How to prepare your project email records for an audit

What does an auditor actually check beyond your formal documents?

Most AEC firms prepare for an audit by making sure their formal project documents are in order - drawings, specifications, approvals, quality records. What often gets missed is that auditors increasingly expect to see the correspondence behind those documents too: the email where a decision was actually made, a risk was flagged, or an approval was given.

If that correspondence only exists in personal inboxes, scattered across whoever happened to be involved at the time, assembling it for an audit becomes a last-minute scramble rather than something you can simply produce.

"Audit-ready at all times" is the real standard to aim for

John Staves, Managing Director at Michael Aubrey Partnership, described the standard worth aiming for: "we're also audit-ready at all times." That phrase is the test. It's not whether a firm could eventually pull together the right correspondence given enough notice. It's whether the record already exists in a state that could be handed over today, with no preparation required.

Being audit-ready at all times means the correspondence record builds itself continuously, as the project progresses, rather than being assembled reactively once an audit is scheduled.

What should you check before an audit if you're not confident your record is complete?

A few practical checks reveal how exposed a firm actually is. Can you produce every email relating to a specific decision within minutes, regardless of who sent or received it? If the person who handled a particular approval has since left the firm, is their correspondence still accessible, or did it leave with them? If an auditor asked for the full correspondence trail on a specific project over the past year, how long would it genuinely take to assemble?

If the honest answer to any of these is "it would take days" or "we're not sure," the gap isn't in the formal documentation. It's in the correspondence that explains it.

How does centralised filing make audit preparation disappear as a task?

The firms that handle audits with the least stress aren't doing more work before the audit. They've removed audit preparation as a distinct task altogether, because the record is already complete. Ideagen Mail Manager supports this by suggesting the correct project folder at the point an email is sent or received, with machine learning that improves the suggestion over time. Filing takes one click rather than a manual search through folders, and original metadata is preserved, so every piece of correspondence ends up where an auditor would expect to find it rather than needing to be reconstructed afterwards.

This doesn't just make audits faster. It removes the risk that comes with incomplete disclosure - the kind of gap that raises more questions than it answers, even when nothing was actually wrong.

Ideagen Mail Manager supports over 50,000 users across 2,500+ firms worldwide.

Frequently asked questions

What do auditors check beyond formal project documents?

Increasingly, auditors expect to see the correspondence behind formal documents too - the emails that show when a decision was made, who approved it, and why, rather than just the final document itself.

What does "audit-ready at all times" mean in practice?

It means the correspondence record is already complete and organised before an audit is ever scheduled, so nothing needs to be assembled or reconstructed when the request comes in.

How can I check how exposed my firm is before an audit?

Ask whether you can produce every email relating to a specific decision within minutes, and whether that's still true if the person who handled it has since left the firm. If the honest answer involves days of searching, there's a gap.

Does audit preparation need to be a separate task?

Not if correspondence is filed centrally as a project progresses. Firms with this in place don't prepare for audits as a distinct exercise because the record is already complete.

What's the risk of an incomplete correspondence record during an audit?

Beyond the practical delay, incomplete disclosure can raise doubts about what else might be missing, even when nothing was actually wrong - which can be more damaging than the original gap itself.