Keeping Business Records in Kenya That Survive a KRA Audit

When KRA asks for invoices behind a return, reconciled records make it easier to trace the figures. If receipts are scattered or missing, it can take longer to answer and you may be unable to support an expense claim.

The rules on what you must keep are fixed. The Tax Procedures Act sets a five-year retention period for tax documents. The Companies Act sets a seven-year period for company accounting records, and a duty on the company and its officers to keep them properly. The records that matter most are the ones that support your income and your expenses, because those are the two figures an audit tests.

1. Why the records decide the outcome

Kenya operates a self-assessment system. You file your return and you carry the burden of showing how you reached your figures. When KRA issues an additional assessment, the Commissioner must state the amendment, the tax law and the reasons in writing under sections 31(8) and 31(8A), but the burden remains on you under section 56(1) to prove that your figures are correct.

An audit is a records exercise. The auditor looks for a document that matches a figure on the return. Sound records let you substantiate your figures and challenge the auditor's; missing records make that harder, and the auditor may adjust a figure it cannot see supported.

2. What the law requires you to keep

The Tax Procedures Act requires a person to maintain any document required under a tax law, in either of the official languages, in a way that lets the person's tax liability be readily ascertained. The document must be retained for five years from the end of the reporting period it relates to, or a shorter period specified in a tax law.

If the document is not in an official language, the Commissioner can require you to provide a translation at your own expense, by a date specified in a notice.

The practical list is short:

3. The five-year rule

The five-year period runs from the end of the reporting period the document relates to. For a document tied to the 2025 income year, which ends on 31 December 2025, the five years run from that date.

Two exceptions extend the period. If the document relates to an amended assessment, you keep it until the period for a further amendment has expired under section 31(7). If the document is needed for a proceeding that began before the five years ended, you keep it until the proceeding is finished.

KRA keeps its side of the same bargain. The authority states that the law allows it to assess for a five-year period, and that where there is gross or wilful neglect, evasion or fraud it can go back as far as necessary (Tax Procedures Act, section 31(4)(a)). The five-year rule is a reason to keep records, not a reason to destroy them early.

4. Companies: the seven-year rule and the accounting records duty

A company has a second, separate duty under the Companies Act 2015. The company must keep proper accounting records, and it must preserve them for not less than seven years from the date they were created.

The records must show and explain the company's transactions, disclose with reasonable accuracy the company's financial position, and enable the directors to ensure that the financial statements comply with the Act. They must be kept in line with the prescribed financial accounting standards issued by the Institute of Certified Public Accountants of Kenya (ICPAK).

A company that fails to comply with the accounting records duty commits an offence, and so does each officer of the company who is in default. On conviction, a body corporate faces a fine of up to KES 2,000,000, and a natural person faces a fine of up to KES 1,000,000 or imprisonment for up to two years, or both. Under section 631(2), an officer commits a separate offence by failing to take all reasonable steps to ensure the seven-year retention duty is met, or by intentionally causing the company to breach it.

The accounting records must be kept at the company's registered office and be open to inspection by the company's officers. There is also a separate duty to prepare annual financial statements that give a true and fair view.

5. The records that decide an expense claim

Since eTIMS, the invoice is the pivot. From 1 January 2026, income and expenses declared in a return are validated against electronic data sources at the point of filing. KRA validates declared income and expenses against three sources: TIMS/eTIMS data, withholding income tax gross amounts, and import records from Customs.

An expense without a valid eTIMS invoice is at risk of being disallowed. For a resident company, a disallowed expense increases taxable profit, ordinarily taxed at thirty per cent. Other businesses apply their relevant tax regime. A business paying turnover tax does not deduct expenses when calculating that tax, so the disallowance does not arise for it.

KRA has made room for expenses that an eTIMS invoice cannot support, including salaries and wages, imports, air passenger ticketing, investment allowances, interest, fees charged by financial institutions, expenses subject to withholding tax that is a final tax, and services provided by a non-resident person without a permanent establishment in Kenya. Where a supplier is not on eTIMS, you upload a non-eTIMS expense listing on iTax and claim the expense on upload, without waiting for KRA approval. Keep the supplier's name, the KRA PIN, the date, the amount and a description of the goods or services.

6. Payroll records

An employer keeps payroll records that carry their own obligations. The records must support PAYE, NSSF, SHIF, the Affordable Housing Levy, NITA and HELB, along with payslips, the statutory computation worksheets, the bank payment confirmations and the iTax filing acknowledgements.

The same five-year tax retention rule applies to payroll records. A labour or tax audit will also ask for a written record of all employees employed under a contract of service, and the written particulars of each contract, which the Employment Act requires an employer to give within two months of the employment starting, for the written contracts covered by sections 9 and 10. The written particulars carry their own retention duty: section 10(6) of the Employment Act requires an employer to keep them for five years after the employment ends. Keep a document until every retention period that applies to it has expired.

7. What it costs to fail

The Tax Procedures Act sets a penalty for failing to keep, retain or maintain a document required under a tax law. The penalty is ten per cent of the tax payable for the reporting period, or KES 100,000 where no tax is payable for that period (section 82(1)–(2)).

Failing to submit a document other than a return by the due date carries a penalty of KES 1,000 for each day or part day of default, capped at KES 50,000. Failing to keep a document that a tax law requires is also an offence, and the general sanction for an offence under the Act is a fine of up to KES 1,000,000 or imprisonment for up to three years, or both. Note the different thresholds: the section 82 penalty applies to failure without reasonable cause, while the section 93 offence requires failure without reasonable excuse. A person is not liable to both a penalty and a prosecution for the same act or omission, and the Commissioner decides which route to take (section 80).

The penalty is the smaller part of the cost. A business that cannot produce its records puts itself at a serious disadvantage, because it cannot substantiate the figures it filed.

8. How to run the books so an audit goes smoothly

Keep a separate business account. Mixing personal and business money makes it hard to explain deposits, and KRA can assess on the information available where a return or a record is missing.

Reconcile monthly. Compare the bank statement, the sales records, the purchase records and the eTIMS records at least once a month. Finding a mismatch before an audit gives you time to investigate and correct it. During an audit, an unexplained mismatch may lead to an adjustment.

Scan documents as they arrive. A receipt photographed and filed on the day it is issued is a record. A receipt kept in a drawer until the end of the year is a risk.

Use a system that keeps an audit trail. The software does not need to be expensive. It needs to record who entered a transaction, when, and what document supports it.

Back up off-site. Records kept in one place can be lost to fire, theft or a failed hard drive. A cloud copy is a record.

9. Getting ready before KRA writes

Run your own audit once a year. Take the last return you filed and trace every figure on it to a document. Where a figure has no document, fix the record or correct the return.

Keep the five-year file current. Do not wait for KRA to ask. The file should be complete at all times, because the request can arrive at any time.

When a request arrives, respond within the time given, and keep a copy of everything you send. A request for documents is the start of a process that can end in an assessment, and the records you produce then are the ones that decide it.

Key facts