Audit in Kenya: how I do it

Audit in Kenya: how I do it

A statutory audit gives an independent opinion on whether a company's financial statements are free from material misstatement and prepared in line with the applicable framework. You run it under the International Standards on Auditing. ISA 200 sets what you are trying to achieve. ISA 220 (Revised) sets how you manage and reach engagement quality while you do it. Most engagements cover one financial year, commonly ended 31 December, and the work runs from planning through fieldwork to the signed opinion.

Who this is for

This guide is for engagement team members running a statutory audit under the ISAs: staff, seniors, and managers who plan the work, gather evidence, and draft conclusions. It is not a bookkeeping or tax-return guide, and it does not replace the engagement partner's judgment. The requirement to have an audit sits in the Companies Act; confirm the current audit-exemption threshold before you tell a client they do or do not need one. Anything involving the partner's sign-off, a difference of opinion you cannot resolve, or a suspected fraud goes up, not around.

Before you start, ask the client (and yourself)

Acceptance and continuance comes first, every year, new client or repeat. Before you touch a number, the engagement partner has to answer:

• Do we have the expertise this client needs?
• Are we independent, in fact and in appearance?
• Do we have enough resources and time to do the work properly?
• Is management trustworthy? Does the client show integrity?
• Are there risks we should not accept?
• Do the preconditions for an audit exist: an acceptable framework, and management that accepts its responsibilities?

Then ask about the entity itself before its numbers: what the business does, what changed in the year (new products, new markets, new financing), who the related parties are, and what management is planning that depends on this year's result. A client that needs a clean, fast opinion to raise money is telling you where your risk sits.

The method, step by step

1. Decide acceptance or continuance first. Evaluate client integrity, confirm independence, check competence and resources, and confirm the preconditions for the audit exist. Get this wrong and nothing downstream is safe: you cannot cure a missing independence or an integrity problem after you have signed a plan and started fieldwork.
2. Set the tone. The engagement partner stays accountable even when work is delegated. From the start, promote professional skepticism, professional judgment, open communication, consultation, coaching, accountability, and ethical behaviour. This is how the file gets run, not a speech at the kick-off meeting.
3. Direct the team. Make sure every member understands the audit objectives, the risks are communicated, and responsibilities are clearly assigned. A team that does not know where the risk sits will test the wrong things well.
4. Assess risk. Identify the risks of material misstatement at the assertion level for each significant area. Tie each risk to the assertions it threatens: occurrence, cutoff, accuracy, completeness, existence, valuation, rights and obligations.
5. Design and perform responses. Match procedures to the risks you found. Heavier risk earns more extensive procedures than a routine audit, not last year's programme repeated.
6. Supervise as you go. Monitor progress, address issues promptly, and adjust resources where the work needs it. Do not wait for the review to find that a section stalled.
7. Consult on the hard matters. Encourage consultation on complex accounting, significant audit judgments, going concern, fraud, and independence. Where a difference of opinion arises, resolve it and record the resolution before anyone concludes.
8. Review the work. The review evaluates whether the work supports the conclusions, whether significant judgments hold, whether identified issues were resolved, whether the audit evidence is sufficient and appropriate, and whether the work complies with the ISAs.
9. Evaluate the evidence before you form the opinion. Do not rely on management representations alone. Confirm the evidence is sufficient, meaning enough to bring audit risk to an acceptably low level, and appropriate, meaning relevant and reliable, before signing.
10. Document throughout. If it is not on the file, it did not happen. Documentation runs alongside every step above, not at the end.

Before anyone signs, these have to hold: the evidence supports every conclusion, significant judgments have been reviewed, differences of opinion are resolved and recorded, independence is confirmed, and the file is complete.

The traps

• Taking management's word for it. The most common failure. When margins jump, collections slip, and inventory swells, the answer "it is temporary, no provision needed" is a starting point for testing, not a conclusion. Seek corroborating evidence: delivery notes, contracts, subsequent cash receipts.
• Delegating and assuming it is done. The engagement partner remains accountable for delegated work. Assigning a section does not transfer responsibility for its quality.
• Missing management override. Manual journal entries posted late around year-end, especially ones touching revenue, are a fraud-risk signal. Test them; do not scroll past them.
• Weak cut-off. Revenue booked in the wrong period, or goods "delivered" before year-end that the customer disputes, overstates both revenue and receivables. Cut-off testing catches it.
• Stale receivables and slow stock left at full value. Long-outstanding balances with a thin expected-credit-loss provision, and slow-moving inventory never written down, overstate assets. Review the ECL model and the inventory ageing.
• Signing on evidence that does not support the conclusion. A review that rubber-stamps is not a review. If the work does not support the opinion, the opinion is not ready.
• Bending to a management deadline. A finance director who wants the audit wrapped in two weeks to close a financing round is applying pressure, not setting your timetable. The evidence sets the pace.

Worked example

Sunrise Manufacturing Limited, a medium-sized plastic-packaging manufacturer, year ended 31 December 2025. Fourth year as your client. Management forecasts record profits and wants financing for a new plant. The finance director asks for the audit in two weeks.

Fieldwork surfaced: revenue up 37% (KES 3.5bn to 4.8bn) while production volumes rose only 8%; gross margin up from 24% to 38% despite rising raw-material costs; receivables up 92% with many balances over 180 days; inventory up 63% including slow-moving lines; several manual journals touching revenue posted on the evening of 31 December; customer confirmations disputing pre-year-end deliveries; and internal audit flagging weak sales-approval controls.

Read together, these are risks of material misstatement, not coincidences: possible fictitious or premature revenue (revenue rising far faster than production), manipulated cost of sales or inventory valuation (margin up against the cost trend), overstated receivables and revenue (the 92% jump and the disputes), an inadequate ECL provision (the 180-day balances), obsolete inventory not written down, management override (the late journals), and higher control risk (the sales-approval weakness).

The response runs wider than a routine audit: cut-off testing around year-end; matching invoices to delivery notes and purchase orders; reviewing post-year-end credit notes; testing the year-end manual journals; additional debtor confirmations and review of subsequent receipts; evaluating the ECL model and ageing; attending and test-counting inventory and comparing cost to net realisable value; testing sales-approval and journal-entry controls; and fraud procedures including management interviews, review of audit-committee minutes, and unpredictable testing.

Conclusion: elevated audit risk on several fronts. Respond with heightened skepticism, evidence-based judgment, and additional substantive work. Do not form the opinion on management representations; obtain sufficient appropriate evidence first.

Sources

• ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing
• ISA 220 (Revised), Quality Management for an Audit of Financial Statements
• ISQM 1 and ISQM 2, the quality-management standards at firm and engagement level that ISA 220 (Revised) builds on
• Companies Act (Kenya), for the statutory audit requirement; confirm the current audit-exemption threshold before relying on it
• CPAK / ICPAK audit-quality training materials
• FFP Consult, Audit & assurance services in Kenya: https://ffp.co.ke/services/audit-services-kenya

Contributed by Julian Njoroge Maina, 25241.