External Audit Preparation Checklist: What to Do in the 30 Days Before Your Auditor Arrives
The notification arrives. Your external auditor is coming in 30 days. What happens next in your business?
For the founders and business owners I work with, the answer is often the same: a sudden scramble for documents, a panicked round of account reconciliations, and a growing awareness that the records are not quite where they should be.
Here is something I observed consistently during my years as a senior auditor at Deloitte: the stress of an audit rarely comes from complexity. It comes from a lack of preparation. The companies that sailed through fieldwork were not always the ones with the cleanest books. They were the ones who had organized themselves well in the weeks beforehand.
This guide gives you the exact preparation framework I now share with every client at AHC. It is structured as a 30-day countdown, week by week, so you can start wherever you are and still arrive at fieldwork in a controlled, confident position.
---
Why 30 Days Is Not Too Early to Start
Industry research consistently shows that properly prepared companies can reduce their audit timeline by 30 to 50 percent. That translates directly into fewer billable hours from your auditor and less disruption to your team's daily workload.
Audit preparation should not be treated as a year-end event. The companies that experience costly, extended fieldwork are usually the ones that only start thinking about the audit after it has been announced. By contrast, businesses that maintain basic audit readiness throughout the year treat the 30-day window as a final review, not a frantic catch-up exercise.
If you are reading this with 30 days to go, that is still enough time to make a meaningful difference. Here is how to use it.
---
Week 1 (Days 1 to 7): Get Your Financial Records in Order
This week is about making sure your numbers tell a coherent, consistent story.
**Reconcile your trial balance to your general ledger.** This sounds basic, but unexplained variances between the two are one of the most common early findings in external audits. Every difference needs a documented explanation. If you cannot explain it, your auditor will.
**Complete all bank reconciliations.** Every bank account, every period. These should be signed off by a member of management, not just prepared and left in a drawer. Auditors treat an unsigned reconciliation as an incomplete one.
**Prepare draft financial statements.** Have your income statement, balance sheet, and cash flow statement ready before fieldwork begins. Auditors appreciate working from a document you have already reviewed. It signals that management has control over the numbers, which starts the relationship on solid footing.
**Review your chart of accounts.** Ensure that all transactions have been posted consistently and in line with your stated accounting policies. Inconsistent posting - putting similar transactions in different accounts at different times - is a pattern auditors are trained to spot.
---
## Week 2 (Days 8 to 14): Test Your Internal Controls
This is the week most founders skip. It is also the week that makes the biggest difference.
The COSO Internal Control Integrated Framework, which underpins most external audit standards, identifies five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. You do not need to implement all of COSO before your audit. But you do need to know whether your key controls are actually working.
**Document your key controls over financial reporting.** Which controls prevent or detect a material misstatement? Write them down. Auditors need evidence, not assurances. A control that lives only in someone's head provides no protection and no audit comfort.
**Check your segregation of duties.** The most common control weakness in smaller businesses is one person handling too many parts of a transaction cycle. In a sound control environment, the person who approves a payment should not be the same person who executes it or records it. Where you have gaps due to team size, document the compensating controls you use instead.
**Run a self-assessment.** Walk through five to ten of your highest-value transactions from the past period. Trace each one from initiation to recording. Ask yourself: was the control applied? Is there evidence of it? If you cannot find the evidence, your auditor will note the same absence during fieldwork.
**Fix what you find.** A weakness you identify and correct before fieldwork is not an audit finding. A weakness your auditor finds is. This distinction matters - not just for the management letter, but for your credibility as a management team.
---
## Week 3 (Days 15 to 21): Build Your Documentation Pack
This week is about creating the organized, accessible evidence base that your auditors will draw on throughout fieldwork.
Think of your documentation pack as a data room. Every financial area - revenue, payroll, fixed assets, liabilities, equity - should have a clearly labelled folder containing everything your auditor is likely to request.
**Compile your contracts and legal documents.** This means customer contracts, supplier agreements, leases, loan documentation, and any shareholder arrangements. Auditors will ask for these. Having them indexed and ready, rather than scattered across email inboxes and filing cabinets, reduces your response time dramatically and signals strong governance.
**Document your accounting policies in writing.** This is not optional. Verbal policies are not audit evidence. Your auditor needs to understand the principles you have applied and see that you have applied them consistently. If you recognize revenue over time rather than at a point in time, that policy needs to be written down and applied uniformly.
**Prepare your supporting schedules.** Your fixed asset register should be current and reconciled to the balance sheet. Your accounts receivable aging report should reflect accurate, up-to-date balances. Your payables listing should match your recorded liabilities. These schedules are the first working papers your auditor will review, and inconsistencies in them tend to ripple through the rest of the audit.
**Create your data room.** Even if you are not raising investment, the discipline of a well-organized data room pays off during an audit. One folder per financial area. Clearly named files. A simple index at the top level so that any auditor can find what they need without needing to ask your team.
---
## Week 4 (Days 22 to 30): Brief Your Team and Cross the Finish Line
By this point, your records should be substantially in order. Week four is about making sure your team is ready and that you have addressed any remaining loose ends.
**Hold a preparation meeting with your finance team.** Define who is responsible for responding to which types of audit request. Auditors will typically submit a Prepared by Client list during or before fieldwork. Having a named owner for each section prevents requests from falling through the cracks or arriving late.
**Set up a dedicated audit workspace.** This is a practical step that many companies overlook. Your auditors need a physical or virtual space to work. That means appropriate system access, clean desk access if they are on-site, and IT support available if they need to access your accounting system. Preparing this in advance avoids delays on day one.
**Review your prior-year management letter.** If you received a management letter from your previous audit, go through each agreed action. Were they implemented? Is there evidence of implementation? Reopening a prior-year finding because the agreed action was never followed through is an avoidable outcome. Auditors note repeat findings, and they carry weight.
**Do a final review of your financial statements.** Read them as if you are seeing them for the first time. Look for internal inconsistencies - figures that do not cross-reference correctly, disclosures that contradict the numbers, or narratives that do not match the financial position you have reported. Catching these yourself is always better than having your auditor raise them.
---
## The Three Red Flags That Trigger Deeper Scrutiny
Even with strong preparation, certain patterns attract heightened auditor attention. Knowing what they are helps you address them proactively.
**Journal entries without proper authorization.** Late or unsupported journal entries - particularly those posted close to the period end - are among the most consistent triggers for additional testing. Auditors view unauthorized entries as a potential indicator of manipulation. Every journal entry needs a documented preparer, approver, and business rationale.
**Inconsistent revenue recognition.** Applying different policies to similar transactions creates misstatement risk and raises questions about the reliability of your reported revenue. If your revenue recognition policy has any complexity - for instance, multi-element arrangements, contracts with variable consideration, or long-term service agreements - make sure it has been applied consistently and documented clearly.
**Intercompany balances that do not reconcile.** If your business has related party transactions or intercompany balances, unresolved differences between the two sides of those transactions are a reliable time drain during fieldwork. Resolve them before day one.
---
## The Most Important Principle in Audit Preparation
Across every engagement I have worked on, the most common reason for extended or difficult audits is not complex accounting. It is undocumented controls and processes.
Your controls may be working well. Your team may be applying them diligently. But without documentary evidence, auditors can only rely on inquiry. And inquiry is the weakest form of audit evidence recognized under any professional standard. Observation, inspection, and re-performance all outrank it. If your team tells an auditor "we always approve transactions before they're processed," but there is no approval record, that control does not exist for audit purposes.
Documentation is not bureaucracy. It is the foundation of audit credibility.
---
## Frequently Asked Questions
**How far in advance should I start preparing for an external audit?**
Most advisors recommend starting 60 to 90 days before the audit begins. If you have 30 days, that is workable but requires focus. The four-week framework above gives you a structured way to use the time effectively.
**What documents does an external auditor typically request?**
You can expect requests for financial statements and supporting trial balance, bank statements and reconciliations, fixed asset register, accounts receivable and payable listings, contracts and legal agreements, payroll records, journal entry listings, and documentation of internal controls.
**What happens if the auditor finds a control weakness?**
Control weaknesses are classified as either general deficiencies, significant deficiencies, or material weaknesses depending on their severity. General deficiencies are communicated to management and corrected. Significant deficiencies and material weaknesses are reported to the audit committee or board and, in some cases, disclosed in the financial statements. Identifying and addressing weaknesses yourself before fieldwork is always preferable.
**What is a management letter and why does it matter?**
A management letter is a communication from your auditor to management identifying control deficiencies, inefficiencies, and recommendations observed during the audit. It is separate from the audit opinion. If you received one last year, reviewing it before the current audit is important - auditors track whether prior recommendations were implemented.
**How can AHC help with audit preparation?**
Adil Habib Consulting works directly with founders and business owners to get their businesses audit-ready. This includes reviewing your financial records, assessing your internal controls, preparing your documentation pack, and briefing your team ahead of fieldwork. If you are heading into an audit and want experienced support, [contact us](https://www.adilhabibconsulting.com) or DM Muhammad Adil Habib directly on LinkedIn.
---
## Summary
Audit preparation is not about making your business look better than it is. It is about making sure the work you have already done is properly evidenced and organized so your auditors can verify it efficiently.
The 30-day framework is straightforward:
- Days 1-7: Reconcile your financials. Prepare your draft statements.
- Days 8-14: Test your internal controls. Fix what you find.
- Days 15-21: Build your documentation pack. Organize your data room.
- Days 22-30: Brief your team. Review the prior-year management letter. Final check.
And through all of it, remember the principle that applies to every audit engagement: if it isn't documented, it didn't happen.
---
*Muhammad Adil Habib is the Founder of Adil Habib Consulting and a former Senior Auditor at Deloitte. AHC works with founders and business owners to strengthen financial reporting, internal controls, and audit readiness. Visit [adilhabibconsulting.com](https://www.adilhabibconsulting.com) or connect on LinkedIn at [@muh-adil-habib](https://www.linkedin.com/in/muh-adil-habib/).*
