Immigration Advice Authority (IAA) audit checklist
By Syed Husnain Khalid · Published 8 October 2026 · Last checked 8 October 2026 · 9 min read
Drafted with AI. Each claim was checked against the primary sources listed below by AI on 8 October 2026; a person has not reviewed it yet.
Short answer
A UK Immigration Advice Authority (IAA) audit checks that a registered organisation complies with the Code of Standards 2024 and the Guidance on Competence, by reviewing its policies, procedures and client files. The IAA gives 2–4 weeks’ notice. Have ready a complete client list, the documents named in the confirmation letter and evidence for all nine Principles.
This checklist is for organisations registered with the Immigration Advice Authority and the advisers who work in them, at Levels 1 to 3. The IAA’s registration guidance, updated on 5 October 2026, now sets out the audit process: how organisations are selected, the notice period, the client list due before the audit and the Identified Issues Report that follows. We build Filyst, case management software for immigration firms, so the last section says which records software keeps and which it does not. The sections cover what an audit is, who is audited, how it is arranged, the evidence for each Principle and what happens afterwards. It is our preparation list, not the IAA’s own audit form.
What is an Immigration Advice Authority audit?
An IAA audit is a review of a registered organisation by the Immigration Advice Authority, the UK regulator of immigration advisers. The IAA was previously known as the Office of the Immigration Services Commissioner (OISC) and took its present name in January 2025.
Older material calls the same review an OISC audit. It is a different body from New Zealand’s Immigration Advisers Authority, which shares the initials.
Section 11.2 of IAA registration explained says the Immigration Services Commissioner, who heads the IAA, has a statutory duty to ensure advisers are fit and competent and to promote good practice. Audits allow the Commissioner to do three things:
- assess whether organisations comply with the Code of Standards and the Guidance on Competence;
- review the policies and procedures submitted at registration to confirm they are operating effectively;
- examine client files and the work of authorised advisers to ensure advice is competent and cases are managed appropriately.
The Code of Standards 2024is the IAA’s rulebook: nine Principles, each supported by numbered Codes. It applies to any organisation or person providing immigration advice or immigration services in the UK, apart from those the Immigration and Asylum Act 1999 excludes. The Guidance on Competence is the Commissioner’s document that sets out the work permitted at each level and category of registration. An audit is either a premises audit or a remote audit. The same guidance also mentions a pre-registration audit for applicants; this checklist covers audits of organisations that are already registered.
Which organisations does the IAA audit, and when?
The IAA selects registered organisations for audit each year. Its guidance says the reasons for selection may include six things:
- newly regulated organisations requiring additional support;
- organisations with complaints or concerns raised in the previous year;
- changes in management, structure, areas of work or registration level;
- organisations previously audited and implementing improvements;
- organisations with staff under supervision or multiple advisers across locations;
- random sampling of organisations with no known issues.
Audit timing depends on regional officer availability and the organisation’s circumstances. A separate IAA page, Regulations that immigration advisers must follow (last updated 25 October 2024), says the IAA aims to audit all newly regulated organisations within 12 months of approval and decides when further audits are required. That is an aim, not a fixed date.
Organisations that employ solicitors have one exception. Section 10.6 of the registration guidance says the IAA will not normally review the files of solicitors regulated by the Solicitors Regulation Authority (SRA), or by the equivalent bodies in Scotland or Northern Ireland, during premises audits. If a solicitor’s conduct or work raises concerns about the organisation’s fitness or competence, the IAA may refer the matter to that regulator or ask to review examples of the solicitor’s work.
How is an IAA audit arranged?
The IAA contacts the organisation 2–4 weeks in advance to agree a date. A confirmation letter then details the audit type (premises or remote), the attendees, date and time, and the documents required and audit scope (adviser competence and policies and procedures).
For a remote audit, meetings are held on Microsoft Teams or a similar platform. Documents must be submitted electronically through a secure platform, and the IAA deletes electronic documents containing client files after the audit is concluded.
Organisations must provide reasonable access for premises audits. The guidance says failure to co-operate may result in the IAA seeking an inspection warrant, and in cancellation of registration without right of appeal if access is persistently denied.
What goes in the client list the IAA asks for?
Before the audit, an organisation must provide a complete client list covering the period since its last audit or its registration date. The IAA cross-checks the list with Home Office data. The guidance names five fields.
| Field | What to record for each client |
|---|---|
| Client name | The client's name as it appears on the file |
| Level of work and case type | The level the work was done at and the type of case |
| File opening and closing dates | The date the file was opened and, if closed, the date it was closed |
| Case outcome | The outcome, if the file is closed |
| Adviser name(s) | Every adviser who worked on the file |
The list is far quicker to produce from a register kept as files open and close than from a search through old folders two weeks before the audit.
What evidence should be ready for each Principle?
The Code of Standards 2024 has nine Principles, and every Code under them begins “You must”. The middle column below summarises what the Codes require. The evidence column is our suggestion for how to show it; the IAA’s confirmation letter lists the documents it wants for a given audit.
| Principle and Codes | What the Codes require | Evidence to have ready |
|---|---|---|
| 1: Rule of law (1.1–1.3) | Act in accordance with UK law; do not knowingly or recklessly allow anyone to be misled; do not abuse any judicial or immigration process | Attendance notes and copies of the documents behind each application and statement |
| 2: Honesty and integrity (2.1–2.2) | Act with honesty and integrity; clearly identify yourself to clients, prospective clients and third parties | Adviser and organisation named on letters, emails and the website |
| 2: Reporting misconduct (2.3–2.4) | Promptly report serious misconduct within the organisation to the Commissioner, and to the relevant authority | A written reporting procedure and a record of any reports made |
| 2: Referrals (2.5–2.6) | Do not demand, accept or offer an inducement for referring or recommending a client | A list of referral arrangements and their terms |
| 2: Fees and free advice (2.7–2.8) | Charge no fee if registered as non-fee charging; inform clients of Legal Aid and free legal advice where appropriate | Client care letter or attendance note showing the client was told |
| 3: Authorisation (3.1–3.3) | Advise only for the organisation you are authorised to work for; let no unauthorised person advise; do not work above your Level or Category without written permission | Each adviser's level and category, matched against the files they worked on |
| 3: Outsourcing (3.4) | Outsource only within approved levels and categories, with the client's prior consent | The client's consent on the file |
| 3: Complaints (3.5) | Have and implement an effective written complaints procedure | The procedure and a record of each complaint and its outcome |
| 3: Notifications (3.6–3.7) | Notify the Commissioner in writing of significant changes; notify immediately of criminal charges, convictions and relevant civil proceedings | Copies of every notification sent to the IAA |
| 3: Exemptions (3.8) | Apply in writing for any exemption from the Code and await written approval | The Commissioner's written approval |
| 4: Competence (4.1–4.4) | Be fit; give prompt, clear and competent advice; keep knowledge current; demonstrate compliance with the Continuing Professional Development (CPD) requirements | CPD records for every adviser |
| 4: Confidentiality (4.5) | Keep client affairs confidential unless the law, the Code or the client's explicit authority allows disclosure | Who can access client records; the client's authority for any disclosure |
| 5: Best interest and conflicts (5.1–5.2) | Act in the client's best interest; explain any conflict of interest in writing and get written consent before acting | The written explanation and the client's written consent |
| 5: Client care letter (5.3–5.4) | Give every prospective client an effective client care letter; keep a signed and dated copy or evidence of electronic agreement | The agreed letter on every file |
| 5: Progress (5.5) | Keep each client regularly informed, in writing, of the progress of their case | Dated letters or emails on the file |
| 5: Continuity (5.6) | Have arrangements so a case can continue if you are temporarily unable to work | Written cover arrangements |
| 5: Documents and transfers (5.7, 5.9) | Return the client's documents on request without delay; transfer the file as soon as possible on request, whether or not payment is outstanding | Dates of each request and of the return or transfer |
| 5: Closure (5.8) | Give a closure letter or statement when the case concludes or either side withdraws | The closure letter on every closed file |
| 5: Retention (5.10) | Retain all client files and records for at least six years, then destroy them securely | A retention date on each closed file and a record of destruction |
| 6: Registration number and logo (6.1–6.2) | Display the IAA registration number where appropriate; use the IAA logo only as the approval letter instructs | Website, letterhead and the approval letter |
| 6: Promotion (6.3–6.5) | Do not tout; do not criticise other organisations or advisers in promotional material; make no promotional statements about success rates | Current website, adverts and social media posts |
| 6: Name and status (6.6–6.8) | Do not use a confusing or misleading name; get authorisation before changing the name or legal status; uphold public trust in the scheme | The Commissioner's authorisation for any change |
| 7: Fairness (7.1–7.3) | Treat everyone fairly, with dignity and without prejudice; give each client equal opportunity whatever their vulnerability; show due respect to clients, the Commissioner, the Home Office, courts and other agencies | An equality policy and file notes of adjustments made for clients |
| 8: Governance and insurance (8.1–8.2) | Have effective governance, processes and policies; hold current and adequate professional indemnity insurance (PII) | Policies, who is responsible for what, and the current PII certificate |
| 8: Records (8.3–8.6) | Keep complete, clear and accurate financial records; run an effective file management system; keep attendance notes of all dealings; store records securely, accessible to the client and available to the Commissioner on request | Financial records, attendance notes on every file and a description of how files are stored |
| 8: Original documents (8.7) | Give the client a copy of any original you retain and return originals as soon as possible | A record of originals held and returned |
| 9: Fees (9.1–9.3), fee-charging organisations | Have a fee scale and charge only a reasonable fee that relates to the work done; invoice when payment is required and give proof of payment; under a prior card authorisation, take only fees invoiced seven days after the invoice was provided | Fee scale, invoices, receipts and dates of card payments |
| 9: Client money (9.4–9.7), fee-charging organisations | Hold client money in a distinct client account if you take money in advance or hold money for a client; promptly return remaining money, disbursement refunds and agreed refunds | Client account statements matched to each client, and dates of refunds |
Five of these documents were uploaded with the application for registration: an example client care letter, a PII quote or certificate, a fee scale (fee-charging organisations), evidence of a business bank account, plus a client account if payments are taken in advance, and the complaints procedure. An audit reviews the policies and procedures submitted at registration, so check that the versions in use still match what was sent.
Two timing points sit outside the Code. The IAA’s regulations page says advisers must notify the Commissioner of changes that may affect competence or fitness within 10 days of the change, where Code 3.6 says “within a reasonable period of time”. The registration guidance says advisers are asked for details of their professional development each year, when applying for continued registration.
How do I check my own files before an audit?
Sample open and closed files for every adviser and test each one against the Codes that need a document on every file: 5.4, 5.5, 5.8, 5.10, 8.5 and 9.2. These steps are our method, not an IAA procedure.
- Build the client list first, then pick the sample from it.
- Check that each file holds a client care letter the client signed and dated, or agreed to electronically.
- Check that each file holds written progress updates and attendance notes of every dealing.
- Check that each closed file holds a closure letter and a retention date at least six years ahead.
- Match every fee to an invoice and proof of payment and, where money was taken in advance, to the client account.
- Compare the level and category of the work on each file with the adviser’s authorisation.
- Record what was missing, fix it, and note the date of the fix.
The Code also expects an explanation where a process departs from an IAA Guidance Note. Guidance Notes are not provisions of the Code, and the IAA does not require permission for a departure. Organisations need to be prepared to explain why the departure was appropriate and prove the Principle was still met when work is reviewed at a premises audit.
What happens after an IAA audit?
Most organisations receive an Identified Issues Report (IIR) within 10 working days. If the audit finds no issues, the IAA confirms that in writing. The IIR outlines three things:
- breaches or poor practice;
- required remedial actions or improvements;
- requests for further information or confirmation of compliance.
Organisations should respond within 10 working days and address each action point clearly. The guidance adds that advisers may need to complete training or resit a competence assessment. If the Commissioner is not satisfied with fitness and competence, a report is issued for comment before any action, and cancellation decisions carry a full right of appeal. The guidance describes audits as an opportunity for improvement, and regional officers can provide advice.
Which audit evidence can case software record?
Case software records the evidence that is a by-product of daily work: dates, approvals and who did what. It does not write a complaints procedure, buy insurance or make a firm compliant. Filyst, our own case management product for immigration firms, records four of the items above:
- Sign-off by a second person: a case stage cannot be approved by the person who asked for the approval.
- An audit log of who did and approved what, and when.
- Deadlines on each case, with reminders 30, 14, 7 and 1 days ahead and when a deadline is overdue.
- A retention date set when a case is closed, six years by default for UK firms, with a reminder when destruction is due.
Building the retention feature showed us a gap that is easy to overlook: Code 5.10 gives the period, at least six years, and no start date. Filyst starts the clock on the day the case is closed, and a firm’s written policy needs to name its own start date in the same way. No regulator approves case software, and meeting the Code stays the firm’s responsibility.
An audit tests the Code of Standards, which the IAA Code of Standards 2024 guide explains Principle by Principle. Code 5.10 creates the six-year duty covered in how long immigration advisers must keep client files. Software for immigration firms describes how we set Filyst up, and Filyst has its plans and prices.
Frequently asked questions
How much notice does the UK IAA give before an audit?
The IAA contacts organisations 2–4 weeks in advance to agree a date, then sends a confirmation letter with the audit type, attendees, date, time, documents required and scope.
Is an IAA audit always held at your premises?
No. An audit is either a premises audit or a remote audit. Remote audits are held on Microsoft Teams or a similar platform, with documents submitted electronically through a secure platform.
When is a newly registered organisation audited?
The IAA says it aims to audit all newly regulated organisations within 12 months of approval. It selects organisations for audit each year, and timing depends on regional officer availability and the organisation's circumstances.
Can an organisation refuse an IAA audit?
Organisations must provide reasonable access for premises audits. The IAA says failure to co-operate may result in it seeking an inspection warrant, and in cancellation of registration without right of appeal if access is persistently denied.
Is an OISC audit the same as an IAA audit?
Yes. The Office of the Immigration Services Commissioner rebranded as the Immigration Advice Authority in January 2025, so both names refer to audits by the same UK regulator.