Getting Audit-Ready: Documentation to Keep

Most audits do not go wrong because the numbers are wrong. They go wrong because a figure is correct and nobody in the office can produce the document behind it within a reasonable time. The examiner asks for support on a handful of transactions, the search takes three days, and a routine review turns into a negotiation about what can be reconstructed. Being audit-ready is mostly about making that search short.

What an audit actually tests

An audit is not a re-computation of your financial statements. Whether it is a BIR examination, a statutory audit for your annual filing, or a due diligence review by a client, the work has the same shape: someone selects a set of transactions and asks you to prove each one. They want the entry in the books, the document that gave rise to it, evidence that money actually moved, and some sign that the transaction was approved by a person with the authority to approve it.

The second thing an examiner does is reconcile. Returns against books, books against bank, payroll register against the amounts remitted. Differences are normal; unexplained differences are what turn a review into an assessment. Most of the time the difference is not fraud or even error — it is a timing question, a reclassification, or a document that was filed under a different name.

The point of being audit-ready is that you can explain a difference in the same week it is raised, from records you already have.

The chain behind every figure

For each transaction, the file should let a stranger walk from the ledger to the paper without asking you a question. That means the journal entry, the source document, the proof of payment and the approval — kept together, or at least cross-referenced so that finding one leads to the others. A well-organised set of supporting documents is worth more at audit time than a beautifully formatted trial balance.

Since 27 April 2024, under Revenue Regulations No. 7-2024, the Invoice is the primary document for sales of both goods and services, and the Official Receipt has become a supplementary document. From that date, a manual or loose-leaf Official Receipt issued without a stamped "Invoice" does not support an input tax claim. If your records span that change, the practical consequence is filing discipline: purchases from the transition period need the right document attached, not merely a document, and whoever files them has to know which is which.

Payroll and statutory records belong in the same file

Payroll is where documentation debt accumulates quietly, because the deadlines are annual and the evidence is scattered across the year. Employers must furnish each employee a BIR Form 2316 on or before January 31 of the following year, or on the day the last payment of compensation is made if employment ended earlier. Under substituted filing, duplicate copies go to the BIR not later than February 28, together with the Certified List of Employees Qualified for Substituted Filing. BIR Form 1604-C and its alphalists are due January 31. Keeping the filed copies, with the transmittal or acknowledgement, is the whole exercise.

Contribution records deserve the same treatment. For SSS, PhilHealth and Pag-IBIG, keep the generated remittance reports alongside the proof of payment, not just the bank debit. That matters more than usual this year: PhilHealth Circular No. 2026-0001 opened a one-time waiver of interest on missed employer contributions for the applicable months July 2013 to December 2024, with requests accepted only until December 31, 2026. Knowing whether you have a gap at all requires a remittance history you can actually read.

How long to keep records, and how to keep them safely

Retention is the part most businesses get wrong in both directions — discarding too early, or keeping everything forever in a way that makes retrieval impossible. Keep books of accounts and their supporting documents for the full period the BIR prescribes for preservation, and treat that period as surviving any system migration or change of accountant. Some obligations carry their own clock: an employer implementing telecommuting must keep the documents proving voluntary adoption for at least three years under DOLE Department Order No. 237, series of 2022.

Storage is now a compliance question in itself. NPC Circular No. 2023-06 requires secure authentication — multifactor authentication or secure encrypted links — for personnel accessing sensitive personal information, privileged information or a high volume of personal data, requires files on removable or portable media to be encrypted, and prohibits sending documents containing personal data by facsimile. A shared folder of payroll PDFs that anyone in the office can open is a finding waiting to happen, and a breach has to be reported to the National Privacy Commission within 72 hours of knowledge or reasonable belief.

Build the trail while the work is happening

The reason audit preparation feels like a fire drill is that the trail is usually assembled backwards, months after the transactions. A system helps only to the extent that it captures the evidence at the moment the work is done — the approval when it is given, the document when it is received, the change when it is made.

None of this removes the judgment about what to keep. It removes the search.

What audit-ready actually looks like

An audit-ready business is not one with better records than everyone else. It is one where a request for support on twenty transactions is half a day of work instead of a fortnight, where the person answering is not the only person who could have answered, and where the answer is the same whether the question comes from an examiner, an external auditor or a bank. That state is reached in ordinary weeks, not in the month before fieldwork — by filing the document when it arrives, recording the approval when it is given, and keeping remittance proofs with the returns they support. Do that consistently and the audit stops being an event. It becomes a scheduling matter.