Answering an audit request
In short Work out exactly what’s being asked for and by when, and make sure nothing it touches is thrown away while you gather it. When you reply, send what was asked for, and make a note of exactly what went out and when.
Who might be asking
A request to see your records can come from your own auditors, a client checking up on a supplier, a regulator, HMRC or a person asking about their own data.
Each has its own powers and deadlines, so start by working out which you’re dealing with.
This guide is general information, not legal advice. What a request obliges you to send is a judgement for you and your advisers, so talk to them first if it has legal force or you’re not sure whether it does.
Know the deadline
Some deadlines are set in law:
- A subject access request: generally one month from receiving it, which you can extend by two further months, with notice, where the requests are complex or numerous (UK GDPR Article 12A, inserted by the Data (Use and Access) Act 2025, section 76).
- A Freedom of Information request to a public authority: promptly, and no later than the twentieth working day after it’s received (Freedom of Information Act 2000, section 10).
- An HMRC information notice: an officer can require information or documents reasonably required to check your tax position (Finance Act 2008, Schedule 36, paragraph 1), so read the notice for the time it gives you.
Auditors and clients usually set their own dates. If one isn’t realistic, it’s better to say so early than late.
Leave everything as it is
Once a request is in, nothing it touches should be changed or thrown away.
For a Freedom of Information or subject access request, altering, erasing or destroying information to prevent its disclosure is an offence (Freedom of Information Act 2000, section 77; Data Protection Act 2018, section 173).
A hold over everything the request covers will make sure of that, and it’s worth pausing routine clear-outs until you’ve replied. Our guide to running one will take you through it step by step.
Gathering what’s asked for
- Search by the thing the request is about: a person, a client, an account or a case.
- Check you have the whole set, including paper copies and attachments.
- Read it before it goes, and take out anything the person asking isn’t entitled to, with a note of why.
- Export it in a form they can open, and list the documents so you can both refer to them.
Showing the records are what they say they are
An auditor will often want more than the documents. They’ll ask when each one was filed, whether it has changed since, and who has opened it.
Answering that from memory or from old emails is slow and hard to stand behind. It’s much easier when every filing, view and change is noted as it happens, and you can export the history alongside the documents.
After you reply
Write down what you sent, when and to whom, and file a copy of the export itself.
Then undo anything you paused for the request, unless something else still needs it to stay in place.
How folio will help
In folio, you’ll be able to find everything filed under a person, a client or a case in one search, place a hold while you work, and export what’s asked for.
The ledger will show when each record was filed and who has opened it since, and you’ll be able to export that alongside the documents. Exports, reports and links explains how that will work.
Sources
- Data (Use and Access) Act 2025, section 76
- Freedom of Information Act 2000, section 10
- Freedom of Information Act 2000, section 77
- Data Protection Act 2018, section 173
- Finance Act 2008, Schedule 36, paragraph 1
This guide is general information, not legal advice. The figures come from the legislation linked above as it stood when we last checked it, and how long you keep each kind of record is your professional judgement.
Read next
Tell us what you have to keep
folio is in private beta. If it sounds like it would help, get in touch and we’ll set it up with you.