We test your systems, access and policies the way an external auditor or regulator would, then hand you a ranked list of fixes your board can read and your IT team can actually finish. Most of it runs remotely, so it works wherever your offices are.
If any of these sound like your week, you are in the right place. Each one is fixable.
A bank, donor or multinational client wants proof of your controls before they sign. You have good people and decent systems, but nothing written down to show it, and the deal waits while you scramble.
Nobody is quite sure who can get into the accounting system, the shared drive or the Microsoft 365 admin page. Forgotten accounts are an easy way in for an attacker, and one of the first things an auditor checks.
There's a backup, somewhere, set up by someone. Whether it actually restores is a question nobody wants answered for the first time during a ransomware attack or after a power surge takes out the server.
Patient records, student files, national ID numbers and mobile money numbers are all personal data. Operate in more than one country and you may answer to more than one data protection law. If you can't say where the data lives, who can see it and how long you keep it, that's a gap with your name on it.
Most organisations don't know how exposed they are until someone outside asks. A bank partner sends a security questionnaire. A donor or an overseas client wants to see your data protection policy. The external auditor asks who approved access to the finance system, and the only record is a WhatsApp message from two years ago.
Our IT audit gets you that answer first. We review your infrastructure, applications, user access, backups and policies against ISO/IEC 27001, NIST CSF 2.0 and CIS Controls v8, and against the law in each country you operate in. For clients in Ghana that means the Data Protection Act, 2012 (Act 843) and the Cybersecurity Act, 2020 (Act 1038); elsewhere it might be Nigeria's Data Protection Act 2023, Kenya's Data Protection Act, 2019, South Africa's POPIA or GDPR. Every finding comes with the evidence, a risk rating and a fix we can help you carry out.
We test access management, change control, backups and IT operations using samples from your live systems, rather than taking the policy document's word for it.
We identify the threats that matter to your business, from ransomware to insider fraud, and rate each by likelihood and impact so you spend money in the right order.
A requirement-by-requirement check against the rules you answer to. For clients in Ghana: Act 843, Act 1038 and Bank of Ghana directives. Elsewhere: Nigeria's Data Protection Act and CBN guidelines, Kenya's Data Protection Act, POPIA or GDPR.
A gap assessment against ISO/IEC 27001:2022 and a practical plan for the risk register, controls and Statement of Applicability you'll need before a certification body visits.
Short, plain security policies for passwords, access, backups and incident response, written for your staff and mapped to the framework you're measured against.
We don't hand over a report and disappear. We help your team close the findings, then retest, so you have proof for whoever asked.
Four stages, each with something you can see and sign off before we move on.
We agree what's in scope, which framework or regulation you're measured against and who we'll speak to on your side. You get a fixed scope and quote before any work starts.
We sit with your IT, finance and operations staff, inspect configurations and pull samples such as user lists, backup logs and change records, mostly over secure remote sessions, with a site visit where one adds something.
Each gap is written up with its evidence, the business risk in plain terms and a recommended fix, rated so you can see what to do this month and what can wait a quarter.
We walk management through the report, help your team fix the high-risk items, then retest and update the findings so the evidence is ready for your auditor, regulator or partner.
Book a short scoping call from wherever you are. Tell us who is asking for evidence and by when, and we'll come back with a fixed scope, a quote and a realistic schedule.
Or call +233 24 886 9658Recognised frameworks and platforms, not home-made checklists. Ask us how each one applies to you.
Straight answers to what people ask us before they start.
Still have a question?
Call us on +233 24 886 9658 or send us a message. A real person will get back to you.
The cost depends on scope, so we quote each audit after a short scoping call. The main drivers are how many sites, servers and business applications are included, which framework or regulation you're measured against, and whether you want help fixing the findings. A focused review of one office and its core systems costs far less than a group-wide ISO 27001 readiness programme. Because most of the work is remote, travel rarely appears on the quote; if a site visit is needed, it is priced as a separate line. Once we agree the scope, the quote is fixed.
It depends mainly on scope and on how quickly your team can share evidence. A single office with a handful of core systems is a short engagement; several branches, regulated systems or ISO 27001 readiness take longer. After the scoping call you get a dated plan showing interviews, testing, the draft report and the board briefing, so you can tell your auditor or partner when to expect results.
Usually the law of each country where you collect or use personal data, which can mean more than one. For clients in Ghana that is the Data Protection Act, 2012 (Act 843), which also requires data controllers to register with the Data Protection Commission. Nigeria has the Nigeria Data Protection Act 2023, Kenya the Data Protection Act, 2019 and South Africa POPIA, and GDPR can apply if you handle data about people in the EU. Our audit shows where you stand against each; for legal interpretation, involve your lawyer.
No. ISO/IEC 27001 certificates are issued only by accredited certification bodies, and we are not one. What we do is prepare you for that audit: a gap assessment against ISO/IEC 27001:2022, help building the risk register, policies and Statement of Applicability, and an internal audit before the certification body arrives. Keeping preparation and certification separate also keeps the final audit independent.
Yes. Most of an IT audit is interviews, document reviews and read-only checks of configurations, and all of that works over secure video calls and screen sharing, while your staff carry on with their normal work. Ghana runs on GMT all year, which overlaps the working day across most of Africa and Europe, and we book sessions at times that suit you. Where something needs eyes on site, such as a server room or a branch walk-through, we plan a visit with you.
Only you and the people named on the engagement. We sign a non-disclosure agreement before work starts, use read-only access wherever possible and keep evidence encrypted. When the engagement ends we return or delete it, as you prefer. Your report belongs to you, and we never mention your organisation in our marketing without written permission.
Yes, if you want us to. Every finding comes with a recommended fix, and we can carry out the work, support your in-house IT team or brief your existing vendor. Where a regulator or auditor needs the review to be independent of whoever does the fixing, we'll tell you upfront so the two roles stay separate and your evidence holds up.
Most organisations start with one of these and add the rest as they grow. Here is where this service fits.
