A Nairobi Startup's Agent Just Automated Its Own Compliance Audit — and Investors Are Nervous

Ruwa Systems, a 40-person compliance-automation company in Nairobi's Kilimani district, has spent two years selling software that helps banks assemble audit evidence. Last month it turned the product on itself — and the result has become an uncomfortable case study.

The agent pulled control documentation from eleven internal systems, drafted narrative explanations for 312 controls, and produced a submission-ready pack in under nine hours. Ruwa's previous audit cycle took a team of six about five weeks. The filing was accepted. The problem, according to two people who sat in on the subsequent board meeting, is that nobody in the room could say with confidence which parts a human had actually read.

"The technology worked exactly as advertised, which is the part that worries me," said one investor in the company's Series A, who asked not to be named discussing an unannounced governance review. "If the attestation is signed by a director, the director has to be able to defend it line by line. Nine hours is not long enough to defend 4,000 pages."

Ruwa has since added a mandatory human sign-off step at the control-family level and says it will publish an audit trail standard for agent-generated evidence later this quarter. The broader question is not going away: as agents get good enough to produce work that clears regulatory bar, the accountability chain has to be rebuilt around them, not bolted on afterward.