Audit software for Rwanda's audit firms and the internal auditors of public and regulated entities.
Rwanda asks for long memories: ten accounting periods of company records, ten years of tax records, and ten years of working papers for auditors accredited by the National Bank. AuditEDMS gives each record its own retention date and keeps it in your own SharePoint with a receipt, runs the statutory audit from tender to archive with its gates and clocks, sends request lists that clients and auditees answer online, and records time and fee notes, for ICPAR firms and for internal audit in central government, districts, banks and listed companies.
Built for ten-year retention, ICPAR's reviews and the Organic Law's internal audit duties.
Most Rwandan retention periods are ten years, not five or seven, and several of them also say where the record is kept. ICPAR reviews every firm authorised for statutory audit, BNR adds its own conditions for the auditors of banks, and the Organic Law on Public Finance Management sets who follows up audit recommendations in government. Each duty below points to the capability that holds its evidence.
Keep working papers and audit documents for at least ten years and produce them on request, as a BNR-accredited auditor (BNR Regulation N° 44/2022, Art. 4)
Retention dates by document type, set to ten years for audit documents where your firm is BNR-accredited; files versioned and checksummed, and legal hold for any file that must stay longer
Keep annual accounts and reports for ten accounting periods and tax books for ten years (Law N° 007/2021, Arts. 111 and 121; Law N° 020/2023, Art. 15)
Separate retention dates for a client's accounts, reports, minutes and tax documents, filed by client, engagement and type
Serve a regulated client for three years, extendable by at most two, then cool off for three (Regulation 44/2022, Art. 13)
Each year's engagement sits on the client's record with its sign-off, so the years served can be read from the engagement list; AuditEDMS does not enforce rotation
Assemble the audit file promptly after the report and change it afterwards only with a record of why, when and by whom (ISA 230, adopted without modification)
An archive clock counting from sign-off to your deadline (45 days by default, 60 at most); every later change written to the audit trail
Show ICPAR's quality assurance reviewers how each sampled statutory audit was run
A printable compliance view per engagement: every stage, its evidence, its dates and who completed it
Run internal audit to the Internal Auditor General's standards, with the board or council following up recommendations through the audit committee, and the Chief Budget Manager implementing the Auditor General's (Organic Law N° 002/2022.OL, Arts. 80, 81, 88 and 89)
Engagement stages up to management responses and the final report, each with its evidence; request lists to the audited unit or district; a findings register holding each recommendation and the agreed action with its owner and due date, and a follow-up register of open and overdue actions for the audit committee
Store personal data in Rwanda unless the NCSA registration certificate authorises storage abroad, and report a breach within 48 hours (Law N° 058/2021, Arts. 48 to 50)
Runs in your own Azure subscription, in the region you choose, with documents in your own SharePoint; Entra ID sign-in and an audit trail of access
This maps software capability to obligations; it is not professional or legal advice, and it is not a statement that any deployment complies with Rwanda's data law. AuditEDMS follows internal audit recommendations to implementation in its findings register; it does not hold an audit universe or a risk-based annual plan.
For Rwanda's audit firms, and for internal audit wherever the Organic Law or a regulator requires it.
Every company appoints an external auditor, whose report follows the applicable standards, and the auditor has access to the company's records at all times (Law N° 007/2021).
Tier I firms have two or more partners with ICPAR practising certificates and Tier II firms one; both keep working papers for ten years and rotate after at most five years.
Internal auditors in ministries, agencies and districts work under the Internal Auditor General's coordination, and the Chief Budget Manager must implement the recommendations of the Office of the Auditor General, which works under Law N° 79/2013.
BNR's governance regulation requires an independent internal audit function and a board audit committee that reviews its work at least quarterly.
The CMA's 2024 Code requires an internal audit function with a charter, its head reporting to the audit committee chair, and the committee approving the internal audit plan.
Frequently asked questions.
How long must records be kept in Rwanda?
Mostly ten years. A company keeps its annual accounts and the auditors' and directors' reports for its last ten accounting periods, and minutes for at least ten years (Law N° 007/2021). Tax books and documents are kept for ten years from 1 January after the fiscal year (Law N° 020/2023, Art. 15). An auditor accredited by BNR keeps working papers for at least ten years; for other audit files, ISA 230 sets an ordinary minimum of five years from the auditor's report. In AuditEDMS each document type has its own retention date, and legal hold keeps a file beyond it.
Where is the data hosted, and does Rwanda's data protection law allow it?
AuditEDMS runs in your own Azure subscription, in the Azure region you choose, and your documents stay in your own SharePoint. Azure has no region in Rwanda, or anywhere in East Africa; the nearest are in South Africa. Law N° 058/2021 requires personal data to be stored in Rwanda unless the controller's registration certificate from the National Cyber Security Authority authorises storage outside Rwanda. If you choose a region outside Rwanda, confirm first that your NCSA registration certificate authorises it. We do not claim that a deployment complies with the law; that depends on your registration and your data.
What does ICPAR's quality assurance review need from a firm?
ICPAR reviews every firm and practitioner authorised for statutory audit, choosing where to look by risk, and tests the files against the ISAs, which Rwanda applies without modification. AuditEDMS prints, for any engagement the reviewer picks, the stages, their evidence, their dates and who completed each one, and its audit trail shows any change made after the file was archived.
Does AuditEDMS track BNR's auditor rotation?
Not as a rule. Every year's engagement for a regulated client is on the client's record with its sign-off, so the years your firm has served can be read from the engagement list and its CSV export; the five-year limit and the cooling-off period are yours to monitor.
Can public sector internal auditors use it with the Government of Rwanda Internal Audit Procedures Manual?
Yes. The internal audit template is ready to use and adjusted at implementation to the manual your entity follows; requests for information go to the audited unit or district as upload links, and the draft report, management responses and final report are dated stages with their evidence. Each recommendation and management's agreed action go into the findings register, which follows the action to implementation, verified by someone other than the person who recorded it implemented. The Auditor General's 2024 report put the implementation rate at 60%; the follow-up register gives the audit committee the open and overdue actions to follow up.
Does it issue EBM invoices?
No. At implementation AuditEDMS is set up for Rwanda: fees in francs, VAT at the normal 18 percent, a tax template that files with the RRA, and accounting records kept ten years. It raises fee notes at the billing milestones you choose, with VAT, part payments, and work in progress and yield from approved time. Tax invoices still go through your RRA-certified EBM, and nothing posts to RRA or an accounting system.
What does it cost?
On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff, and implementation is quoted separately.