Mkaguzi: internal audit & GRC
Run your entire internal audit inside your ERP
Mkaguzi (Swahili for auditor) is an IPPF-aligned, AI-assisted internal audit and governance platform that manages the full risk-based audit lifecycle, audit universe to board report, natively on ERPNext. It automatically captures immutable audit trails on your GL, payments, payroll, and stock transactions, runs continuous-monitoring rules between audits, and offers an opt-in AI finding reviewer plus a multi-agent testing engine where the auditor keeps sign-off. It gives audit committees assurance, gives auditors AI leverage, and gives management a closed-loop path from finding to fixed.
Live audit run on your own data
Key capabilities
Risk-Based Audit Universe & Annual Plan
Register auditable entities with inherent and residual risk scores, then prioritize and budget the annual plan by risk. Audit effort goes where risk is highest, and the plan is defensible to the board.
Governed Engagement Lifecycle
Audit Engagement moves through role-gated Planning, Fieldwork, Reporting, and Issued states with budgeted-versus-actual hours, team, and scope. Consistent, controlled execution with full time and budget visibility.
Working Papers with Sign-Off
Structured working papers capture objective, methodology, test results, and exceptions with prepared-by and reviewed-by sign-off, versioning, and revision history. Review-ready, defensible evidence.
Findings → CAP → Follow-Up Loop
Every finding (condition, criteria, cause, consequence, severity, risk score) links to a Corrective Action Plan with owner, milestones, and verification, tracked to closure. Nothing slips through the cracks.
Automatic Immutable Audit Trail
An Audit Trail Entry is created on insert, update, and trash of 20+ ERP doctypes: GL, Journal, Payment, Invoices, Payroll, Stock, and User/Role changes. Tamper-evident evidence, captured without manual pulls.
Continuous Monitoring
A rule engine runs hourly against live ERP data, raising Monitoring Exceptions and Anomaly Alerts between audits. Control failures are caught in near-real-time, not next year.
AI Finding Reviewer & Multi-Agent Engine
An opt-in, Ollama-powered reviewer enriches, scores, and stress-tests findings while the auditor retains sign-off. Financial, Risk, Compliance, Asset, and Discovery agents run scheduled tests and log evidence. Coverage without headcount.
Board & Committee Reporting with QAIP
Board Report, auto-generated quarterly Audit Committee Briefings, and executive summaries, plus whistleblower intake, IIA quality assessment (QAIP), and auditor competency and CPE tracking built in.
Why teams choose this
- Cut external-audit prep from weeks to days: evidence is already captured, immutable, and searchable
- Never lose a finding: every issue gets an owner, a plan, and verified closure
- Audit where the risk is with a risk-scored universe that drives your annual plan
- Extend coverage without headcount: AI agents run routine control tests on schedule
- Keep audit data at home: run the AI on local Ollama so sensitive data never leaves your servers
- Catch control failures between audits with hourly continuous-monitoring rules
- Deliver board-ready governance with standardized, on-time committee and board reporting
- Prove conformance with an IPPF-style charter, working-paper sign-off, QAIP, and CPE tracking
Frequently asked questions
What is Mkaguzi?
Mkaguzi, Swahili for auditor, is a native ERPNext internal audit and governance management system covering the full risk-based audit lifecycle from audit universe to board report. It installs as a Frappe app on the same site and hooks core ERP transactions automatically, with an opt-in AI finding reviewer and a multi-agent testing engine where the auditor keeps sign-off.
How does Mkaguzi use AI, and is my audit data safe?
An opt-in, Ollama-powered finding reviewer enriches, scores, and stress-tests findings while the auditor retains sign-off, and Financial, Risk, Compliance, Asset, and Discovery agents run scheduled tests and log evidence. You can run the model locally on Ollama so sensitive audit data never leaves your servers.
How does Mkaguzi track corrective actions to closure?
Every finding, with its condition, criteria, cause, consequence, severity, and risk score, links to a Corrective Action Plan carrying an owner, milestones, and verification, tracked by a follow-up tracker to closure. Nothing slips through the cracks, and management gets a closed-loop path from finding to fixed.
Does Mkaguzi capture an immutable audit trail automatically?
Yes. An Audit Trail Entry is created on insert, update, and trash of 20-plus ERP doctypes, including GL, Journal, Payment, Invoices, Payroll, Stock, and User and Role changes. Deleted documents are archived before removal, giving tamper-evident evidence captured without manual pulls.
Is Mkaguzi aligned to professional audit standards?
Yes. It follows an IPPF-style lifecycle with charter, audit universe, working-paper sign-off, quality assessment (QAIP), and auditor competency and CPE tracking. Board reports, auto-generated quarterly Audit Committee Briefings, and whistleblower intake round out the governance package.