An Audit is more than just an administrative check — the duration, timelines, and frequency of an audit have a direct impact on a company's compliance, reputation, and smooth operations. This article explains practically how long is the audit period, legal or regulatory restrictions, how many times an audit is usually performed, as well as when the audit needs to be repeated. At the end there are practical recommendations for managing the audit process more efficiently.
Ideally, how long is the audit limit?
- Annual external Audit generally held every year and take time a few weeks to a few months, depending on the size and complexity of the enterprise. In the meantime, capital market regulator (issuers / public companies) set strict reporting time limits—for example, OJK regulations regulate the period of submission of periodic financial statements.
- Internal audit it does not have a single “time limit": its frequency and duration are of the nature risk-based (based on risk assessment), so it can range from daily/weekly audits on specific processes to annual reviews for other functions. The IIA guidelines encourage risk-based audit planning and periodic quality reviews.
How long is the audit period?
The audit process can be divided into three main phases — the estimated duration of each phase helps management prepare resources:
- Planning & preparation (planning): 1-4 weeks
- Includes business understanding, scope determination, risk assessment, and initial document requests.
- Fieldwork: 2-8 weeks (can be more on large companies)
- Transaction checks, third party confirmations, sampling, and interviews. The complexity of the system and the quality of documentation greatly affect the duration.
- Reporting & communication of findings: 1-3 weeks
- Preparation of audit reports, discussion of findings with management, and finalization of opinions/recommendations.
Total average: 2-12 weeks for most medium-sized companies; longer for large corporations, multi-entities, or public entities that have a group structure and cross-country operations.
What are the limits for regulatory audits?
Audit time limits depend on the legal context and type of entity:
- Public company / issuer: subject to the provisions of the OJK / exchange regulations governing deadline for submission and announcement of periodic financial statements (e.g. POJK provisions on the submission of periodic financial statements). Delay beyond the specified limits may be subject to administrative penalties.
- Limited liability company (PT): UU No. 40 of 2007 regulates audit obligations for companies with certain criteria (eg. total assets or specific turnover). That is, for a PT that meets these criteria, an audit is not just a good practice but also a legal obligation.
- Regulated sectors (banks, insurance, pension funds): there are additional restrictions and requirements from regulators (FSA, BI, etc.) regarding the frequency and scope of audits.
Notes: The "audit deadline “is different from the” reporting deadline" — the audit can be completed before or at the same time as the reporting deadline set by the regulator.
How many times are audits performed?
- External Audit: generally once per year for annual financial statements. Public companies are required to prepare annual reports that are audited annually by Registered Public Accountants.
- Internal audit: more flexible frequency — risk-based. High-risk areas (cash, inventory, receipts) may be audited periodically (quarterly or even monthly), while stable areas may be audited annually or biennially. The IIA guidelines recommend internal audits be designed based on an organization's risk assessment so that the frequency of audits reflects risk priorities.
Best practices: a combination of regular internal audits (for operational and compliance controls) and annual external audits (for independent opinions on financial statements).
How Many Times a Year Should an Audit Be Done at Minimum? Frequency Table and Sample 4-Quarter Schedule
Short answer: there is no single minimum number that applies to every audit. Only the audit of financial statements is clear-cut: once for each financial year for entities required to be audited. For internal audit, professional standards only require a risk assessment at least once a year as the basis for the audit plan. After that, the frequency for each area follows its level of risk. So if you come across a question such as “how many times a year must internal audit be performed at a minimum”, answer with the concept: at least one risk assessment cycle and annual audit plan, not a fixed number.
The table below helps determine the right answer for the type of audit in question.
| Types of audits | Typical frequency | Basis |
|---|---|---|
| Financial statement audit by a public accountant (limited liability companies required to be audited) | Once per financial year | Law No. 40 of 2007, Article 68 paragraph (1): mandatory if the company raises public funds, issues debt acknowledgments to the public, is a public company or state-owned company (persero), has assets and/or business turnover of at least Rp50 billion, or is required by other regulations |
| Annual financial statements of issuers and public companies | Once per year; deadline for submission to OJK and announcement: end of the third month after the financial statement date | POJK No. 14/POJK.04/2022 Article 4 |
| Audit committee meetings of issuers (not an audit, but they set the reporting rhythm) | At least once every 3 months | POJK No. 55/POJK.04/2015 Article 13 |
| Company internal audit (SPI or SKAI) | No universal minimum number. There is an annual audit plan; the frequency for each area follows risk (high-risk areas may be audited quarterly or monthly) | Global Internal Audit Standards (IIA, effective January 2025) Standard 9.4: a risk assessment at least once a year as the basis for the plan. For issuers, POJK No. 56/POJK.04/2015 Article 7 letter a requires the internal audit unit to prepare and carry out an annual internal audit plan |
| Government internal audit (APIP or inspectorate) | Follows the annual oversight work program (PKPT) | The internal oversight regulations applicable to each agency or region; check the regulations that bind your entity |
| Special audit or investigation | Based on a trigger event, not scheduled | Risk assessment results, suspected fraud, or requests from management and regulators |
Two things are often confused. First, the deadline for submitting reports to OJK is a reporting deadline, not the duration of the audit process. Second, a limited liability company that does not meet the criteria of Article 68 is not automatically required to be audited under that law, although creditors or investors may still request it. To understand the logic behind determining frequency, also read the risk-based audit guide and how to prepare an audit plan.
Example of a 4-Quarter Annual Audit Schedule for a Mid-Sized Company
The following example is fictional and for illustration only. PT Contoh Nusantara has assets above Rp50 billion, a financial year running from January to December, and an internal audit team of 3 people. Cash and bank are assessed as high risk, so they are audited every quarter. Receivables and inventory are medium-high risk, so they are audited twice a year. Procurement, payroll, and fixed assets are lower risk, so they are audited once a year.
| Quarter | Internal audit engagements | Other activities |
|---|---|---|
| Quarter 1 (January to March) | Annual risk assessment and audit plan approval. Cash and bank audit (1 engagement) | Year-end audit of the prior year's financial statements by the public accountant; the internal team prepares documents |
| Quarter 2 (April to June) | Audit of cash and bank, receivables, procurement (3 engagements) | Annual GMS, no later than 6 months after the end of the financial year (Law No. 40 of 2007 Article 78 paragraph 2) |
| Quarter 3 (July to September) | Audit of cash and bank, inventory, payroll (3 engagements). Review risks mid-year and update the plan if necessary | Coordinate the schedule and document list with the public accountant |
| Quarter 4 (October to December) | Audit of cash and bank, receivables, year-end inventory, fixed assets (4 engagements) | Preparation for the book closing; preliminary examination by the public accountant if agreed |
Recalculate the totals: cash and bank 4, receivables 2, inventory 2, procurement 1, payroll 1, fixed assets 1, making 11 engagements a year. Per quarter: 1 + 3 + 3 + 4 = 11. If there are major findings or changes such as an ERP migration, this plan may be shifted. That is why professional standards say the audit plan must be dynamic and updated as risks change. Make sure the results of each engagement are also followed up by the deadline, including through reporting to the audit committee for companies that have one.
When should you repeat the audit?
There are conditions that require the audit to be repeated or followed up more quickly:
- Material findings or serious nonconformities
- If the auditor finds material errors, fraud, or control weaknesses that affect the opinion, a follow-up audit or re-audit of the relevant area is often necessary.
- Restatement of financial statements
- A restatement of an already published report usually triggers a re-audit for the revised year / post.
- Significant changes in the environment or system
- For example ERP migrations, mergers & acquisitions, or far-reaching regulatory changes.
- Regulator or stakeholder requests
- Regulators, creditors, or investors may request additional audits when there are indications of non-compliance or material doubts.
- Penilaian kualitas internal audit (external quality assessment)
- The IIA requires an external assessment of the internal audit function at least every five years; the results may recommend a re-audit or improvement of the methodology.
Repeated audits are usually more expensive and time-consuming; therefore prevention through internal controls and neat documentation is much cheaper.
What Factors Lengthen or Shorten the Audit Duration?
Several key factors that determine the duration of the audit:
- Readiness of documents & notes: neat data = faster fieldwork.
- Transaction complexity: cross-entity transactions, derivatives, and complex contracts require additional time.
- Accounting & automation systems: ERP and integrated systems accelerate sampling and verification.
- Management cooperation & response to auditor requests: quick response shortens the process.
- Audit team experience & scope of work: experienced auditors and clearly defined scope help efficiency.
What Are the Practical Recommendations for an Efficient and Timely Audit?
- Start preparation early: clean up transaction evidence, reconciliation, and supporting documents before the audit begins.
- Gunakan checklist & audit tracker: makes it easy for teams to close findings and monitor status.
- Adopt a risk-based approach for internal audit-focus on material and high-risk areas.
- Take advantage of audit technology (data analytics, continuous monitoring) to reduce manual work and speed up sampling.
- Routine communication between the Finance, Management, and auditor teams to avoid delays while fieldwork is underway.
FAQ About Audit Timeframes
How long does one audit process take?
On average 2–12 weeks for most mid-sized companies: planning and preparation 1–4 weeks, fieldwork 2–8 weeks, and reporting and communicating findings 1–3 weeks. Large corporations, multi-entity groups, or cross-border public entities generally need longer.
How many times is an audit performed in a year?
External audits are generally once a year for the annual financial statements. Internal audits are more flexible because they are risk-based — high-risk areas such as cash and inventory can be audited quarterly or even monthly, while stable areas suffice annually.
What are the audit limits under Indonesian regulations?
Public companies are subject to OJK provisions and exchange rules on deadlines for submitting periodic financial statements, with administrative sanctions for lateness. Limited liability companies meeting certain criteria must be audited under Law No. 40 of 2007. Regulated sectors such as banks and insurance have additional requirements from their regulators.
Is the audit deadline the same as the reporting deadline?
They differ. An audit can finish before or at the same time as the regulator's reporting deadline — the reporting deadline governs when reports must be submitted, not how long the audit process runs.
When does an audit need to be repeated?
When material errors, fraud, or control weaknesses affecting the opinion are found; when a restatement of the financial statements occurs; when there are significant changes such as an ERP migration or mergers and acquisitions; at the request of regulators or creditors; and following the results of the external quality assessment of the internal audit function required at least every five years.
What affects how long or short an audit is?
The readiness of documents and records, transaction complexity such as cross-entity contracts and derivatives, the level of accounting system automation, how quickly management responds to auditor requests, and the audit team's experience and the clarity of the examination scope.
Optimize your business Audit strategy with Audithink
There is no one single answer to “how long is the audit limit” — the duration and frequency depend heavily on the type of audit (external vs. internal), the size and complexity of the venture, as well as the requirements of regulators. However, with good planning, a risk-based approach, and the utilization of technology, companies can cut audit time without sacrificing quality.
If you want to simplify audit scheduling, monitor findings, and ensure follow-up is orderly — Audithink it offers end-to-end audit management features (scheduling, checklists, tracking findings, progress dashboards) designed to speed up processes and improve the quality of internal controls. Learn the full features and try request free demo to see how the platform can be adapted to your company's audit needs.
