Two records. Neither overwrites the other.
What a control owner says about a control and what an auditor found are recorded separately, in the same place, and are never merged into one number.
- Design, asserted
Capable of addressing the risk.
Uhuru Manager, 14 Aug 2026
- Design, tested
No auditor test. Whether the control is capable of addressing the risk is established by an independent test.
- Operating, asserted
Nobody has recorded whether this control actually operated over the period.
- Operating, tested
No auditor test. Whether the control actually operated over the period is established by an independent test.
The file has to be trusted by people who were not there
An internal audit function is judged on one thing: whether the audit committee trusts the file. Everything else follows from that.
Spreadsheets and shared drives do not carry provenance. A cell changes and nothing records who changed it, or what it said before. The work can be sound and the file still cannot prove it.
Legacy tools do carry provenance. They are also priced in dollars for a US buyer, and for most African audit functions the licence costs more than the department it is meant to support.
What is in ResiliAudit now
- Universe
The audit universe
The population of auditable entities that the annual plan is drawn from.
- Planning
Engagements and planning
The engagements themselves, with their scope and their timing.
- Racm
The risk and control matrix
Risks mapped to the controls that address them. The spine that the testing hangs from.
- Fieldwork
Fieldwork and work papers
Evidence gathered against the plan. Work paper events are hash chained.
- Findings
Findings
What the work found, recorded so that a correction appends rather than overwrites.
- Reporting
Reports
What goes to the audit committee, drawn from the file.
Work paper events are hash chained
Each event's digest covers the one before it. Verify the chain and it states how many events it checked. Change an entry and it names the link that broke.
Assurance trail
- Routed for review14 Aug 2026, 10:32379a7663704d
- Prepared14 Aug 2026, 13:1095301aad0e87
- Signed off14 Aug 2026, 13:113f7f4deca70e
Not verified. Press verify chain.
Change any actor name, then verify again.
ResiliRisk
Risk and compliance, sharing the same evidence spine as ResiliAudit, sold as a separate module. Some of it is in the platform today.
- The risk registerAvailable
- Risk to control mappingAvailable
- The heat mapIn build
Built for the continent, jurisdiction by jurisdiction
Regulatory content is selected at onboarding rather than assumed. Three packs exist today. The rest are planned, and the list says which is which.
- South AfricaZA packAvailable
- NamibiaNA packAvailable
- LesothoPlanned
- BotswanaPlanned
- KenyaPlanned
- GhanaPlanned
- EswatiniPlanned
- MauritiusPlanned
- NigeriaPlanned
- ZambiaPlanned
- Generic African packAvailable
Every pack is marked provisional pending counsel review, in the product and here. The product says on screen which pack is in force.