements, invoices, VAT returns, payroll records, and contracts
  • Reconcile bank accounts and update your fixed asset register before the auditors arrive
  • Conduct a pre-audit meeting to align on timelines, document requests, and expectations
  • Address any known discrepancies or missing records before the audit begins
  • Keep all records organized, indexed, and accessible, whether digitally or in physical files

Pro Tip: Set up a shared, cloud-based folder at the start of each financial year and file source documents in real time. When the audit notification arrives, your records are already organized rather than buried across email threads and desktop folders.

Table of Contents

What is the difference between an internal and external audit?

Understanding which type of audit you are facing changes how you prepare. The two are fundamentally different in purpose, scope, and who conducts them.

An internal audit is conducted by your own staff or an outsourced internal audit function. Its job is to evaluate the effectiveness of your internal controls, risk management processes, and governance. The 2024 IIA Global Internal Audit Standards set the professional benchmark here, requiring internal auditors to be independent within the organization and to report findings to the audit committee or board. Internal audits are ongoing and forward-looking. They catch problems before external auditors do.

An external audit is conducted by an independent registered auditor and results in an opinion on whether your financial statements give a true and fair view. For South African companies, this is governed by the Companies Act and overseen by the Independent Regulatory Board for Auditors (IRBA). External audits are mandatory for companies above certain Public Interest Score thresholds, which we cover in detail later.

The COSO Internal Control Framework is the most widely used model for designing and evaluating internal controls globally. It organizes controls across five components: control environment, risk assessment, control activities, information and communication, and monitoring. Whether you are preparing for an internal or external audit, mapping your processes against COSO gives auditors a structured picture of how your business manages risk and prevents errors.

The practical difference for preparation is this: internal audits require you to document your processes and controls, while external audits require you to substantiate every number in your financial statements with source documents. Both demand organized records. External audits demand more of them.

How do you plan an audit and who should be involved?

Good audit preparation starts weeks, sometimes months, before the auditors walk in. The earlier you begin, the less disruptive the process.

  1. Confirm the audit type and trigger. Is this a statutory external audit, a SARS audit, or an internal review? Each has different documentation requirements and timelines. SARS, for example, officially begins an audit only when you receive a Notification of Audit letter specifying the auditor’s name and the scope. A verification request is less formal and does not carry the same weight.
  2. Define the scope. What period is under review? Which entities, tax types, or business units are included? Get this in writing from the auditors before you start pulling documents.
  3. Set a realistic timeline. A routine SARS audit can take anywhere from 30 days to 12 months depending on preparation and cooperation. Build your internal deadlines backward from the auditors’ submission dates.
  4. Appoint an internal liaison. This person owns the audit process on your side. They coordinate document requests, manage communication with the audit team, and track outstanding items. In a small business, this is often the financial manager or bookkeeper. In larger organizations, it may be the CFO or a dedicated compliance officer.
  5. Brief your team. Finance, payroll, operations, and management all need to know an audit is underway. Auditors may request information from multiple departments. Surprises slow everything down.
  6. Review prior audit findings. If you have been audited before, pull the previous management letter. Auditors often revisit areas where issues were flagged. Resolving those weaknesses before the audit starts removes easy targets.

The goal of this planning phase is to get ahead of the auditors’ requests rather than react to them. Every document you can produce on day one shortens the process.

Business team planning audit documents

What documents do you need to prepare for an audit?

This is where most of the practical work happens. SARS typically requests bank statements, sales and purchase invoices, VAT schedules, payroll data, lease and loan agreements, and shareholder loan accounts. Respondents generally receive 21 business days to submit requested documents, with extensions available by written request.

The Tax Administration Act requires all financial records to be kept for a minimum of five years from the date of tax return submission. Failure to maintain these records is a tax offense, not just an administrative oversight.

Core document checklist

  • Bank statements: all accounts, for the full audit period, reconciled to your accounting records
  • Sales invoices and purchase invoices: with supporting delivery notes, purchase orders, and contracts where applicable
  • VAT returns and schedules: input and output VAT reconciled to your general ledger
  • Payroll records: payslips, IRP5s, EMP201 and EMP501 submissions, leave records
  • Fixed asset register: updated with additions, disposals, and depreciation for the period
  • Loan agreements: shareholder loans, bank facilities, and any related-party transactions
  • Management accounts and trial balance: for the full audit period
  • Prior year financial statements: for comparative purposes
  • CIPC registration documents and share register: for statutory compliance checks

Document organization best practices

Area Best practice Why it matters
Digital filing Use cloud accounting software with document attachment Auditors can trace transactions to source documents instantly
Naming conventions Date-first file names (YYYY-MM-DD_description) Prevents confusion and speeds up retrieval
Bank reconciliations Reconcile monthly, not at year-end Discrepancies are easier to resolve when they are fresh
VAT schedules Reconcile VAT returns to the general ledger each period Prevents VAT adjustments that attract penalties
Fixed assets Update the register every time an asset is bought or sold Auditors cross-reference depreciation and disposals directly

Keeping an updated fixed asset register and reconciling bank statements in your accounting software prevents the kind of audit adjustments that delay sign-off and attract SARS scrutiny. Double-entry bookkeeping creates a complete, traceable audit trail that lets auditors follow any figure directly back to its source document. If your books are on a single-entry or spreadsheet system, that trail does not exist, and auditors will ask for it manually.

How should you communicate with auditors before and during the audit?

The pre-audit meeting is one of the most underused tools in audit preparation. Most businesses treat it as a formality. It is not.

Hands texting auditor communication

Use the pre-audit meeting to confirm the audit scope, agree on a document submission schedule, clarify the format auditors prefer for records, and identify any areas they plan to focus on. Getting this information upfront lets you prioritize your preparation rather than scrambling to respond to requests as they arrive.

Key items to cover in the pre-audit meeting:

  • Confirmed audit period and entities in scope
  • List of documents required and preferred format (digital or physical)
  • Submission deadlines and the process for requesting extensions
  • Named contact persons on both sides
  • Any known issues or prior-year findings you want to flag proactively
  • Agreed communication channel (email, portal, or in-person)

Communication best practices during the audit:

  • Respond to document requests promptly and completely. Partial responses create follow-up requests and extend the timeline.
  • Never guess. If you are unsure about a figure or a transaction, say so and commit to a date when you will have the answer.
  • Keep a log of every document submitted, including the date and the name of the person who received it.
  • If an auditor raises a finding you disagree with, engage professionally and in writing. Verbal agreements are difficult to enforce later.
  • Flag delays early. If you cannot meet a deadline, request an extension in writing before the deadline passes, not after.

Openness and responsiveness are the two qualities auditors value most. A business that is organized and communicates clearly almost always has a shorter, less disruptive audit than one that is defensive or slow to respond.

Why does thorough audit preparation benefit your business?

The most obvious benefit is a shorter audit. A routine audit can take anywhere from 30 days to 12 months depending on how prepared the business is and how quickly it responds to requests. Businesses that arrive at the audit with organized records, reconciled accounts, and a clear document trail consistently sit at the shorter end of that range.

Beyond time, there are three other concrete benefits:

  • Fewer adjustments. When your records are complete and reconciled, auditors have less reason to propose corrections. Adjustments to your financial statements or tax returns can trigger penalties and interest.
  • Lower compliance costs. Auditors charge for time. A disorganized client takes longer to audit, and that time is billed. Preparation directly reduces your audit fee.
  • Stronger credibility. For businesses seeking investment, applying for credit, or tendering for contracts, clean audited financials carry weight. Investors and lenders read audit opinions carefully.

Audit preparation also protects you from SARS risk. SARS distinguishes between a verification and a full audit. A verification is a routine check. An audit is a formal process that can result in additional assessments, penalties, and interest. Businesses with well-maintained records are far less likely to see a verification escalate into a full audit.

Statistic: According to SARS, a routine audit completion can range from 30 days to 12 months depending on preparation and cooperation.

What are the South African-specific audit requirements you need to know?

South Africa has its own set of rules that determine whether your company needs an audit at all, and what records you must keep regardless.

Public Interest Score and audit thresholds

Under the Companies Act, your audit requirement depends on your Public Interest Score. The PIS is calculated annually based on your turnover, employees, third-party liabilities, and number of shareholders. The thresholds work like this:

  • PIS of 350 or more: a statutory audit is mandatory
  • PIS between 100 and 349: an audit is required if your financial statements were independently compiled (not by a director or employee), or if 10% or more of shareholders request one
  • PIS below 100: an independent review under ISRE 2400 standards is generally sufficient, unless the company is owner-managed

Public companies, State-Owned Enterprises, and large private companies with high PIS scores always require a full audit. Smaller companies may qualify for an independent review or compilation, which carries lower compliance requirements. Understanding which category you fall into is the first step in audit planning. You can read more about the distinction in this guide to independent review vs audit for South African businesses.

Record-keeping under the Tax Administration Act

The Tax Administration Act mandates five years of record retention from the date of tax return submission. This covers invoices, bank statements, payroll records, VAT schedules, and contracts. Destroying or losing records within that window is a tax offense, regardless of whether you are under audit.

SARS verification vs audit: know the difference

Many businesses confuse a SARS verification with a full audit. A verification is a routine request for supporting documents to confirm a specific return. An audit is a formal investigation that begins only when you receive a written Notification of Audit. The notification names the auditor and specifies the scope. Until you receive that letter, you are in a verification process, not an audit.

Key practices for South African audit readiness:

  • Calculate your PIS annually to confirm your audit or review requirement
  • Retain all records for at least five years from tax return submission
  • Keep your fixed asset register current and reconcile it to your depreciation schedule
  • Reconcile bank statements monthly in your accounting software
  • File VAT returns on time and reconcile each return to your general ledger before submission
  • Maintain a CIPC-compliant share register and keep your company registration documents accessible

Pro Tip: Cloud accounting platforms like Xero or Sage Business Cloud allow you to attach source documents directly to transactions. When SARS requests an invoice from three years ago, you retrieve it in seconds rather than searching through physical files. This single habit reduces audit response time more than almost anything else.

For a deeper look at what SARS specifically looks for, Readyaccounting’s guide on preparing for a SARS audit covers the process in detail.

What does an audit preparation timeline look like?

Working backward from your audit date gives you a clear picture of what needs to happen and when. Here is a practical timeline for a statutory external audit:

8–12 weeks before the audit: Confirm your PIS and audit requirement. Engage your auditors and agree on the audit period, scope, and key dates. Pull prior-year financials and the previous management letter to identify any unresolved findings.

Infographic displaying audit preparation timeline steps

6–8 weeks before: Begin gathering documents. Reconcile all bank accounts, update the fixed asset register, and compile VAT schedules for the full audit period. Brief your team on the audit timeline and their responsibilities.

4–6 weeks before: Complete your trial balance and management accounts. Reconcile intercompany accounts and shareholder loan accounts. Identify and resolve any discrepancies before the auditors see them.

2–4 weeks before: Conduct the pre-audit meeting. Submit any documents the auditors have requested in advance. Confirm the submission format and the named contacts on both sides.

1 week before: Final readiness check. Verify that every item on your document checklist is accessible and indexed. Confirm that your liaison is available and briefed for the audit period.

During the audit: Respond to requests within agreed timelines. Log every document submitted. Escalate any disagreements in writing rather than verbally.

This timeline works for SARS audits too, though the trigger is the Notification of Audit letter rather than a scheduled date. When that letter arrives, compress the timeline and prioritize the documents SARS has specifically requested.

How do you handle audit findings after the audit ends?

The audit report is not the end of the process. How you respond to findings determines whether the same issues appear in next year’s audit.

Receiving the management letter or audit report: Auditors typically issue a management letter alongside their opinion. This letter lists control weaknesses, errors, and recommendations. Read it carefully. Each finding is a signal about where your processes broke down.

Responding to findings: Draft a formal response to each finding. For each one, state whether you accept it, explain the root cause, and commit to a specific corrective action with a deadline. Vague responses (“we will improve our processes”) carry no weight. Specific ones do (“we will implement monthly bank reconciliation sign-off by the financial manager, effective from the next quarter”).

Addressing SARS audit outcomes: If a SARS audit results in an additional assessment, you have the right to object within 30 business days of the assessment date. If you disagree with the outcome, engage a tax professional before the objection deadline. Missing that window significantly limits your options.

Building findings into your next cycle:

  • Update your internal controls to address the root causes identified
  • Add the resolved findings to your pre-audit checklist for next year
  • Share relevant findings with your team so the same errors are not repeated
  • If the audit identified a systemic record-keeping problem, invest in fixing it now rather than at the next audit

The businesses that consistently produce clean audits are not the ones with perfect records from day one. They are the ones that treat each management letter as a genuine improvement plan and follow through on it. Preparing your annual financial statements with that discipline built in is what separates a smooth audit from a painful one.

Key takeaways

Thorough audit preparation, grounded in organized records, clear communication, and knowledge of South African compliance requirements, is the single most effective way to reduce audit duration, minimize adjustments, and protect your business’s credibility.

Point Details
Know your audit type Confirm whether you need a statutory audit, independent review, or face a SARS audit before preparing documents.
Five-year record retention The Tax Administration Act requires all financial records to be kept for at least five years from tax return submission.
Audit duration varies widely A routine audit can take 30 days to 12 months; organized businesses consistently sit at the shorter end.
SARS verification vs audit A verification is not an audit. An official SARS audit begins only when you receive a written Notification of Audit letter.
Readyaccounting Readyaccounting helps South African SMEs maintain audit-ready books year-round through cloud accounting and tax compliance support.

Readyaccounting keeps you audit-ready all year

Most businesses only think about audit preparation when the auditors are already at the door. Readyaccounting is built for the businesses that want to get ahead of that. As an outsourced accounting and tax compliance firm for South African SMEs and startups, Readyaccounting replaces manual bookkeeping with cloud-based systems that keep your records organized, reconciled, and audit-ready every month of the year, not just in the weeks before an audit.

Your books are maintained on cloud infrastructure with source documents attached to every transaction. Your VAT returns are reconciled before submission. Your fixed asset register is current. When a SARS notification or a statutory audit date arrives, the preparation is already done.

If you want books that hold up under scrutiny, explore Readyaccounting’s outsourced accounting services or see how accounting automation reduces the manual errors that auditors find. Get in touch to find out what audit-ready books actually look like for your business.