Getting ready for an IRBA inspection

How a South African audit firm can prepare its audit files, archives, quality records and practitioner records before IRBA inspects its work.

By Achekam · 11 October 2026 · 4 min read · For Accountants & audit firms in South Africa

An IRBA inspection does not test how hard the firm worked in the weeks before the inspectors arrived. It tests the files as they stood when the reports were signed, and the firm's system of quality management as it actually ran during the year. Anything added afterwards shows as added afterwards.

That is why the best preparation is unglamorous: files assembled on time, locked and archived; quality records kept as events happened; practitioner records that show who was entitled to sign and when that was checked. This article goes through each, with the parts Achekam keeps for you and the parts it does not.

What inspectors look at

In South Africa, the Independent Regulatory Board for Auditors regulates auditors, and its auditing standards follow the IAASB's. IRBA's page on inspections explains how it inspects registered auditors under section 47 of the Auditing Profession Act, including inspecting auditors of public companies at least every three years.

Expect attention at two levels. At firm level, inspectors look at the system of quality management under ISQM 1: the risk assessment, the responses, monitoring and remediation, and leadership's evaluation. At engagement level, they select audit files and test them against the ISAs: whether the evidence supports the opinion, whether significant judgements are documented, and whether review happened before the report was signed.

Files assembled and locked on time

IRBA Board Notice 512 of 2023, Rule 4, requires the final engagement file to be assembled within 60 days of the report date and kept for at least five years, for audits of periods beginning on or after 15 December 2024. Achekam's rule book holds this rule as approved and uses it for the retention date. Partners and administrators can read the approved rule, with its change log, in the Regulatory Rule Book.

After the report is issued, the engagement partner assembles and locks the audit file. From then on, changes can only be added as addenda, and unlocking needs a second partner or the quality reviewer. Completion cannot be forced through with an unissued report, an uncleared quality review or a missing retention rule.

Before an inspection, run a simple check across the files from the inspection period:

1. Each issued report has a locked file.
2. The lock date falls within the period the rule allows after the report date.
3. Any changes after locking are addenda, each with its reason.

Files that fail the second test need an explanation ready, not a quiet fix. Audit file assembly and IRBA retention explains the rule in more detail.

Archives that can be re-verified

Each locked audit file is built into an archive of its papers, workbooks, signed report and logs, with a hash manifest that can be re-verified. Anything that could not be included is listed as an omission. Only a partner, a manager or the quality reviewer can download it.

Re-verifying an archive shows that the file an inspector receives is the file that was locked. Download the archives of the files most likely to be selected, confirm each one verifies, and read its omissions list. An omission discovered by the firm in advance is a matter to explain; one discovered by the inspector is a finding.

Quality registers and inspection progress

The firm's quality registers, among them professional judgements, quality incidents, complaints and inspection progress, are kept on Achekam's server with every version and who changed it. Bring them up to date before the inspection, not by rewriting history, but by adding what is missing.

Inspectors will want to see what the firm did with earlier findings. Use the inspection progress register to show each previous finding, its root cause, the remedial action, its owner and the evidence that it worked.

One limit to address yourself: sign-off roles on professional judgements are checked only by the screen, not by the server. As part of your monitoring, confirm that the significant judgements on the files likely to be inspected were signed off by someone with the authority your policy requires. Setting up ISQM 1 in a small firm covers the wider system.

Practitioner records

Inspectors will check that the people who signed were registered auditors when they signed. Achekam can hold the records, but it does not make the check for you.

Under TEAM > Practitioner Credentials, a partner, manager or administrator records each practitioner's professional body, membership standing with the date it was verified, and practising authority, with evidence. A credential someone recorded about themself is flagged.

Know the limits. For a South African firm, Achekam does not check the credentials register when a partner approves an audit report or signs financial statements; signing needs only the Partner role. The "IRBA" badge on Partner Review & Signing is a label: Achekam checks the signer's partner role, not IRBA registration. So keep the dated evidence of each signing partner's registration yourself, and check it against IRBA's register at least before each signing season. IRBA registration and signing checks sets out what to verify.

A readiness table

Three months out

Pick the files from the most recent year most likely to be selected, verify their archives, and check their lock dates. Update the registers with every finding and remediation since the last inspection, and refresh the dated evidence for every signing partner.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.