Proving which version was signed and issued

How a firm can show which version of a set of statements the client approved, the partner signed and the firm issued, using fingerprints and frozen copies.

By Achekam · 11 October 2026 · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

Months after a set has gone out, someone asks a pointed question. The bank holds a copy with a different loan balance from the one in the firm's file. The client says it never approved the going concern wording. An inspector wants to know whether the version the partner signed is the version that was filed. Each question comes down to the same thing: which version?

Year end produces many versions of the same statements. Drafts go back and forth, figures change late, PDFs are downloaded and forwarded. Without a reliable link between each approval or signature and the exact content it relates to, the firm is left reconstructing events from e-mail. This article explains the records Achekam keeps and how they combine into an answer.

Why versions get confused near year end

The causes are familiar:

• a draft PDF downloaded for discussion is forwarded and treated as final;
• the client approves a draft, then a late adjustment changes a figure;
• the partner signs on one day and a typo is fixed the next;
• a practitioner's report ends up attached to statements that changed after it was written.

Each is innocent on its own. Together they make it impossible to say what was approved, signed and issued, unless the records tie each step to specific content.

File names do not help. "AFS final", "AFS final v2" and "AFS final signed" tell a reader only that someone thought each one was the last. Dates on e-mails show when a file was sent, not what was in it. What the firm needs is a property of the content itself, recorded at the moment each person acted, so that the question "was it this one?" has a yes or no answer.

The fingerprint on the issued PDF

The anchor is the issued set. Staff can download statements as an A4 PDF made on Achekam's server at any stage, but issuing is different: it stores the final PDF with a fingerprint and locks that version.

A fingerprint is a value calculated from the exact content of a file; change anything and the value changes. The stored fingerprint therefore lets anyone test whether a PDF in circulation is the one the firm issued. A copy of the issued file, unaltered, carries the same fingerprint. A draft download forwarded by a client will not, which is precisely the point.

Locked means what it says. Later work on the engagement, a rebuild after a correction for instance, does not change the issued version. If the statements have to change, a new version is issued.

Partner signatures bound to a content hash

The partner's signature is the next link. In the Partner Signing Cockpit, a partner signs the firm's financial statements, and the signature is bound to that version's content hash. A signature recorded against one version cannot be carried across to different content.

Note what the cockpit leaves to the partner: it asks the partner to confirm acceptance and independence outside Achekam. Those confirmations belong in the engagement file, dated before the signature.

Reports bound to the version they cover

Where a practitioner reports on the statements, the report is tied to content as well:

• Audit reports prepared in Achekam. The partner can record the approved audit report as issued, which binds the statements' fingerprint and starts the file-assembly clock.
• Reviews and audits by another firm. A firm can send a frozen set to another firm on Achekam, or to an outside practitioner by e-mailed link, for an independent review under ISRE 2400 (Revised) or an audit, and the reviewer's signed report is bound to that version.

That binding answers the question every audit or review file must be able to answer: what exactly did the report cover? Documentation requirements for audits are set by ISA 230, which sits with the other ISAs and the ISQMs in the complete text the IAASB publishes in its 2026 Handbook of international pronouncements.

The client's approval of a frozen copy

Two more records close the loop on the client's side.

Approval of the draft. The client receives a link to a frozen copy of the draft statements, where they can comment, confirm or ask for changes. Because the copy is frozen, the approval relates to defined content.

Signatures by directors or trustees. When a document is e-signed through Achekam, the signed PDF comes with a completion certificate listing each signer's e-mail, times, IP address and browser, and the document's fingerprint, and it is filed in the client's "Signed documents" folder.

Put together, the trail for one set looks like this:

The records are only as useful as the discipline around them. A few habits make the trail hold together:

1. Send nothing for approval or signature that is not the version you intend to issue; if anything changes afterwards, repeat the step.
2. Never send draft downloads to third parties; send the issued PDF.
3. When an outside party queries a copy, compare it with the issued version before discussing its content.
4. Keep a one-line note on the file listing the date of each step in the table.

When the question comes, months later, the answer is then a matter of reading the file rather than searching inboxes. Locking and issuing are covered in issuing statements: the final PDF and a locked version, and directors' signatures in directors signing the approved statements by link.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.