Taxes

Surviving a KRA audit: the records you need.

An audit is a records review, not a mystery. Here's the five-year rule, the invoice-to-payment trail that auditors actually follow, and the files that make one finish quickly instead of dragging on.

26 Jul 2026·Taxes·761·7 MIN READ

Audits follow the money trail.

Strip away the letters and the jargon, and a KRA audit is a question: "do your records support the figures on your returns?" Auditors work by sampling — they pick invoices, then follow each one forward to the payment and backward to the sale. Where the trail breaks, they look closer.

This is why the single most valuable file in your business is the invoice-to-payment trail: every invoice you raised, and the payment that settled it, linked together. Build that habit and an audit becomes a guided tour of your books. Skip it and the same audit becomes archaeology.

The five-year rule.

Under the Tax Procedures Act, you're required to keep your books and records for at least five years from the end of the accounting period they relate to. That includes invoices, receipts, bank and M-Pesa statements, payroll records, contracts, and the workings behind your returns.

Five years is longer than a phone's life and longer than most filing cabinets. The realistic answer for a small business is digital records you can export, backed up somewhere safe.

What they'll ask for.

Sales records — every invoice (and now, every eTIMS record) for the period under review.

Payments received — bank statements, M-Pesa statements, card settlements.

Purchases and expenses — with the invoices to back each claim.

Payroll — payslips, PAYE returns (P10s), P9 certificates, NSSF and SHIF remittances.

Statutory filings — the returns you submitted, matched to the records behind them.

Reconciliation workings — the notes showing how your figures tie together.

eTIMS changed the game.

Because your sales invoices now exist in KRA's own systems, the audit isn't comparing your paper to your ledger — it's comparing your ledger to what KRA already has. A gap between your issued eTIMS invoices and your reported sales is found before the auditor visits. The electronic record removes the guesswork, in both directions: it protects honest businesses and exposes gaps fast.

If the letter arrives.

Don't ignore it. Missing a response deadline turns a review into an assessment by default.

Get your records together first. Reconstruct nothing from memory — that's when errors get baked in.

Involve your accountant early. They speak the language and will spot issues you'd miss.

Answer what's asked, provide what's requested, and keep every response documented.

The 30-second habit

Reconcile payments to invoices the day they arrive. It's the single habit that keeps the trail intact and the audit short. See how to set it up.

Audit-ready by default.

The businesses that dread audits least are the ones where every invoice, payment, and report lives in the same system — nothing reconstructed, nothing missing. That's the outcome we built Tieghtsuite around: complete, exportable records you can hand over without a week of preparation.