Audit working papers
Audit programmes, tests, notes on findings and the evidence behind the auditor’s report, per client and per financial year.
A client portal and document archive for accounting and audit firms
Your audit team receives hundreds of client documents on every engagement, and some are already being read with AI. In folders.id each engagement has its own folder, AI reads only the folders you allow, and every access is on the record.
What you hold
What an accounting firm holds
A client’s unpublished financial data, and the working papers your opinion rests on.
Documents from the client (PBC)
Financial statements, general ledgers, bank statements, fixed asset registers and contracts, sent against your request list.
Confirmations and representations
Bank and receivables confirmation replies, and the management representation letter signed at the end of the engagement.
Engagement letters and reports
The engagement letter, draft auditor’s reports and the management letter, back and forth with the client until final.
What binds you
What you are bound by
A summary, not legal advice. For certainty, read the regulation itself.
Confidentiality of client information
The Public Accountants Law (UU 5/2011), Article 29(1): a public accountant and their associated parties must keep confidential the information obtained from a client.
Working papers and professional standards
Article 25(2) of the same law requires a public accountant to follow SPAP and the professional code of ethics, and to prepare working papers and be responsible for them. SA 230 within SPAP governs audit documentation, including how long it is kept.
Personal data in the files
Bank statements, payroll and staff lists carry personal data. As a controller, your firm must protect it and prevent unauthorised access (UU 27/2022, Articles 35 and 39), and record its processing activities (Article 31).
Where folders.id fits
Where folders.id fits in your firm
It does not make you compliant on its own. What it gives you is control over who and what opens a document, and a record you can show.
One folder per engagement
Organise folders by client and financial year and share each only with the engagement team. Periodic access reviews help make sure people who moved teams no longer hold access.
The PBC list through a portal
Send a portal link that collects documents, with a password and an expiry. Every file is scanned for malware before it is opened, and the client needs no account.
From documents into a table
Define columns such as invoice number, date and amount. The AI fills them with a quote from the source document, and totals are counted by the database, not guessed by a model.
AI with clear limits
Ask the built-in AI or connect Claude and ChatGPT. Answers link to the passages they quote, the AI reads only the folders you pick, and NIK and account numbers are masked first.
The agreed version, on the record
The client approves a specific version of the draft report through the portal, any two versions can be compared, and a legal hold keeps an engagement under inspection from being deleted.
Related guides
Indonesia PDP Law Checklist for Professional Firms
A practical Indonesian PDP Law checklist for law firms, notaries, tax consultants and audit firms: what to have in place before GR 33/2026 takes effect.
Read the guideIs ChatGPT Safe for Confidential Client Documents?
How to use ChatGPT, Claude and Copilot on client documents without losing control: account types, model training, data location and a short AI policy.
Read the guideAI Acceptable Use Policy Template for Firms
A copy-ready AI acceptable use policy for law, notary, tax and accounting firms: approved tools, banned data, human review, incident reporting and rollout.
Read the guideQuestions
Questions accounting firms ask
Does this replace our audit software?
No. folders.id does not build audit programmes or calculate materiality. It is where client documents and working papers are kept, found and shared, with AI access you limit.
Can we show what an AI has read?
Yes. The activity record keeps every search and read an AI made, refusals included, and the AI access report exports to CSV. The record of processing is built from your live settings rather than a template.
Where are our files stored?
Uploaded files are stored with an Indonesian object-storage provider; the application and its database, including the text read out of documents for search, currently run in Singapore. When an AI reads a document, the content goes to the AI provider you connected and that provider’s policies apply — so you choose the folders, and identity numbers are masked first.
Can we bring files across from Google Drive or SharePoint?
Yes. Import once or sync folders from Google Drive, Dropbox, OneDrive, SharePoint and Box. Drive, Dropbox, OneDrive and Box can also sync both ways.
Does using folders.id make us compliant?
No software can promise that. folders.id helps you limit access, mask identity numbers for AI, and keep a record you can show. Your policies, methodology and procedures remain yours.
Try it on one engagement
Create a free workspace, send one PBC portal to a client, and connect an AI to one folder. Then see for yourself what was recorded.
Create your workspace