Assembling the audit file within IRBA's 60 days

IRBA's rule on assembling the final audit file within 60 days and keeping it five years, and how Achekam times, locks, archives and retains the file.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa

The report is signed, the client has its statements and the team has already moved to the next job. That is the moment file assembly slips. A review note was never formally cleared, a confirmation reply sits in someone's inbox, the final version of a lead schedule lives on a laptop. Weeks later, nobody is sure which version of the file is the one an inspector will see.

IRBA has put a clock on this stage, and on how long the result must be kept. This article sets out the rule as it stands at the time of writing and walks through how Achekam starts the clock, locks the file, builds the archive and holds it for the retention period.

The rule at the time of writing

IRBA Board Notice 512 of 2023, Rule 4, requires the final engagement file to be assembled within 60 days of the report date and kept for at least five years. It applies to audits of periods beginning on or after 15 December 2024.

Assembly is the administrative completion of the file that ISA 230 deals with: putting the documentation in order, finishing cross-references and removing superseded drafts. It is not a window for new audit work. Anything genuinely new after the report date belongs in the file as an addition, with who added it, when and why. The full text of ISA 230 is in the IAASB's 2026 Handbook, which collects the quality management standards and all the International Standards on Auditing.

When the clock starts

In Achekam, the partner records the auditor's report as issued. That act binds the statements' fingerprint to the report and starts the file-assembly clock. Before that, the partner can send the client a read-and-comment preview link and send the approved report for e-signature.

One practical point follows. The rule counts from the report date, while Achekam's clock starts when the issue is recorded. Record the issue on the day the report is dated, so the clock in the system and the clock in the rule start together. A team that records issue a week late has a week less than its screen suggests.

Where the firm has named an engagement quality reviewer, that person must clear the audit report before it can be issued. The reviewer must be a partner or senior manager not on the engagement team. For a South African firm, Achekam does not require a reviewer for any engagement type; naming one is the firm's decision.

Assembling and locking the file

After the report is issued, the engagement partner assembles and locks the audit file under AUDIT & ASSURANCE > Completion. Three conditions cannot be overridden: the report must have been issued, any quality review must be cleared, and a retention rule must exist.

Once the file is locked, changes can only be added as addenda. Unlocking needs a second partner or the quality reviewer, so no single person can reopen a file quietly. That matches what an inspector expects to see: a closed file, with any later additions visible as additions.

The archive and its hash manifest

Each locked audit file is built into an archive of its working papers, workbooks, signed report and logs, with a hash manifest that can be re-verified later. If a file in the archive were altered, the manifest would no longer match.

The archive lives under DOCUMENTS > Archived Audit Files. Only a partner, a manager or the quality reviewer can download it. Anything that could not be included is listed as an omission, which is far better than discovering a gap during an inspection. Read the omissions list when the archive is built and deal with each item while the team still remembers it.

Where the rule is kept and who changes it

Achekam's rule book holds IRBA's Rule 4 as an approved rule and uses it to set each file's retention date. A firm's partners and administrators can read the approved statutory rules Achekam's decisions use, including audit-file retention, with their change log, under QUALITY & GOVERNANCE > Regulatory Rule Book. Only Achekam's platform administrators change them, never one person alone.

At the end of the retention period, disposal is also controlled. Achekam disposes of a governed record only after its retention period has ended and no legal hold applies, with three different people requesting, reviewing and approving. The disposal certificate keeps proof that the disposal happened but not the content. Legal holds and disposal sit under QUALITY & GOVERNANCE > Record Governance.

A file-assembly checklist

1. Clear every review note before the report is dated, not after.
2. Make sure any named quality reviewer has cleared the report.
3. Record the report as issued on its report date.
4. Diary the end of the 60 days at once, with a named owner.
5. File confirmation replies, final lead schedules and signed letters during assembly.
6. Have the engagement partner lock the file well inside the window.
7. Read the archive's omissions list and resolve each item.
8. Add anything later only as an addendum, with the reason.
9. Check the retention date shown against the rule book.

Closing the loop on this year's files

Look at the audits issued in the last two months and check, for each, that issue was recorded on the report date and that the file is locked or on track to be. Then make the 60-day date part of the completion meeting rather than an afterthought. More detail on the archive itself is in audit file assembly and archive, and work sent to another firm for review is covered in independent review by another firm.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.