Locking the audit file and building the archive
What happens to an audit file in Achekam after the report is issued, from assembly and lock to the archive's hash manifest and eventual disposal.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Once the auditor's report is signed, attention moves to the next client, and the file of the last one quietly stays open. A senior tidies a lead schedule weeks later. A manager adds a memo that "should have been there". Months afterwards, nobody can say which papers existed on the report date and which were improved after it, which is precisely the question an inspector asks.
ISA 230 expects the final audit file to be assembled on a timely basis after the date of the auditor's report, and after that, nothing deleted or discarded before the end of the retention period, with any later addition documented. This article follows an audit file in Achekam from the moment the report is issued to the day it may lawfully be destroyed.
The clock starts when the report is issued
When the partner records the auditor's report as issued, Achekam binds the statements' fingerprint to the report and starts the file-assembly clock. From that point the engagement is in its assembly period.
For South African audits, IRBA Board Notice 512 of 2023, Rule 4, requires the final engagement file to be assembled within 60 days of the report date and kept for at least five years, for audits of periods beginning on or after 15 December 2024. Achekam's rule book holds this rule as approved and uses it for the retention date. The South African rule is covered in more depth in audit file assembly and IRBA retention.
Nigerian and Kenyan firms should take their assembly and retention periods from their own regulator's requirements and the firm's quality policies. Partners and administrators can read the approved statutory rules that Achekam's decisions use, with their change log, under Quality & Governance, Regulatory Rule Book. Only Achekam's platform administrators change those rules, never one person alone.
Assembling and locking
Under Audit & Assurance, Completion, the engagement partner assembles and locks the audit file after the report has been issued. Three conditions cannot be overridden at this stage: the report must have been issued, any engagement quality review must have been cleared, and a retention rule must exist for the file.
After the lock, changes can only be added as addenda. That is the behaviour ISA 230 describes: the file as it stood is preserved, and anything added later sits alongside it as a separate, dated record rather than an edit to the original. The full text of ISA 230 is in the IAASB's 2026 Handbook, available from its download page.
Unlocking needs a second person
Sometimes a locked file genuinely has to be reopened, for example because a regulator's query reveals a paper filed in the wrong engagement. Unlocking needs a second partner or the engagement quality reviewer. The engagement partner cannot reopen their own file alone.
Treat every unlock as an event worth documenting in its own right: the reason, who asked, who agreed, and what was changed before the file was locked again.
The archive and its hash manifest
Each locked audit file is built into an archive of its working papers, workbooks, signed report and logs. The archive comes with a hash manifest: a list of every item with a fingerprint calculated from its content. The manifest can be re-verified at any time, which shows whether anything in the archive has changed since it was built.
Anything that could not be included is listed as an omission rather than silently left out. Read that list when the archive is built; an omission discovered years later, during an inspection, is much harder to explain.
Only a partner, a manager or the quality reviewer can download an archive. Archives are found under Documents, Archived Audit Files.
Disposal at the end of retention
At the end of the retention period, a file is not simply deleted. Achekam disposes of a governed record only after its retention period has ended and no legal hold applies, and three different people are involved: one requests the disposal, one reviews it and one approves it. The disposal certificate keeps proof that the disposal happened, but not the content.
Legal holds matter here. If a client is in litigation, under investigation, or the subject of a regulator's enquiry, place the hold before anyone considers disposal. Holds and disposal are managed under Quality & Governance, Record Governance.
The life of a file, in order
| Stage | Who acts | What Achekam does |
|---|---|---|
| Report recorded as issued | Engagement partner | Binds the statements' fingerprint, starts the assembly clock |
| Assembly and lock | Engagement partner | Refuses if the report is unissued, the quality review uncleared or no retention rule exists |
| After lock | Engagement team | Accepts addenda only |
| Unlock | Second partner or quality reviewer | Refuses an unlock without one of them |
| Archive | Partner, manager or quality reviewer downloads | Builds the archive with a hash manifest and lists omissions |
| Disposal | Three different people | Only after retention ends with no legal hold; certificate keeps proof, not content |
A completion checklist for the partner
- Record the report as issued on the day it is signed, so the assembly clock starts on the right date.
- Diary the assembly deadline that applies to the engagement.
- Clear any outstanding papers, then assemble and lock before the deadline.
- Read the archive's omissions list and resolve what can be resolved.
- Re-verify the hash manifest when the archive is first built, and note that you did.
- Place a legal hold the moment a dispute or enquiry arises.
How the report reaches the point of issue is described in drafting and approving the auditor's report.
The habit to build
Lock the file when the work is finished, not when the deadline arrives. A file locked soon after the report, with nothing added since, tells a reviewer more about your firm's discipline than any policy document.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
