Assessment, governance & sustainability
Records audit and assessment: know what you hold before you change anything
A systematic review of your records environment, ending in a costed action plan.
A records audit is the starting point for almost every records project. We look at the paper and digital records you hold today, how they are kept and who uses them. We check them against the laws and rules that apply to you. Then we tell you plainly what should be done, in what order and at what cost.
It suits organisations in Nairobi and across Kenya that know their records need attention but are not sure where to begin. The audit gives you facts to plan with, instead of guesses.
Who it is for
Boards and managers who need a clear picture before they commit money to digitisation or a new system. Finance and compliance teams preparing for KRA, SASRA, donor or Auditor-General audits. Organisations that have grown quickly, merged departments or lost the staff member who knew where everything was. The method is the same for SMEs, NGOs, SACCOs, law firms and government entities; only the rules change.
The problem it solves
Most records problems stay invisible until something goes wrong. A file cannot be found during an audit. A contract exists only in one person's email. Old boxes fill a store room because nobody is sure whether they can be destroyed. Personal data is kept longer than the Data Protection Act 2019 allows. Without an audit, each of these is handled as an emergency. With one, they become items on a plan, ranked by risk.
How we do it, step by step
Scoping call
We agree which departments, sites and record types are in scope, and who we should speak to.
Inventory
On site, we survey registries, store rooms and shared drives, and note what exists, where it is and what condition it is in.
Interviews
Short conversations with the people who create and use records show how files really move, which is often different from the written procedure.
Legal check
We compare what you hold with the rules that bind you: the Data Protection Act 2019, PPADA 2015, the Tax Procedures Act and KRA requirements, SASRA rules and donor agreements, as they apply.
Risk rating
Each gap is rated by likelihood and impact, so the urgent items stand out from the merely untidy ones.
Report and plan
You receive a written report and a prioritised, costed action plan, and we walk your team through it.
What a records audit looks at
We look at four things. What records exist and where they sit. Whether they are complete and can be found when needed. Whether they are kept for the right length of time, no longer and no shorter. And whether access is controlled, especially for personal and financial information.
Planning digitisation from the audit
If you are thinking about scanning, the audit includes a volume and cost estimate for document digitisation. It also identifies records that have passed their retention period, so you do not pay to scan files you are entitled to destroy. That list feeds directly into a retention schedule.
What you receive
- Records inventory and gap analysis report
- Compliance risk assessment against DPA 2019, PPADA 2015, KRA, SASRA and sector requirements
- Prioritised and costed action plan
- Digitisation volume and cost estimate
Timelines and cost
Fieldwork usually takes one to three days on site, depending on the number of sites and the volume of records. The report follows once the findings are checked with you. Fees are scoped per engagement, and you receive a written proposal within 48 hours.
Frequently asked questions
- How long does a records audit take?
- Fieldwork is usually one to three days on site. Larger or multi-site organisations take longer, and the proposal sets out the schedule before you commit.
- Do you need to read our confidential files?
- We need to see how records are kept, not to read every file. Where we handle confidential material, we work under a signed confidentiality agreement and your own access rules.
- What happens after the audit?
- You decide. Some organisations act on the plan with their own staff. Others ask us to deliver parts of it, such as a retention schedule, records organisation or an EDMS.
- Is the audit only for paper records?
- No. Shared drives, email and existing systems are part of the picture, because most organisations now hold records in both forms.
Related services
Retention & Disposal Policy
A written, legally grounded schedule that says what to keep, for how long, and how to dispose of it.
Paperless & Sustainability Advisory
A measured route to paperless operations, with the evidence to report progress.
Physical Records Organisation & Cleanup
Sort, classify, weed and arrange paper files under a purpose-designed filing scheme.
Sectors this service is built for: Government entities, SACCOs, NGOs, SMEs, Law firms.
Related insights
Start with a conversation.
Tell us what your records look like today. We will meet you on site, listen, and send a written proposal within 48 hours.