James
Mwangi
"Most businesses don't lose money to one big theft. They lose it to a hundred small gaps nobody is watching."
Internal Auditor · CPA(K) · Controls & Cost Assurance
I help owner-managed and mid-sized businesses find where money is leaking — in cash, stock, procurement, payroll and mobile money — and put controls in place that stop it happening again. Because I can pull and test the data myself, I review whole populations rather than a handful of samples.
An auditor who can
also read the data
Most accountants can't query a database. Most IT graduates can't read a trial balance. The combination is where the useful work lives.
I'm a CPA(K) internal auditor, holding a BBIT from KCA University. I work in-house as an internal auditor for a multi-property hospitality and floriculture group, covering both sides of the business — hotels and an export flower farm.
That means my day job is the same work I do for clients — cash and banking, stock and stores, procurement to payment, payroll and casual labour, cost of sales, and front-office operations — in two of the most control-sensitive industries in Kenya.
The technical half matters just as much. I build the data pipelines myself: extracting from Opera PMS, SunSystems, Materials Control and Sunpro, testing with Arbutus, Python and SQL, and delivering the result as a Power BI dashboard the owner can actually read. The finding and the evidence come from the same hands.
I take on a limited number of outside engagements alongside my role, with my employer's knowledge, and I do not accept work from businesses that compete with them.
Big firms sample.
I test everything.
A conventional review pulls forty vouchers and hopes they represent the year. With the right tools there's no reason to guess.
- Every transaction tested, not a sample
- Duplicate payments and split purchase orders surfaced automatically
- Exceptions ranked by exposure, not by date
- The same tests re-run next quarter in minutes
It is a more complete review at a smaller firm's price — and it is the one thing most independent practitioners in Kenya cannot offer.
Controls, cost
and assurance
Four core engagements plus a supporting reporting service. Each is scoped and priced as a fixed fee before any work starts.
Controls Health Check
A fast, structured review of how money and stock actually move through your business — and where they slip out. This is the engagement most clients begin with.
- Cash handling, banking and mobile money
- Stock, stores and wastage
- Procurement, quotations and approval limits
- Payroll, casuals and overtime
- Debtors, credit limits and collections
Cost Control Assurance
Ongoing testing of the costs that quietly decide whether you make money — with a dashboard so you can see them between my visits.
- Direct cost percentage against standard, by outlet or block
- Purchase price variance and unapproved suppliers
- Stock variance, shrinkage and portioning
- Labour cost per unit of output, including piece rates
- Utility and consumable use against activity
Outsourced Internal Audit
The internal audit function your business should have but can't justify hiring for. An annual plan, quarterly fieldwork, and reporting straight to the owner or board.
- Risk assessment and annual audit plan
- Quarterly fieldwork across agreed cycles
- Reports written for owners, not for auditors
- Formal follow-up on prior findings
- Surprise cash and stock counts
Control Documentation & SOPs
Most businesses run on habit and memory. When a key person leaves, the control leaves with them. This puts it on paper.
- Written procedures for cash, stock and procurement
- Delegation of authority and approval matrix
- Segregation of duties mapped to real roles
- Staff briefing pack and sign-off sheets
Management Reporting & Dashboards
The reporting layer that makes controls stick. Rather than a report you read once, a live Power BI view of the numbers that matter — sales and margin, stock movement, debtor ageing, labour cost and cash position — refreshed from your own systems. Built to be read by an owner in ninety seconds, not interpreted by an accountant.
Businesses where
cash and stock move fast
If your business handles physical stock, daily cash, or casual labour at scale, the same handful of control failures show up again and again.
Hotels & Lodges
Food and beverage cost control, stores and receiving, front-office and booking channel controls, banking and till reconciliation across multiple outlets.
Flower Farms & Agribusiness
Casual labour and piece-rate payroll, stem counts and grading, chemical and fertiliser consumption, packaging, rejects and post-harvest loss.
Retail & Distribution
Stock shrinkage, till and M-Pesa reconciliation, supplier pricing, credit sales and debtor control across branches.
Schools & Colleges
Fee collection and banking controls, procurement and supplier vetting, payroll, boarding stores and asset registers.
Clinics & Pharmacies
Drug stock control and expiry, cash and insurance receipting, procurement approvals, segregation of duties in small teams.
Transport & Logistics
Fuel consumption against distance, spare parts and workshop stores, collections and remittance control, casual and route staff payroll.
Construction & Contracting
Materials on site versus materials paid for, casual labour on the gate, subcontractor certification, plant and fuel, and variation control on live projects.
Missions, Churches & NGOs
Donation and collection controls, restricted fund accounting, procurement in small trusting teams, asset registers, and reporting that satisfies donors and trustees.
How an engagement
actually runs
No open-ended retainers and no surprise invoices. You know the scope, the fee and the deliverable before I start.
Twenty minutes, free
We talk about what worries you, what systems you run, and how big the business is. If I'm not the right fit I'll say so on that call.
Fixed scope, fixed fee
A one-page proposal: what I will examine, what you receive, what it costs, and when it's delivered. Signed before anything begins.
Mostly remote
System exports, document requests and video walkthroughs, with data tested against the full population. Site visits scheduled where physical verification is needed.
Findings you can act on
Each finding states the exposure, the cause and the fix, with an owner and a date. Then I come back and check whether it was done.
Findings go to you, and only you
In an owner-managed business the people being reviewed are often family, or long-serving staff you trust. That's exactly why the reporting line has to be agreed up front. Every engagement begins with a confidentiality agreement, findings are reported to the owner or the board alone, and no staff member is named to their colleagues. Client data is handled under Kenya's Data Protection Act and is not kept after the engagement unless you ask me to.
What the work
looks like
Engagements carried out in my internal audit role across the group's hospitality and floriculture operations. Client-identifying detail is withheld.
Group Operational Controls Audit
A multi-property review using mystery guest evidence, covering conflict of interest, booking channel controls, guest registration, food safety and facility safety. Delivered as a ranked risk register with an action tracker assigned by owner and date.
M-Pesa Reconciliation Automation
Built a fuzzy-matching Python pipeline to reconcile mobile money receipts against the ledger across several months, replacing manual matching. Output is a multi-sheet workbook with matched items, exceptions and an audit trail.
Stores Data Extraction Pipeline
Converted Materials Control PDF exports — receiving journals, deliveries, transfers and invoices — into structured workbooks, making cost of sales testable at transaction level rather than by summary report.
Payroll & Allowance Variance Review
Converted raw payroll system reports into analysable data and tested house allowance and related payments for variance against entitlement, surfacing inconsistencies for management action.
Sales Mix & Revenue Analysis
Full-year sales mix analysis across outlets and categories, identifying margin concentration and pricing inconsistencies, issued as a formatted audit report to management.
Management Dashboards
Power BI reporting built directly on operational system data, giving management a standing view of cost, revenue and exception trends instead of a monthly report assembled by hand.
Where I've Worked
Audit and finance experience across hospitality, agribusiness and professional practice.
- Risk-based internal audit across hotel properties and export floriculture operations
- Cash and bank, accounts receivable, cost of sales, payroll and operational standards
- Audit data analytics using Arbutus, Python and SQL on full transaction populations
- Power BI management reporting built on operational system data
- Data protection compliance review and supporting documentation
- Food and beverage cost control, stores receiving and variance investigation
- Monthly management accounts preparation and review
- Budget input and forecasting support with operational departments
- Audit fieldwork support, reconciliations and ledger review
- Tax computations and VAT submissions for SME clients
- Internal control testing under senior supervision
Fixed fees,
agreed up front
I don't bill by the hour. Every engagement is quoted as a fixed fee after a free scoping call, so you know the cost before you commit.
Controls Health Check
- One week of fieldwork
- Six control areas reviewed
- Ranked control gap report
- Risk register and action tracker
- One debrief call with the owner
Cost Control Retainer
- Monthly or quarterly testing cycle
- Surprise cash and stock counts
- Exceptions pack each cycle
- Cost dashboard kept current
- Follow-up on prior findings
- Direct line for questions between cycles
Outsourced Internal Audit
- Risk assessment and annual audit plan
- Four fieldwork visits per year
- Board-ready quarterly reporting
- Formal prior-action follow-up
- Control documentation included
Half the fee is payable on signature and the balance on delivery. Travel and accommodation for on-site work are quoted separately and billed at cost.
Credentials &
Training
Accounting qualification on one side, information systems on the other. The overlap is the practice.
Certified Public Accountant — CPA(K)
Business Information Technology (BBIT)
Audit Data Analytics
Organisations I've
worked with
Hotels, farms, contractors, traders and institutions — in-house and on assignment. Different sectors, the same handful of control problems.
Engagements have been carried out both as an in-house internal auditor and on assignment. Names are listed to show the range of operations I've worked across; nothing about any organisation's controls, findings or figures is disclosed here or anywhere else.
Notes on controls,
cost and cash
Practical pieces for owners and managers — where money actually leaks out of a business, and what to do about it without hiring a department.
First pieces are being written
Short, practical notes for owners and managers on where money actually leaks out of a business — and what to do about it without hiring a department. The first ones land shortly.
Common Questions
Scope, pricing, confidentiality and the limits of what I can take on.
What does an internal controls review actually involve?
A structured walkthrough of how money and stock move through your business: cash handling and banking, mobile money, stock and stores, procurement and approvals, payroll, and debtors. You receive a written report naming the control gaps, ranked by exposure, with a practical fix for each and an action tracker showing who does what and by when.
Do you carry out statutory audits?
No. Statutory audit of financial statements in Kenya requires an ICPAK practising certificate and annual licence. My work is internal audit and controls advisory — reviewing how your business operates and strengthening it. If you need a statutory audit, I'm happy to point you toward a licensed firm.
Which businesses do you work with?
Owner-managed and mid-sized businesses across Kenya, with particular depth in hospitality and floriculture. Typical clients include hotels and lodges, flower farms and agribusiness, retail and distribution, schools and colleges, clinics and pharmacies, and transport operators — any business that handles cash, stock or casual labour at scale.
Can you work remotely, or do you need to visit?
Most of the work is remote: system exports, document review, data testing, video walkthroughs and dashboard delivery. Some procedures need a physical presence, such as surprise cash counts and stock verification. Those are scheduled as site visits, or run by your own staff following a written protocol with evidence submitted for review.
How is the work priced?
Fixed fees, quoted in writing before work begins — never hourly. The price depends on the size of the business and the scope agreed in a free scoping call. Half is payable upfront and the balance on delivery. Travel and accommodation for on-site work are quoted separately and billed at cost.
How do you handle confidentiality?
Every engagement starts with a confidentiality agreement. Findings are reported to the owner or the board only, never to the staff being reviewed. Client data is handled under Kenya's Data Protection Act and is not retained beyond the engagement without written instruction.
Do you still offer web development, SEO and digital marketing?
Yes, though they sit separately from the controls practice. Website builds, SEO, Google and Meta Ads, social media management and AI workflow automation are set out on the Digital & AI Services page.
Book a free
scoping call
Twenty minutes on the phone or a video call. Tell me what worries you about the business, and I'll tell you honestly whether a review is worth your money.
Direct contact
Kenya — all counties
Clients across Kenya — remote nationwide, on-site by arrangement
Within one working day