Why Document Access Becomes a Crisis at Audit Time

Business audit document preparation in the UK tends to expose the same weaknesses every time. The records are there, but the infrastructure around them isn’t. Specifically, four things tend to go wrong.

No consistent indexing

Documents get filed when they arrive, but not always under a consistent system. One person labels a folder by supplier name, another by date, another by project code. Over three years, the archive becomes a patchwork that only the person who created each section can navigate. When that person isn’t available, or has left the business, retrieval slows to a crawl.

Records split across physical and digital systems

A common situation in UK businesses: some records are physical, some are in accounting software, some are in email, some are on a shared drive that hasn’t been properly structured. There’s no single index covering all of it. When an auditor asks for everything related to a particular transaction or period, assembling the full picture takes days.

Outdated or non-existent retention schedules

A retention schedule tells you what you’re keeping, why, and for how long. Without one, the archive tends to grow indefinitely, with no clear sense of what’s been retained and what may have been discarded. During an

audit, that uncertainty is a problem. If you can’t confirm whether a document was destroyed intentionally at the end of its retention period or was simply lost, that raises questions.

No defined process for urgent retrieval

Even businesses with reasonably organised archives often have no documented process for producing documents quickly when needed. Under normal conditions, taking a week to locate a file is inconvenient. During an audit, it’s a different matter.

Auditors, whether from HMRC, the FCA, a sector regulator, or an internal audit function, expect documents to be produced promptly. An inability to locate records quickly signals disorganisation at best. At worst, it raises the question of whether the records were kept at all. HMRC, for example, can go back six years for careless record-keeping errors, and up to 20 years in cases of suspected deliberate tax evasion. The obligation to have records available is not a courtesy.

An inability to locate records quickly signals disorganisation at best. At worst, it raises the question of whether the records were kept at all.

The Documents Auditors Most Commonly Request

This list isn’t exhaustive, but it covers the categories that come up most consistently. Having a clear picture of where each of these sits in your archive is a good starting point for any audit preparation exercise.

Financial records

Bank statements, purchase orders, sales invoices, expense records, VAT returns, payroll records, and accounting software exports. HMRC requires limited companies to keep accounting records for six years from the end of the financial year they relate to, under both tax law and the Companies Act 2006. For sole traders and partnerships, the standard is five years after the 31 January submission deadline for the relevant tax year. VAT records carry their own six-year requirement under HMRC’s VAT Notice 700/21.

Contracts and agreements

Client contracts, supplier agreements, employment contracts, and any agreements that relate to the transactions or period under review. Under the Limitation Act 1980, most simple contracts have a six-year limitation period, so that’s a reasonable minimum for retention. Contracts executed as deeds carry a 12-year limitation period and should be kept accordingly.

Board minutes and company records

For Companies Act compliance, limited companies are required to keep board minutes and resolutions for 10 years from the date of the meeting under section 355 of the Companies Act 2006. Statutory registers, including the register of members and directors, should be kept for the life of the company. Auditors may also request evidence of governance decisions relevant to the period under review, particularly in regulated sectors.

Correspondence

Emails and letters relevant to disputed transactions, material decisions, or regulatory communications. This category is frequently underestimated. In financial services, MiFID II requires firms to retain records of relevant communications for at least five years, and up to seven years if requested by the FCA. For most other businesses, the practical question is whether key communications can be located if needed, not just whether they technically still exist somewhere.

Sector-specific records

Regulated businesses carry additional requirements on top of the above. FCA-regulated firms need client records, suitability assessments, and communications records. Healthcare providers need clinical and

patient administration records held to NHS Records Management Code of Practice standards. Life science companies need batch records, trial master files, and SOPs, often for 25 years or more after a trial closes. The sector requirements generally go further than the baseline, not less far.

Setting Up an Audit-Ready Archive

The goal isn’t to scramble together documents when an audit arrives. It’s to maintain records in a way that means audit preparation takes a few hours, not several days.

That comes down to four habits.

Consistent indexing from the point of filing

Documents should be indexed when they’re filed, not when they’re needed. That means agreeing on a filing structure across the business, applying it consistently, and not allowing individual workarounds. A simple, well-maintained system beats a sophisticated one that’s applied inconsistently.

A documented retention schedule

A retention schedule records what categories of document you hold, the legal basis for keeping them, the minimum retention period, and the destruction date. It doesn’t need to be complex. It needs to be current and followed. When an auditor asks whether you have a particular category of document and when it was last reviewed, a documented schedule is a credible answer. ‘We think we kept it’ is not.

Clear ownership

Someone in the business needs to own record management. That doesn’t mean one person does all the filing. It means one person is responsible for the system, updates the retention schedule, and is the point of contact when documents need to be located quickly. Without that ownership, standards drift.

A tested retrieval process

The retrieval process should be documented and periodically tested. If a specific document were requested today, how long would it take to produce it? Who would find it? If the honest answer is ‘it depends’ or ‘we’d have to look around’, that’s worth addressing before an audit requires a better answer.

For businesses using an external archive provider, an audit-ready document management setup means the archive is indexed, retrieval requests are handled to a documented turnaround time, and there’s a clear chain of custody for every document in storage.

If Your Archive Isn’t Currently Audit-Ready

This is a common situation. Most businesses don’t set up their archive with audit preparation in mind. Records accumulate over years in whatever system happened to develop, and nobody reviews the whole thing until there’s a reason to.

If that describes your archive, the practical approach is triage rather than a wholesale reorganisation.

Start with the records most likely to be requested. Financial records, contracts, and payroll data cover the majority of HMRC and Companies Act audit scenarios. Establish what you have in these categories, whether it’s complete, and whether it’s accessible. If there are gaps, understanding those gaps now is better than discovering them when an auditor is waiting.

Next, look at indexing. Even a basic catalogue of what’s held, organised by year and document type, is significantly more useful than an unstructured collection of boxes or folders.

For businesses with significant volumes of legacy records, a managed review and cataloguing exercise may be the most practical route. An external archive provider can assess what exists, help organise it, and set up

a system that works going forward. That’s a different service from simply storing new records. Ardington Archives offers document management consultancy specifically for businesses that need to bring an existing archive under control, not just maintain one that’s already organised.

Retrieval Speed Matters More Than You’d Think

When an auditor asks for a document, ‘we’ll find it and come back to you’ is a weak position to be in. It introduces uncertainty about whether the document exists, whether it will match what was described, and whether there are other records that might contradict it. A rapid, confident response to a document request sends a different signal entirely.

A properly indexed external archive delivers that confidence in a practical form. Documents can be requested by phone, email, or online portal, and returned physically or digitally to a documented turnaround time. Next working day is standard for most requests. Same-day retrieval is available for urgent cases.

That’s a meaningful difference from searching through an office storeroom, a filing cabinet that hasn’t been touched in two years, or a network drive with inconsistent folder naming.

For businesses in sectors with strict audit or inspection requirements, the retrieval record itself can also matter. A managed archive maintains a log of every request and return, which provides an audit trail for document access as well as document retention. That’s something an unmanaged in-house system generally can’t offer.

Ardington Archives helps businesses get their records into a state where retrieval is fast, documented, and reliable. Whether you need a consultancy review of an existing archive or an ongoing managed storage solution, we can help. Get in touch to discuss your current setup.