Audit
What 'Audit-Ready' Actually Means for Your Client Communication
Evoke LedgerBridge Editorial | 4/9/2026 | 6 min read
If you were asked today to produce a complete record of every document you requested from a specific client in the past 18 months — what you asked for, when you asked for it, what was submitted, when it was received, who reviewed it, what queries were raised, and when approvals were given — how long would that take? For most accounting firms, the answer is somewhere between "several hours" and "not possible with confidence." That is not an audit-ready communication record. It is a reconstruction exercise, and the difference matters more than most firms currently appreciate.
The Real Cost of the Current Approach
The concept of audit readiness is usually applied to financial records: the supporting documents, working papers, and calculations that underpin a set of financial statements or a tax submission. The communication record around those documents — who asked for what, who approved what, who was notified — is treated as secondary, if it is treated at all.
Three separate pressures are closing this gap: professional standards, POPIA, and increasing client sophistication.
From a professional standards perspective, accounting firms operating under SAICA or IRBA guidelines have obligations around engagement documentation that extend beyond financial working papers. The engagement record should include evidence that the client was appropriately informed, that professional judgments were based on information the client provided, and that approvals were obtained before material submissions were made. A communication record living in a personal email inbox does not meet this standard reliably.
From a POPIA perspective, the communication record is also a personal information record. Firms that cannot account for where client communication was stored, who accessed it, and how long it has been retained are exposed under the Act regardless of the quality of their financial working papers.
From a client relationship perspective, the communication record is increasingly the surface on which disputes are resolved. When a client questions a submission, challenges a fee, or raises a concern about what they were told at a particular point in an engagement, the communication record is the evidence base.
What a Better Operating Model Looks Like
An audit-ready communication record has four characteristics: it is complete, timestamped, accessible, and untampered with.
Complete means every material interaction between the firm and the client is captured — every document request, every reminder, every submission received, every query raised, every response given, every approval obtained. Completeness is not achievable through email alone, because email records can be deleted, can exist in personal accounts outside the firm's control, and do not automatically link communications to the specific engagement and document they relate to.
Timestamped means every record has an immutable date and time associated with it, not dependent on the sender's or recipient's device clock. A WhatsApp message has a timestamp, but it is stored on a personal device, can be deleted, and cannot be extracted in a format useful for professional review. A portal communication with a server-side timestamp is a different category of record.
Accessible means the record can be retrieved quickly and completely for any client, without searching personal email accounts or depending on a specific staff member still being employed.
Untampered with means the record is stored in a system that does not allow retroactive editing. Email does not meet this standard.
A Framework for Getting This Right
Select three client engagements at random and attempt to reconstruct the full communication record for each. Try to answer: What was the first document request made? When? What was submitted in response? What queries were raised and answered? What approvals were obtained? The gaps in your answers identify your exposure.
Identify which communication channels are outside your firm's control. Personal email accounts, WhatsApp on personal devices, and text messages sent from personal phones are all outside your control environment. Any communication not accessible through a firm-level system is a gap.
Assess your current retention practice. How long are client communication records retained? Is there a defined policy that is actually applied? For professional liability purposes, a record that no longer exists is as problematic as one never made.
Define the minimum communication record standard for each engagement type. Bookkeeping, tax return, and audit-adjacent engagements have different record-keeping requirements. Define what the minimum acceptable record looks like for each type.
What This Looks Like Inside a Purpose-Built Platform
Evoke LedgerBridge captures every communication event automatically as part of the engagement record. Every document request issued, every reminder sent, every document received, every query logged, every approval given is stored with a server-side timestamp, linked to the specific engagement and task, and accessible to the firm immediately and permanently.
For firms working through the specifics of what this record should contain, the article on audit-ready client communication logs covers the detailed requirements. For document retention obligations under South African law, document retention and POPIA for accountants is the relevant reference.
Common Mistakes Firms Make When Addressing This
The first mistake is conflating file storage with communication records. Storing client documents in a well-organised folder does not produce a communication record. The documents and the communication around them are different things.
The second mistake is assuming the communication record only matters when something goes wrong. The communication record is also a daily operations tool — firms that can review the full engagement history for any client are better positioned to manage complex engagements and onboard new staff.
The third mistake is underestimating how quickly the adequacy standard for communication records is shifting. Three years ago, a well-maintained email archive was a reasonable professional standard. POPIA enforcement, increasing professional liability claims, and the expectations created by digital-first business practices are all pushing that standard higher.
The risk of staying with your current approach is not that a complaint will definitely find your records inadequate. It is that if one does, you will have no effective answer.
If your firm is ready to move past inadequate communication records and build a genuinely audit-ready practice, Evoke LedgerBridge was built for exactly this.
Book a demo or chat on WhatsApp to see how it fits your delivery model.