For many Kenyan business owners, directors and finance managers, the word "audit" carries a mix of anxiety and obligation. It can feel like an annual inspection to be endured, a box to be ticked so that a bank, a regulator or a donor will keep its doors open. Yet a financial statement audit is one of the most useful instruments a serious organisation can invest in. Done well, it does far more than satisfy a compliance requirement. It builds trust with the people who put their money, their goods and their reputations behind your business, and it gives you an independent, expert read on how sound your numbers and systems really are.
This guide sets out, in plain language, what a financial statement audit actually is, who in Kenya is likely to need one, what value it delivers, and how the process works from start to finish. It also gives you a practical checklist so you can prepare properly, avoid the common pitfalls that slow audits down, and get the most out of the exercise. Whether you run a private limited company, manage an NGO, lead a SACCO, sit on a school board of management or simply want to understand what your auditor is doing and why, the aim here is to leave you better informed and more confident.
A quick note on accuracy before we begin. Regulatory thresholds, statutory deadlines and specific rules change over time and can differ by sector. Throughout this article we describe requirements at a conceptual level rather than quoting figures or dates that may be out of date by the time you read this. For anything that turns on a precise threshold or deadline, confirm the current position with a qualified professional or the relevant authority.
A financial statement audit is an independent examination of an organisation's financial statements by a qualified, external auditor. The purpose is to allow the auditor to express a professional opinion on whether those financial statements give a true and fair view of the organisation's financial position and performance, and whether they have been prepared in accordance with the applicable financial reporting framework. In Kenya, that framework is usually International Financial Reporting Standards (IFRS) or, for smaller entities, the IFRS for SMEs.
The key words in that description are "independent" and "opinion". The auditor is not part of your management team and does not prepare your accounts. Their job is to stand back, gather sufficient and appropriate evidence, and then form a view that others can rely on. That independence is what gives an audit its value. A set of financial statements prepared by management and blessed by management alone is only as trustworthy as management's own honesty and competence. Once an independent auditor has examined them and attached an opinion, external parties have a credible, third-party assurance to lean on.
It is important to understand what an audit opinion is, and just as importantly, what it is not. An audit opinion is a reasonable assurance conclusion. Reasonable assurance is a high level of assurance, but it is not absolute. Auditors do not, and cannot, examine every single transaction. They use sampling, professional judgement and risk assessment to gather enough evidence to be reasonably confident that the financial statements are free from material misstatement, whether that misstatement is caused by fraud or by error.
"Material" is another term worth pausing on. A misstatement is material if it could reasonably be expected to influence the decisions users make on the basis of the financial statements. Auditors set a materiality level during planning and focus their effort on matters that could cross that threshold. A tiny, isolated error that no reasonable user would care about is not the point of an audit; errors, omissions or manipulations large enough to mislead are.
An audit opinion is not a guarantee that the financial statements are perfect, nor a certificate that the business is healthy or well managed. It is a professional, evidence-based conclusion that the statements, taken as a whole, are free from material misstatement and fairly presented in accordance with the applicable framework.
An audit also does not primarily exist to detect every instance of fraud, although auditors are required to consider fraud risk and to remain alert to it throughout. The primary responsibility for preventing and detecting fraud rests with the organisation's management and those charged with governance, such as the board of directors. The auditor's role is to design their work to obtain reasonable assurance that the financial statements as a whole are not materially misstated, including by fraud.
Not every engagement with an accountant is an audit, and the differences matter. When you approach a professional firm, you may be offered, or may actually need, one of several different services. Choosing the right one saves money and avoids misunderstandings with the parties relying on your accounts.
An audit, as described above, provides reasonable assurance, the highest level of assurance available in these engagements. The auditor performs extensive procedures: assessing risk, evaluating internal controls, testing transactions and balances, obtaining external confirmations, inspecting documents and much more. The output is a formal opinion expressed with positive language, for example that the financial statements "present fairly, in all material respects" the financial position of the entity. Because of the depth of work involved, an audit is the most rigorous and typically the most costly of the three.
A review provides limited assurance, sometimes called moderate or negative assurance. The practitioner performs fewer procedures than in an audit, relying more heavily on inquiry of management and analytical procedures such as comparing balances and ratios over time and investigating anything unusual. Rather than positively stating that the statements are fairly presented, the practitioner concludes in negative terms, for example that "nothing has come to our attention" to suggest the statements are not prepared, in all material respects, in accordance with the framework. A review is lighter, faster and cheaper than an audit, and can be appropriate where a full audit is not required but some independent comfort is still wanted.
A compilation provides no assurance at all. Here the accountant simply uses their expertise to assemble financial information provided by management into the form of financial statements. They do not test it, verify it or vouch for it. A compilation is useful for organisations that need well-presented statements but do not have the in-house capacity to prepare them, and where no external party is demanding independent assurance. Because no assurance is given, a compilation cannot substitute for an audit where an audit is genuinely required.
In short, think of these three as a ladder of assurance. A compilation puts the numbers in order; a review casts a professional eye over them and flags anything that looks off; an audit digs in with evidence and testing and stands firmly behind a positive opinion. If a lender, regulator or donor specifically asks for "audited financial statements", a review or compilation will not meet that requirement.
The question of who is legally required to have an audit, and who simply benefits from one, comes up constantly. The honest answer is that it depends on your legal form, your size, your sector and, very often, on the demands of the people you deal with. What follows is a general overview. Because the specific rules and any size thresholds can change, treat this as a map rather than a rulebook, and confirm your exact obligation with a professional.
Companies incorporated in Kenya are governed by the Companies Act, which sets out directors' responsibilities for keeping proper accounting records and preparing financial statements. Many companies are required to have their financial statements audited, although the law contemplates that certain smaller companies may, subject to conditions, be exempt from a mandatory statutory audit. Whether your company qualifies for any such exemption depends on criteria that can include size and the nature of the business, and these criteria are exactly the kind of detail that can change over time. Even where an exemption is available, a company's own shareholders, or a minority of them, may still be entitled to require an audit, and the directors may choose to have one regardless.
The practical point is this: do not assume you are exempt, and do not assume you are caught. Establish your company's position deliberately, in writing, with reference to the current rules, and revisit that position as your business grows.
Non-governmental organisations, trusts, societies and other non-profit bodies frequently have to produce audited financial statements, both because of the regulatory regime that governs them and because of the expectations of their funders. Donors and grant-makers almost universally require audited accounts as a condition of funding, and many will also require project-specific or grant-specific audits in addition to the annual organisation-wide audit. For NGOs, an audit is often the single most important instrument for demonstrating that funds were used for their intended purpose.
Savings and credit cooperative organisations and other cooperative societies operate under a regulatory framework designed to protect members' funds. Audit and reporting obligations are a core part of that framework, and regulators take them seriously because SACCOs hold money on behalf of their members. If you manage a SACCO, an audit is not merely good practice, it is central to your licence to operate and to the confidence of your membership.
Schools, colleges and other educational institutions, whether run by boards of management, trusts or private companies, are commonly expected to have their accounts audited. Parents, sponsors, boards and, where applicable, government bodies all have an interest in knowing that fees, grants and other funds are properly accounted for. An audit provides that reassurance and helps boards discharge their stewardship duties.
Beyond any statutory requirement, a very common trigger for an audit is a demand from a third party. Consider the following situations:
In all these cases, an audit may be voluntary in the strict legal sense but effectively unavoidable in commercial terms. If the people you need to do business with require audited accounts, then you need an audit.
It is worth reframing the audit not as a cost imposed from outside but as an investment that returns real value. The benefits fall into several categories, and mature organisations come to rely on them.
The most direct benefit is credibility. Audited financial statements carry weight precisely because an independent expert has examined and stood behind them. This credibility opens doors: with banks, investors, donors and regulators, with suppliers who may extend credit and with customers who want to know they are dealing with a stable partner. In a market where trust is hard-won, an audit is a powerful signal of seriousness.
Audited accounts are frequently a precondition for accessing loans, attracting investment, receiving grants and winning tenders. An organisation that can produce clean, timely audited financial statements is able to compete for opportunities that are closed to those that cannot, and over time that access can be the difference between growth and stagnation.
While detecting every fraud is not the primary purpose of an audit, the fact of an annual independent examination is a strong deterrent. Employees and managers who know that transactions and balances will be scrutinised by an outside party are far less likely to attempt fraud, and the weak spots that fraudsters exploit are more likely to be identified and closed. An auditor's fresh perspective often surfaces risks that insiders have stopped noticing.
During an audit, the auditor evaluates aspects of your internal control environment and communicates any weaknesses to management, usually in a management letter with practical recommendations. This feedback is genuinely valuable: it can point to gaps in segregation of duties, weaknesses in authorisation, poor record-keeping or reconciliation practices, and opportunities to strengthen controls before they cause losses. Many organisations find that acting on the management letter improves their operations year after year.
Reliable numbers are the foundation of good decisions. When directors and managers know their financial statements have been independently verified, they can plan, budget and invest with greater confidence. For boards, an audit is a key tool of governance and oversight, helping them hold management to account and demonstrate to members, shareholders or the public that they are exercising proper stewardship. In effect, it is an annual health check: the opinion tells the outside world your statements can be relied upon, and the management letter tells you where to improve.
Audits in Kenya are not carried out on an ad hoc basis. They are governed by a structure of standards and professional bodies that exists to ensure quality, consistency and integrity, and understanding it helps you appreciate why auditors do what they do.
Audits are conducted in accordance with International Standards on Auditing, a comprehensive set of standards issued by the International Auditing and Assurance Standards Board and adopted for use in Kenya. The ISAs govern how audits are planned and performed: how the auditor assesses risk, gathers evidence, evaluates internal controls, uses sampling, documents their work, communicates with those charged with governance and forms and expresses their opinion. When your auditor tells you they are following professional standards, the ISAs are the backbone of what they mean.
ICPAK, the Institute of Certified Public Accountants of Kenya, is the professional body for accountants and auditors in the country. It oversees the qualification, registration and professional conduct of Certified Public Accountants, sets and enforces ethical standards, provides continuing professional development and carries out quality reviews. When you engage a registered audit practitioner, you are engaging someone who is subject to ICPAK's standards and discipline, which is an important safeguard of quality and ethics. Only appropriately qualified and registered practitioners are permitted to carry out statutory audits.
While the ISAs govern how the audit is done, the financial statements themselves are prepared under a financial reporting framework. In Kenya this is generally International Financial Reporting Standards for larger and more complex entities, and the IFRS for SMEs for smaller entities that qualify to use it. These frameworks set out how transactions and balances should be recognised, measured, presented and disclosed. The auditor's opinion is framed by reference to the applicable framework, which is why identifying the correct framework for your entity is one of the first things to get right. Certain regulated sectors may also be subject to additional or sector-specific reporting requirements layered on top of the general framework.
Understanding the flow of an audit takes much of the mystery out of it and helps you cooperate effectively. While every firm has its own methodology, a typical audit moves through the following broad stages.
The audit begins before any testing takes place. The auditor and the client agree the terms of the engagement, usually in an engagement letter that sets out the scope, responsibilities, timing and fees. The auditor then plans the audit, developing an understanding of the business, its industry and its regulatory context. Planning is not a formality: a well-planned audit focuses effort where the risks are, which makes it both more effective and less disruptive to you.
During planning and into early fieldwork, the auditor performs a risk assessment, identifying where the financial statements are most likely to be materially misstated through error or fraud. They consider factors such as the complexity of transactions, the reliability of systems, the possibility of management override of controls and the pressures the business faces, and they set materiality. The output is an audit strategy that directs resources towards the highest-risk areas rather than spreading effort evenly and thinly.
The auditor develops an understanding of the internal controls relevant to financial reporting. In some audits they will test whether those controls operated effectively throughout the period, which, if the controls are strong, can reduce the amount of detailed testing required. Where controls are weak or cannot be relied upon, the auditor compensates by doing more substantive testing of the underlying transactions and balances. Either way, the evaluation of controls is a core part of the work and often the source of the recommendations you receive at the end.
This is the stage most people picture when they think of an audit. The auditor gathers evidence to support the figures in the financial statements. Techniques include:
Because auditors use sampling rather than checking everything, the quality and completeness of your records has a direct effect on how smoothly this stage goes. Well-organised, reconciled records make fieldwork faster and cheaper. Missing or disorganised records slow everything down and can even prevent the auditor from obtaining the evidence they need.
Once fieldwork is complete, the auditor evaluates the evidence gathered, resolves outstanding queries, considers the adequacy of disclosures, assesses the entity's ability to continue as a going concern, and considers events occurring after the reporting date that may affect the statements. Any misstatements identified are discussed with management, and management decides whether to adjust the financial statements. Uncorrected misstatements are evaluated to see whether, individually or together, they are material. The auditor also obtains written representations from management on certain matters.
Finally, the auditor forms and expresses their opinion in the auditor's report, which accompanies the financial statements. Alongside the formal report, the auditor usually communicates with those charged with governance about significant findings, and issues a management letter setting out control weaknesses and recommendations. This is the stage where the value of the whole exercise crystallises: an opinion the outside world can rely on, and constructive feedback you can act on.
Preparation is the single biggest factor within your control that determines whether an audit is smooth or painful, and cheap or expensive. Auditors bill for their time, and time spent chasing you for documents or fixing records that should have been complete is time you pay for. The organisations that get the most from their audits, at the lowest cost and least disruption, are invariably the best prepared.
The foundation of good preparation is a clean, complete and reconciled set of accounting records. Before the auditor arrives, make sure your bank accounts are reconciled to your ledgers, your control accounts agree to their supporting schedules, and your trial balance actually balances and ties to draft financial statements. Reconciliations that are up to date and free of unexplained differences will save enormous amounts of time.
Auditors will ask for evidence to support the figures. Having this ready in advance, ideally organised and indexed, transforms the experience. Prepare schedules that break down major balances and reconcile them to the ledger, and gather the underlying documents that support them.
Assign a knowledgeable member of your finance team to be the auditor's main point of contact, someone who can answer questions and locate documents quickly. Agree a realistic timetable with the auditor in advance, including the fieldwork dates and the target date for the signed report, and make sure key people will be available and not on leave during fieldwork.
If you already know there is a problem, a difficult judgement, a dispute, a possible impairment, a related-party transaction or an uncertainty about going concern, raise it with your auditor early rather than hoping it will go unnoticed. Early discussion gives everyone time to gather evidence and reach a well-supported conclusion, and it avoids last-minute surprises that delay the report.
Use the following checklist as a practical starting point. Your auditor will usually provide a tailored request list as well, but having these items ready before the audit begins will put you well ahead.
Knowing what tends to attract an auditor's attention helps you prepare more effectively and, over time, run a tighter operation. Broadly, auditors look for evidence that the figures are complete, that they exist, that the organisation actually owns what it claims to own, that items are valued correctly and that everything is properly presented and disclosed.
In practice, certain issues come up again and again across Kenyan organisations of all kinds. Being aware of them lets you address them before the auditor does.
None of these issues is fatal if handled properly. The organisations that fare best are those that treat each year's findings as a to-do list for the year ahead, steadily strengthening their systems so that the same problems do not recur.
The auditor's report ends with an opinion, and the type of opinion given matters a great deal to the people who read it. There are four main outcomes, and it is worth understanding each in plain terms.
An unqualified opinion, often called a clean opinion, is the best outcome. It means the auditor concluded that the financial statements give a true and fair view and are prepared, in all material respects, in accordance with the applicable framework. There are no material problems the auditor needs to flag through a modification. This is the opinion every organisation should aim for, and the one that lenders, donors and investors want to see. Note that an auditor can issue a clean opinion and still draw attention to important matters through an emphasis of matter paragraph, which highlights something already disclosed in the statements without changing the opinion itself.
A qualified opinion means the financial statements are fairly presented "except for" a specific matter. The auditor issues a qualified opinion when there is a material misstatement that is confined to a particular area, or when they were unable to obtain sufficient evidence about a particular area, but in either case the issue is not so pervasive that it undermines the statements as a whole. A qualified opinion is a warning sign: it tells readers that most of the statements can be relied upon, but there is a defined problem they should understand. The auditor explains the reason for the qualification clearly in the report.
An adverse opinion is serious. It means the auditor concluded that the financial statements are materially misstated and that the misstatements are pervasive, so much so that the statements as a whole do not give a true and fair view. In effect, the auditor is telling readers not to rely on the financial statements. An adverse opinion is rare, and it signals deep problems that need urgent attention.
A disclaimer of opinion is issued when the auditor is unable to obtain sufficient appropriate evidence, and the possible effects of that limitation are both material and pervasive. Because the auditor simply does not have enough to go on, they decline to express any opinion at all. A disclaimer can arise, for example, where records are so incomplete that the statements cannot be verified, or where significant restrictions were placed on the scope of the audit. Like an adverse opinion, a disclaimer is a strong negative signal.
A clean opinion is the goal. A qualified, adverse or disclaimed opinion is not the end of the world, but it is a clear message that something needs fixing, whether in your records, your controls or your accounting. The right response is to understand exactly why, and to work with your auditor and advisers to put it right for next year.
The value you get from an audit depends heavily on who performs it. Choosing an auditor is not simply a matter of finding the lowest quote. It is about finding a firm that is properly qualified, genuinely independent, experienced in your sector and able to work with you constructively. Consider the following factors.
It is also sensible to think about the broader relationship. Many organisations benefit from working with a firm that offers integrated audit, tax and advisory services, so that insights from the audit can flow into better tax planning and strategic advice, and so that you are not constantly re-explaining your business to different advisers.
It depends on the size and complexity of the organisation, the quality of your records and how well prepared you are. A small, well-organised entity with clean, reconciled records can be audited relatively quickly, while a larger or more complex organisation, or one with disorganised records, will take considerably longer. The single biggest factor within your control is preparation. The better organised your records and schedules, the faster and smoother the audit will be. Agree a realistic timetable with your auditor at the outset and confirm the target date for the signed report.
Audit fees vary with the size and complexity of the organisation, the level of risk, the state of your records and the time required to complete the work. Rather than quoting a figure, a reputable firm will assess your circumstances and give you a clear, transparent quote. Remember that a cheap audit is not necessarily good value: an experienced firm that identifies weaknesses and helps you strengthen your systems can save you far more than the difference in fees. Ask for a written engagement letter that sets out the scope and the basis of the fee.
Possibly, and possibly not. Under the Companies Act, some smaller companies may qualify for exemption from a mandatory statutory audit, subject to conditions, while others are required to have one. The specific criteria can change and depend on your circumstances, so you should confirm your position with a professional rather than assume. Even where an exemption is available, your shareholders may be entitled to require an audit, and you may still need audited accounts for a bank, a donor, an investor or a tender. Many small businesses choose to have an audit voluntarily because of the credibility and improved systems it brings.
The auditor's report is the formal document that accompanies the financial statements and contains the audit opinion, the conclusion the outside world relies upon. The management letter, by contrast, is a separate, more detailed communication to management and those charged with governance. It sets out weaknesses in internal controls, other observations and practical recommendations for improvement. The report is for external readers; the management letter is for you. Both are valuable, and acting on the management letter year after year is one of the best ways to strengthen your organisation.
A qualified opinion is not a catastrophe, but it is a clear signal that something specific needs attention. First, make sure you understand exactly why the opinion was qualified, as the auditor will explain the reason in the report. Then work with your auditor and advisers to address the underlying issue, whether that means correcting a misstatement, improving your records so the necessary evidence exists, or strengthening a control. The goal is to fix the root cause so that you can return to a clean opinion in future periods. Lenders and donors will want to see that you have understood and responded to the qualification.
Independence is central to the value of an audit, and there are ethical rules designed to protect it. There can be threats to independence when the same firm both prepares an organisation's financial statements and audits them, and these threats have to be carefully managed, safeguarded against, or avoided altogether depending on the circumstances and the type of entity. In some cases it is entirely acceptable with appropriate safeguards; in others it is not permitted. A reputable firm will assess independence carefully and tell you honestly what is and is not appropriate for your situation. If you are unsure, ask the firm to explain how they manage independence.
A financial statement audit, approached in the right spirit, is far more than a compliance exercise. It is a way to earn trust, to unlock finance and opportunities, to deter and detect fraud, and to steadily improve the systems that keep your organisation healthy. The organisations that thrive are the ones that stop seeing the audit as an ordeal and start using it as a tool.
MAJ Advisory LLP is a Nairobi-based professional firm offering integrated audit, tax and advisory services. We work with companies, NGOs, SACCOs, schools and other organisations across a range of sectors, and we bring both technical rigour and a genuinely practical, business-minded approach to every engagement. Our aim is not merely to issue an opinion, but to help you understand your numbers, strengthen your controls and position your organisation for growth. Because our audit, tax and advisory teams work together, the insights from your audit feed directly into better tax planning and sharper strategic advice.
Whether you face a statutory audit requirement, need audited accounts for a lender, donor, investor or tender, or simply want the credibility and reassurance that an independent audit brings, we would be glad to help. We can also help you confirm your exact obligations under the current rules, prepare for your audit efficiently, and act on the findings to improve year after year.
Talk to MAJ Advisory LLP today about your audit and assurance needs. Get in touch with our team for a no-obligation conversation about how a well-run audit can build trust, open doors and strengthen your organisation. We look forward to working with you.
Our team provides integrated Audit, Tax and Advisory support for businesses, investors and institutions across Kenya. Book a free consultation and let us help you move forward with confidence.
Book a Free Consultation