Being ready for an audit is a retrieval problem

Organisations in the UAE face several kinds of scrutiny: tax authority reviews, sector regulator inspections, external financial audits, certification surveillance audits and client due diligence. They ask different questions, but they test the same underlying capability. Can you produce the records that support what you have stated, quickly, and can you show that nothing is missing.

A note on scope before going further. Retention periods and the legal status of digital copies vary by sector and by record type, and they are matters for your own legal or compliance adviser. This page deals with the operational side: making records findable, complete and evidenced.

What is actually being tested

An auditor rarely reads an entire archive. They sample, and the sample tests the system rather than the document. Three things get judged.

• Availability. The requested item is produced within a reasonable window. Repeated delays turn a narrow sample into a wider one.
• Completeness. The set produced is demonstrably the whole set, not the part that was easy to find. This is harder than availability and it is where most organisations are weakest.
• Integrity. The record is what it was when created, and any change is visible and attributable.

Speed matters more than it should, for a human reason. An auditor who receives requested items promptly and completely forms a view about the control environment before examining anything in detail. An auditor who waits a week for a file from a storeroom forms a different one, and tends to look harder.

Retrieval under time pressure

Audit requests do not arrive in the shape your filing system expects. They come as attributes: everything relating to this supplier for this period, all agreements signed by this entity, every version of this policy. A folder structure organised by department and year answers none of those without someone opening a lot of files.

This is why index design deserves an audit lens. When agreeing index fields, run past requests through them. Take three requests you have actually received, and check whether the proposed fields would answer each one with a single search. If not, either the fields are wrong or the retrieval will be manual, and manual retrieval under audit pressure is where errors and omissions happen.

Worth capturing in most archives: counterparty or entity, document type, date, reference number, the internal owner, and the period or financial year the record belongs to. That last one is frequently omitted and frequently exactly how a request arrives.

Evidencing completeness

Producing documents is straightforward. Proving that you produced all of them is the part organisations struggle to answer, because absence leaves no trace. Completeness is not something you assert at the end; it is something built during digitization and then reported.

1. 1Count at the source. A box manifest recording department, category, date range and a consistent count, created before anything moves.
2. 2Reconcile at every handover. Counts at collection, at receipt, at capture and at load, with discrepancies explained rather than absorbed. A number that changes silently between two stages is the thing you will be unable to explain later.
3. 3Keep an exceptions log. Documents that were illegible, unidentifiable, damaged or deliberately excluded, each with a reason and a decision. A known, documented gap is defensible. An unexplained one is not.
4. 4Preserve sequence evidence. Where records carry their own numbering, such as invoice or voucher sequences, reconciling against that sequence is stronger evidence of completeness than any count, because it shows what should exist rather than what was found.
5. 5Report it once, formally. A closeout report stating what was digitized, from where, in what condition, with what exceptions, is the document you hand an auditor when they ask how you know this is everything.

Integrity and the trail around the record

Once records are digital, the questions shift from the storeroom to the system. Who can view a record, who can change or delete one, is version history retained, are access events logged, and can a deletion be attributed to a person and a date. A digitised archive sitting on an open shared drive with no logging answers none of these, which is why the destination system matters as much as the scanning.

Keep the scanned image as the evidential record. OCR text and extracted index data are access aids and can contain errors; the image is what was on the paper. When an extracted value and the image disagree, the image governs, and any process built on the data should be able to fall back to it.

A readiness checklist

1. 1Take your three most recent audit or inspection requests. Can each be answered by a single search in the current system? If not, that is your index gap.
2. 2Pick a record category and try to state, with evidence, that the digital set is complete. If you can only assert it, build the reconciliation.
3. 3Confirm your retention schedule with your own advisers, then check that the schedule is actually enforced somewhere rather than living in a policy document.
4. 4Test permissions as an ordinary user, not as an administrator. Administrators see everything and therefore test nothing.
5. 5Check that access and deletion events are logged, and that someone would notice.
6. 6Name the person who produces records during an audit, and the deputy who does it when that person is on leave.
7. 7Run a rehearsal. Request twenty records across categories on a short deadline and time it. The result tells you more than any policy review.