Frequently Asked Questions

BAC Practice offers seven core services: Internal Audit, Compliance Review, Risk Management, IT & Systems Audit, Follow-Up Reviews, Special Investigations, and Advisory Services. Every engagement follows a documented, risk-based methodology aligned with IIA Standards.

We work with organisations of all sizes — from SMEs and NGOs to banks, universities, government agencies, and large corporates. Engagement scope and fees are tailored to the size and risk profile of your organisation.

Yes. While our office is based in Kigali, our team conducts fieldwork across Rwanda, including multi-site and branch-network audits where required.

Yes. Every engagement includes a follow-up review to verify implementation of recommendations. Our team remains reachable by WhatsApp, phone, and email during business hours (Mon–Fri 8AM–6PM).

Fees depend on the scope, size and risk complexity of the engagement. We provide a detailed, no-obligation proposal after an initial scoping consultation — there is no fixed price list for professional audit work.

Yes, we typically require a deposit to commence fieldwork, with the balance invoiced on completion or against agreed milestones for larger, multi-phase engagements.

For larger or multi-phase engagements, yes — we can agree a milestone-based payment schedule at the engagement-letter stage.

Yes. Every engagement begins with a signed engagement letter setting out scope, fees and timelines, and every payment is accompanied by a formal invoice and receipt.

After your initial enquiry (WhatsApp, phone, or the contact form), we schedule a scoping consultation to understand your needs and risk areas. We then issue a detailed engagement proposal with scope, timeline and fees. Once the engagement letter is signed, fieldwork begins, followed by reporting and a follow-up review.

Timelines vary by scope. A focused compliance review can take 1–2 weeks; a full internal audit cycle (planning through reporting) typically runs 3–6 weeks; multi-site or IT systems audits can take longer depending on complexity. We always agree a timeline upfront.

A brief description of the area you want reviewed, your organisation type and size, and any specific concerns or recent incidents. We refine the scope further during the consultation.

Internal audits cover governance, risk management and control effectiveness across the agreed scope — financial controls, operational processes, procurement, IT systems, or a combination, depending on the audit plan.

We share findings as they are identified during fieldwork rather than only at the final report stage, so there are no surprises. Each finding includes a risk rating, root cause, and a recommended corrective action with an assigned owner.

Yes — every engagement includes a follow-up review that tracks implementation progress and verifies corrective actions with evidence before a finding is marked closed.

We assess IT general controls, access management, cybersecurity risk, change management, and — where relevant — ERP system configuration (SAGE, SAP, Oracle and similar platforms).

Yes. Where useful, we use data analytics techniques on transactional data to identify anomalies, duplicate payments, or control breakdowns that manual sampling might miss.

Yes — IT systems audits are independent by design and routinely cover systems implemented by third parties or in-house teams.