Run your entire internal audit inside ERPNext

Most internal audit teams in Kenya still run on three tools. Excel for the risk register. Word for working papers. Email for follow-up. The evidence is scattered, the sign-offs are slow, and when the external auditor arrives, the team spends weeks pulling samples and reconstructing what happened.

The root cause is separation. The audit happens outside the system that produces the transactions. Auditors ask finance for GL extracts, HR for payroll reports, and procurement for purchase orders. By the time the evidence is assembled, it is already stale.

The audit lifecycle, one system

Mkaguzi runs the full internal audit lifecycle natively inside ERPNext. It starts with the audit universe: every auditable entity scored by inherent and residual risk. That risk score drives the annual plan, so scarce auditor time goes where the risk is highest, not where the schedule is easiest.

Each engagement moves through Planning, Fieldwork, Reporting, and Issued states. Working papers carry prepared-by and reviewed-by sign-offs. Findings are structured with condition, criteria, cause, and consequence. Every finding links to a corrective action plan with an owner, milestones, and verified closure.

• Audit universe with inherent and residual risk scoring.
• Risk-based annual audit plan.
• Governed engagement lifecycle with workflow states.
• Working papers with versioning and reviewer sign-off.
• Finding to CAP to follow-up tracker, fully closed loop.
• Board reports and audit committee briefings generated on schedule.

Evidence that captures itself

Because Mkaguzi lives on the same Frappe site as the ERP, it can watch the ledger directly. Every GL entry, journal, payment, invoice, salary slip, stock movement, and user or role change is copied into an immutable audit trail entry. The trail cannot be edited. Deleted documents are archived before removal.

This changes the economics of an audit. External auditors do not need to request large samples and manually reconcile them. The evidence is already captured, timestamped, and searchable. Audit prep time drops from weeks to days.

Continuous monitoring between audits

Traditional audit finds problems once a year. Continuous monitoring finds them now. Rules run hourly against live ERP data and raise monitoring exceptions when a pattern breaks. A payment to a new supplier above a threshold. A stock movement outside normal hours. A user permission change that grants write access to a sensitive account.

The exceptions feed back into the risk register and the annual plan. Audit coverage stops being a point-in-time exercise and becomes a live control.

AI as assistant, not auditor

Mkaguzi includes an AI finding reviewer and a multi-agent testing engine, but the auditor keeps sign-off. The AI can draft, score, and enrich a finding. It can run routine control tests on schedule. It cannot close an engagement, approve a corrective action, or delete a working paper.

For sensitive environments, the model can run on a local Ollama instance. Audit data never leaves the server. That matters for banks, SACCOs, and any organization where member or customer data must stay on-premise.

Who this is for

The product is built for Chief Audit Executives, audit managers, risk and compliance officers, and audit committees at banks, SACCOs, government agencies, NGOs, and mid-to-large enterprises that already run ERPNext or plan to. If your audit function is mature enough to have a charter and an annual plan, Mkaguzi gives you the system to run them properly.

The bottom line

Internal audit should not be a scavenger hunt for evidence. It should be a governed, evidence-backed process that gives the board assurance and management a clear path from finding to fixed. Moving the audit inside ERPNext is how you get there.