If you have recently registered a company in Kenya, or if you are running an NGO, a SACCO, or a growing business, one question almost always comes up: do we legally need an audit? And if so, how often — and by whom?

The answer depends on the type of entity you are, your annual turnover, and the sector you operate in. This guide breaks down exactly what a statutory audit is, which organisations are required to have one under Kenyan law, and what happens if you do not comply.

What Is a Statutory Audit?

A statutory audit is an independent, legally required examination of an organisation’s financial statements, carried out by a qualified external auditor. The word “statutory” simply means it is required by law — not optional.

The purpose of a statutory audit is to give an independent opinion on whether a company’s financial statements present a true and fair view of its financial position and performance. The auditor is not an employee of the company — they are an independent professional whose job is to verify that the numbers are accurate and that the accounts comply with the applicable financial reporting standards.

In Kenya, statutory audits are conducted in accordance with the International Standards on Auditing (ISA) and financial statements must comply with either full IFRS or IFRS for SMEs, depending on the size and nature of the entity. Auditors must be practicing members of the Institute of Certified Public Accountants of Kenya (ICPAK) holding a valid practicing certificate.

The Legal Basis: Companies Act 2015

The primary law governing statutory audits for companies in Kenya is the Companies Act, 2015, which came into full force in June 2016.

Part XXVII of the Act places a clear obligation on the directors of every company to ensure that the company’s financial statements are audited each financial year. The audited statements, together with the Directors’ Report and Auditor’s Report, must then be filed with the Registrar of Companies within the following deadlines:

• Private companies — nine months after the end of the financial year
• Public companies and companies limited by guarantee — six months after the end of the financial year

Failure to file on time is a statutory offence for which directors can be held personally liable.

Does Every Company in Kenya Need a Statutory Audit?

Not every company is legally required to have a statutory audit. The Companies Act 2015 introduced a small company exemption, but the conditions are specific — and in practice, very few companies fully benefit from it.

Companies that MUST have a statutory audit

Your company is legally required to be audited if it does not qualify as a small company, or if it falls into one of the following categories regardless of size:

• Public companies (listed on the Nairobi Securities Exchange or other regulated markets)
• Banks and financial institutions regulated by the Central Bank of Kenya (CBK)
• Insurance companies regulated by the Insurance Regulatory Authority (IRA)
• Deposit-taking SACCOs regulated by SASRA
• Companies with subsidiaries (parent companies must produce audited individual and consolidated financial statements)
• Foreign companies operating in Kenya

The small company exemption — and its real-world limits

Under Section 164 of the Companies Act, a company may qualify as a “small company” and be exempt from the statutory audit requirement if it satisfies at least two of the following three conditions:

However — and this is critical — the exemption does not work the way many directors assume.

The Income Tax Act requires all companies, including small ones, to file audited financial statements with KRA when submitting their annual tax returns. This means that even if a company is technically exempt from the audit requirement under the Companies Act, it will still need audited accounts to satisfy KRA’s filing requirements. In practice, this makes the small company exemption largely theoretical for any company that files corporate tax returns.

Who Else Is Required to Have a Statutory Audit in Kenya?

Beyond companies registered under the Companies Act, several other types of organisations have mandatory audit obligations under their own sector-specific legislation:

NGOs (Non-Governmental Organisations)

NGOs registered in Kenya are regulated by the NGO Coordination Board under the NGO Act, 1990. All NGOs are required to submit annual returns including audited financial statements to the NGO Coordination Board by 30 June each year. Failure to comply can lead to suspension of operations or financial penalties.

In addition, most donor-funded NGOs face audit requirements from their funders — international donors such as USAID, the EU, and UN agencies typically impose their own audit standards as a condition of funding, which often go beyond the minimum statutory requirement.

SACCOs

Both deposit-taking SACCOs (regulated by SASRA) and many non-deposit-taking SACCOs are required to undergo annual statutory audits. Deposit-taking SACCOs must submit their audited financial statements to SASRA by 15 March of the following year. SASRA also maintains an approved list of auditors who are authorised to conduct audits of regulated SACCOs — not every registered audit firm qualifies.

Schools and educational institutions

Private schools and universities in Kenya are generally required to produce audited accounts as a condition of their registration and renewal with the relevant regulatory bodies.

Donor-funded projects and public benefit organisations

Any organisation receiving grant funding from government or international donors will typically have an audit requirement written into the grant agreement, regardless of its legal form.

Quick Reference: Do You Need a Statutory Audit?

What Happens If You Don’t Have a Statutory Audit?

Failing to comply with statutory audit requirements in Kenya carries real consequences:

For companies: Directors can be held personally liable for failure to ensure financial statements are prepared and filed with the Registrar of Companies. Late filing attracts penalties under the Companies Act.

For KRA compliance: Without audited financial statements, you cannot meet your annual corporate tax filing obligations. This blocks your ability to obtain or renew a Tax Compliance Certificate — which you need for tenders, licences, and banking.

For NGOs: The NGO Coordination Board can suspend your organisation’s registration and revoke your operating certificate. Donors will typically terminate funding agreements if audited accounts are not submitted on time.

For SACCOs: SASRA can impose financial penalties, restrict operations, or revoke a deposit-taking SACCO’s operating licence for non-compliance with audit requirements.

Beyond the legal consequences, the absence of audited accounts makes it significantly harder to access bank financing, attract investors, win procurement contracts, or demonstrate to any third party that your organisation is financially sound.

Who Can Conduct a Statutory Audit in Kenya?

A statutory audit must be carried out by a registered audit firm whose partners hold valid practicing certificates issued by ICPAK. Not every accountant or bookkeeper qualifies — the auditor must be independent of the company, meaning they cannot be an employee, director, or shareholder of the entity being audited.

For SACCOs specifically, the auditor must also appear on SASRA’s approved auditors list for the relevant year.

When selecting an auditor, look for a firm that:

• Is registered with ICPAK and holds a valid practicing certificate
• Has experience auditing entities in your specific sector
• Understands the current KRA requirements including eTIMS compliance
• Can turn around the audit within your statutory filing deadlines

Frequently Asked Questions

Is a statutory audit the same as a tax audit? No. A statutory audit examines your financial statements to confirm they are accurate and comply with accounting standards. A tax audit is conducted by KRA to verify that your tax declarations are correct. The two are separate processes, though audited financial statements help you prepare for and defend against a KRA tax audit.

Can my internal accountant conduct the statutory audit? No. A statutory audit must be conducted by an independent external auditor. Your internal accountant — or any person employed by or connected to your company — cannot serve as the statutory auditor.

How long does a statutory audit take in Kenya? For a well-prepared SME, a statutory audit typically takes two to four weeks. Larger organisations or those with complex transactions may take longer. Engaging your auditor early — ideally two to three months before your financial year-end — significantly reduces delays.

Does a dormant company need a statutory audit? A dormant company with no transactions during the year may be exempt from the full audit requirement, but should still file a balance sheet with the Registrar of Companies. It is advisable to consult a qualified auditor to confirm the company’s obligations before choosing to skip the audit.

Need a Registered Audit Firm in Kenya?

Understanding whether your organisation needs a statutory audit is the first step. The second is ensuring you engage a qualified, independent auditor in time to meet your filing deadlines.

At Juma Auditors, we conduct statutory audits for companies, NGOs, SACCOs, and other entities across Kenya. Our team of ICPAK-registered CPAs delivers accurate, timely audits that keep you compliant with the Companies Act, KRA requirements, and sector-specific regulations.

📞 Call us: +254 725 948 551 📧 Email: info@jumaauditors.co.ke 🌐 Visit: www.jumaauditors.co.ke 📍 Office: Kimathi Chambers, 5th Floor, Nairobi