How should a company structure its document folders for audits?

Last updated: 5 November 2026

What does audit-ready mean for a document folder?

A folder is audit-ready when a person who did not create it can answer a request from an auditor, a bank or a regulator without asking the person who did. The request is usually specific: the trade licence in force on a date, every purchase invoice from one supplier in one year, the signed contract behind a payment, the Emirates ID copy of a named employee.

That gives three measurable tests. Can the document be found by number, name or date without opening files. Can you show which version is current. Can you hand over only what was asked and nothing else. A structure that passes all three also makes onboarding a new accountant or a new bank relationship much faster.

This guide is practical advice on organisation. It is not legal advice, and it does not tell you how long a record must be kept. For retention periods see the separate retention guide, and confirm anything legal with the authority or an adviser.

Why does structure matter when the authority asks for records?

The Federal Tax Authority (FTA) states that taxable persons must maintain all records and documents supporting the information provided in their tax returns. It lists documents about the transactions in the tax period, a record of assets, a record of liabilities and a record of shares held at the end of the tax period. It also states that both taxable and exempt persons must retain the relevant records for at least seven years following the end of the relevant tax period, and that administrative penalties apply when required records are not kept.

Keeping a record and being able to produce it are different things. A file that exists but cannot be found within the time an authority sets does not help you. The structure below is built so that the supporting document sits next to the entry it supports, and so that a period, an entity and a document type are always visible in the path.

What does a recommended folder tree look like?

Use a small number of top-level folders that match how the business works, not how the files arrived. Numbering the top level keeps the order stable in every tool. The tree below is a starting point for a company with one legal entity. A fictional company, Al Noor Trading, is used as the root.

Company_AlNoorTrading/
  01_Corporate/
    Licences/
    Ownership_and_Governance/
    Insurance/
  02_Tax/
    VAT/
      2026/
    CorporateTax/
      2026/
    Registrations/
  03_Finance/
    Sales_Invoices/
      2026/
    Purchase_Invoices/
      2026/
    Bank/
    Fixed_Assets/
  04_HR/
    Policies/
    Employees/
      Employee_<Name>/
  05_Property_and_Contracts/
    Tenancy/
    Customer_Contracts/
    Supplier_Contracts/
  06_Audit_and_Requests/
    2026_Request_<Bank_or_Auditor>/
  99_Archive_Review/

Three rules keep the tree usable. Do not go deeper than four levels. Put the year in a folder only where documents are produced continuously, such as invoices, bank statements and returns. Keep one place for each document, and use a link or a note rather than a second copy when two teams need it.

How should you handle several entities, branches or free zone licences?

If the group has more than one legal entity, make the entity the first level and repeat the numbered tree inside each one. Each entity has its own licence, tax registration, bank accounts and contracts, and an auditor or bank asks about one entity at a time.

Shared documents such as a group policy or a master supplier agreement go in a separate Group folder at the same level as the entities. A branch with its own licence is treated as its own entity in the tree. If a branch only uses the parent licence, give it a subfolder under the parent and keep its tenancy and utility documents there.

Do not mix personal documents of owners with company documents. Owner passports and Emirates ID copies sit under Ownership_and_Governance, with restricted access, and are never placed in a shared general folder.

How should files be named?

A fixed name pattern lets a person find a file from the name alone. InstantDrive uses DocCategory_EntityName_Identifier_ValidityDate.pdf. The category says what it is, the entity says who it concerns, the identifier is the document number, and the validity date is when it ends or, for a one-time document, the document date. Dates are written year-month-day, the notation described in ISO 8601, so alphabetical order is also date order.

Use no spaces, no Arabic and English mixed in one field, and no words such as final or new. Write the entity name in a short fixed form and use the same form every time, so that a search for one spelling finds every file.

Every name and number above is invented for the example. They do not belong to a real company or person.

Who should own which folder?

Each top-level folder needs one named owner who is responsible for completeness, naming and the quarterly review. The owner is not necessarily the only person who uploads. Ownership means that when something is missing, one person is asked first.

The table suggests an owner by role. Small companies often combine roles. The point is that no folder is owned by nobody, and that no folder is owned by a person who has left.

What access rules should apply?

Apply the smallest access that lets people do their work. Grant access to a folder, not to the whole archive, and review it when a person changes role. HR files, owner identity documents and bank details are the most sensitive and should be limited to a short named list.

Separate three kinds of access. Reading is for people who need to look things up. Adding is for people who upload and name files. Changing or deleting is for the folder owner and one deputy. Most mistakes come from broad delete rights.

Never email a folder link that has no expiry to an outside party. Give an auditor or bank only the files in the request folder, for the time the review lasts, and remove access afterwards. Record in the request folder who received what and when.

How do you answer an outside request using a request folder?

Create one subfolder in 06_Audit_and_Requests for each request, named with the year and the party, for example 2026_Request_BankX. Copy or link into it only the documents that were asked for, in the order of the request letter. Keep the original request message in the same folder.

This protects you in two ways. The outside party sees only what they asked for. You also keep a record of exactly what was supplied, which matters if a question comes back months later. When the request closes, move the folder to 99_Archive_Review or keep it where it is, but do not leave it open to the outside party.

For tax requests, remember what the FTA states: records must be available to support the information in the return. The supporting document, not a summary spreadsheet, is what answers the question.

What should a quarterly review routine include?

A short routine run once every three months keeps the structure from decaying. It takes one to two hours for a small company if it is done on a fixed date. Put it in the calendar of the finance manager and name a deputy.

Write the outcome in a one-page log: date, who ran it, what failed, what was fixed. A dated log shows an auditor that the process runs.

What are the most common mistakes?

The first is organising by person or by the date of upload. A structure called Ahmed_Downloads cannot be handed over when Ahmed leaves. The second is keeping the same document in three places, so that nobody knows which copy is current. The third is naming files after the scanner or the phone, so that the name carries no information.

Other frequent mistakes: mixing drafts and signed versions in one folder, storing only the summary and not the supporting document, letting the folder grow without a review date, giving every employee delete rights, and treating the request folder as permanent shared access for an outside party.

A final mistake is building a perfect tree and never testing it. If the quarterly retrieval test takes a day, the tree is wrong, however tidy it looks.

How does InstantDrive help with this structure?

InstantDrive stores trade licences, Emirates IDs, tenancy contracts, tax invoices and bank letters, reads the key number and date from each file, and names the file in the pattern DocCategory_EntityName_Identifier_ValidityDate.pdf. Because the number and expiry date are part of the name, you can find a document by number or by expiry date without opening it, which supports the expiring-documents step above.

PDFs are compressed and phone image scans are converted to WebP before storage, each upload is limited to 100 MB, and a download uses a link that expires after 15 minutes. Plans start at $9 per user per month. A flat $69 per month covers a whole company on one corporate email domain. Every plan begins with a 30-day free trial and no credit card.

What does InstantDrive not do for this?

InstantDrive does not design your folder tree for you, decide who owns each folder or run your quarterly review. It does not rename files stored in other systems, and it does not give legal, tax or audit advice. It also does not tell you how long you must keep a record.

The tree, the owners and the routine in this guide are suggestions to adapt. The legal statements come from the FTA page linked below and may change, so check the issuing authority or a qualified adviser for your own case.

Primary source: Federal Tax Authority, statement on corporate tax record keeping