Always ready for a KGK audit: the audit-ready reconciliation setup

Every company in Türkiye subject to statutory financial audit lives through the same scene once a year: December arrives, and so does the panic. The auditor shows up, files are opened, documents are hunted down, missing items get patched up. A process that should take a week sometimes stretches into three.

There is exactly one reason for this panic: the company was not audit-ready throughout the year. Continuous auditability is a matter of discipline, not a matter of timing.

What does audit-ready mean?

The Independent Auditing Standards (BDS) published by the KGK (Turkish Public Oversight Authority) set four fundamental conditions for a company to be "auditable":

1. All financial records are complete. No missing invoices, no transactions left in limbo. 2. Every record rests on a justification. The question "why is this item here?" can be answered with a chain of records. 3. Third-party verifiability. Every item in the ledger can be tied back to a bank transaction or an e-invoice. 4. A complete audit trail. The question "who changed this row, when, and why?" can be answered.

Being audit-ready means keeping auditable records every single day. Year-end panic is merely a symptom of not being audit-ready.

Annual spike vs continuous audit

In the traditional model, audit preparation is an annual campaign:

| Mode | Frequency | Cost | Stress | |---|---|---|---| | Annual spike | 1× / year | 3-5 intense weeks | High | | Continuous | Every day, automated | Marginal | None |

The modern continuous audit approach does a little audit prep every day — the audit file is produced automatically at month-end close, with no extra effort asked of the team.

The infrastructure of audit-readiness: 4 cornerstones

1. Complete data collection (from 3 sources)

Bank statements, e-invoices, ledger entries — all three must be in place. Three-way reconciliation guarantees this completeness.

2. Automated categorization and matching

Every transaction must be correctly categorized against a chart-of-accounts item. Manual categorization is error-prone; automated categorization runs on rules + ML patterns.

3. Audit trail (immutable log)

Every record, every change, every approval must be time-stamped and tamper-proof. Modern systems use a blockchain-like immutable log or an append-only journal.

4. One-click reporting

When the auditor arrives, every report should be one click away:

• Account reconciliations
• Bank reconciliation
• Customer/supplier reconciliation
• VAT/withholding report
• FX difference report

The iFinances Reconciliation module integrates all four of these elements.

How does continuous audit work?

Continuous audit spreads the audit activity over time instead of concentrating it at a single point:

Daily (automated):

• Bank integrations are pulled
• E-invoices are retrieved from GİB (the Turkish Revenue Administration)
• Three-way cross-reconciliation runs
• Anomalies are detected and risk-scored

Weekly (manual review):

• Low-confidence matches are reviewed by the team
• High-risk anomalies are categorized

Monthly (close):

• All accounts reconcile automatically
• The "audit file" is exported with one click
• The error rate stays below 0.5%

Annually (the audit visit):

• The auditor walks in to a ready-made audit file
• Their questions are answered from the time-stamped immutable log
• Sign-off is completed in 1-3 days

The 5 most common audit questions — and the modern answers

1. "Why was this invoice matched this way?" Traditional: "I don't remember — let me dig through Excel." Audit-ready: "Match date, reasoning layers, confidence score — all right here, from the explainable AI log."

2. "Who changed this item last month?" Traditional: "We'd have to compare Excel versions — half a day." Audit-ready: pulled from the audit trail in 5 seconds — user, timestamp, old value, new value.

3. "Was the correct CBRT (Central Bank of Türkiye) rate used?" Traditional: "We'd have to check manually." Audit-ready: the CBRT rate was fetched automatically via API for every FX transaction — see the CBRT official rate guide.

4. "Are there any duplicate payments?" Traditional: "We'd have to comb through 10,000 rows." Audit-ready: the anomaly detection module has already flagged duplicate payments; the list is ready — see the anomaly detection guide.

5. "Is the VAT return consistent with the ledger?" Traditional: "We need to check it item by item." Audit-ready: the automated consistency report has already been generated.

ROI: the cost/benefit balance of continuous audit

Typical figures for a 50-employee company:

| Item | Traditional | Continuous | |---|---|---| | Audit preparation (annual team hours) | 240 hours | 12 hours | | Audit fees (rework on missing files) | +20-30% | +0% | | Risk of penalties (missing items) | High | Low | | Monthly close time | 3-4 days | 4 hours |

The real payoff of continuous audit isn't just time — it's confidence. The CFO knows the company is ready whenever the auditor walks in.

Which companies is it mandatory for?

Under KGK regulation, independent audit is mandatory for companies meeting certain criteria:

• Publicly traded companies
• Mid-to-large companies above certain asset/revenue thresholds
• Banks, insurance companies, and capital-market firms

For these companies, being audit-ready is a legal obligation. For everyone else, it is simply good management practice.

Conclusion

Being audit-ready is not a goal — it is an operating mode. Being a little bit ready every day is what eliminates year-end panic.

The iFinances Reconciliation module was built on continuous audit principles. For the detailed architecture, see the three-way reconciliation guide, or request a demo to see how it could transform your own audit process.