The Information Systems Auditor is responsible for examining, evaluating and verifying the Bank’s information systems, technology processes, procedures, internal controls and data to provide independent assurance on the adequacy and effectiveness of ICT governance, risk management and controls.he/she will plans executes and reports on risk-based information systems audits covering the Bank’s core banking system and other critical applications, digital and agency banking platforms, cybersecurity, data governance, technology projects, business continuity and disaster recovery, and third-party technology services to ensure confidentiality, integrity, availability, security and compliance of the Bank’s information assets.

Key Responsibilities

• Ensure through planning that there are adequate internal controls in the systems, that there is adequate protection of data and ensure its integrity
• Plan, execute and lead information security audits across the bank;
• Asses the adequacy and effectiveness of ICT governance, technology risk management, internal controls and information-security arrangements;
• Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure and related security controls;
• Review the Bank’s core banking system, and other critical applications for adequacy of application controls, interfaces, configurations, data integrity, security and availability;
• Review controls over digital, mobile, agency banking and other electronic channels, including transaction processing, system availability, customer-data protection and fraud-prevention controls;
• Evaluate the efficiency, effectiveness and compliance of information systems and technology operations with Bank policies, applicable laws, regulations, regulatory guidelines and recognized professional standards;
• Review identity and access-management controls, including user administration, privileged access, segregation of duties, authentication and periodic access reviews;
• Review system acquisition, development, implementation, integration, migration and change-management processes for adequate governance, authorization, testing, security and controls;
• Provide independent assurance over ICT and digital-transformation projects, including project governance, system implementation, data migration and post-implementation controls;
• Review controls over data governance, quality, integrity, privacy, classification, retention, backup and recovery;
• Assess business continuity, ICT disaster recovery, system resilience, backup arrangements and recovery testing;
• Review third-party, outsourced, vendor and cloud technology arrangements for information-security, data-protection, service-continuity and related technology risks;
• Review technology incident-management processes, including identification, escalation, investigation, root-cause analysis and corrective actions;
• Execute and document audit procedures and ensure findings and conclusions are supported by sufficient and appropriate audit evidence;
• Apply Computer-Assisted Audit Techniques (CAATs), data analytics and other technology-enabled audit tools to analyse data, identify anomalies, test controls and enhance audit coverage;
• Perform forensic investigative systems audits as may be required;
• Develop rigorous best practice recommendations to improve system security on all levels
• Work with management to ensure security recommendations comply with the banks operations
• Collaborate with departments to improve security compliance mange risk and bolster effectiveness
• Prepare reports of system audits findings in addition to providing support for sophisticated data analysis and extraction through computer assisted audit techniques (CAATs);
• Monitor and validate implementation of agreed audit actions and escalate overdue, recurring or inadequately addressed issues;

Knowledge Skills & Abilities

i) At least twelve (12) years’ relevant work experience in the Public Service or Private Sector, three (3) of which must have been in a supervisory position;

ii) Master’s degree in either Accounting, Finance or Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity or equivalent qualification from a recognized institution;

iii) Bachelor’s degree in either Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science or equivalent qualification from a recognized institution;

iv) Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or equivalent relevant professional qualification from a recognized professional body;

v) Registered member of ISACA or equivalent relevant recognized professional body in good standing;

vi) Attended a Management Course lasting not less than four (4) weeks from a recognized institution;

vii) Demonstrated knowledge and experience in information systems auditing

viii) Knowledge of core banking systems, digital financial services, application controls, databases, networks and technology infrastructure;

ix) Knowledge of applicable banking, cybersecurity, data-protection and ICT regulatory requirements and relevant professional frameworks;

x) Demonstrated ability to apply CAATs, data analytics and technology-enabled audit tools;

xi) Strong numerical, analytical, problem-solving, communication and report-writing skills;

xii) Ability to exercise sound professional judgment and evaluate audit evidence;

xiii) Ability to manage priorities, supervise assignments and work collaboratively with multidisciplinary teams;

xiv) High levels of integrity, ethical standards, professionalism, independence and objectivity;

xv) Ability to drive change and continuous improvement;

xvi) Emotional intelligence and effective stakeholder-management skills;

xvii) Proficiency in computer applications;

xviii) Shown merit and ability as reflected in work performance and results; and

xix) Fulfilled the requirements of Chapter Six of the Constitution of Kenya.

• Ensure through planning that there are adequate internal controls in the systems, that there is adequate protection of data and ensure its integrity
• Plan, execute and lead information security audits across the bank;
• Asses the adequacy and effectiveness of ICT governance, technology risk management, internal controls and information-security arrangements;
• Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure and related security controls;
• Review the Bank’s core banking system, and other critical applications for adequacy of application controls, interfaces, configurations, data integrity, security and availability;
• Review controls over digital, mobile, agency banking and other electronic channels, including transaction processing, system availability, customer-data protection and fraud-prevention controls;
• Evaluate the efficiency, effectiveness and compliance of information systems and technology operations with Bank policies, applicable laws, regulations, regulatory guidelines and recognized professional standards;
• Review identity and access-management controls, including user administration, privileged access, segregation of duties, authentication and periodic access reviews;
• Review system acquisition, development, implementation, integration, migration and change-management processes for adequate governance, authorization, testing, security and controls;
• Provide independent assurance over ICT and digital-transformation projects, including project governance, system implementation, data migration and post-implementation controls;
• Review controls over data governance, quality, integrity, privacy, classification, retention, backup and recovery;
• Assess business continuity, ICT disaster recovery, system resilience, backup arrangements and recovery testing;
• Review third-party, outsourced, vendor and cloud technology arrangements for information-security, data-protection, service-continuity and related technology risks;
• Review technology incident-management processes, including identification, escalation, investigation, root-cause analysis and corrective actions;
• Execute and document audit procedures and ensure findings and conclusions are supported by sufficient and appropriate audit evidence;
• Apply Computer-Assisted Audit Techniques (CAATs), data analytics and other technology-enabled audit tools to analyse data, identify anomalies, test controls and enhance audit coverage;
• Perform forensic investigative systems audits as may be required;
• Develop rigorous best practice recommendations to improve system security on all levels
• Work with management to ensure security recommendations comply with the banks operations
• Collaborate with departments to improve security compliance mange risk and bolster effectiveness
• Prepare reports of system audits findings in addition to providing support for sophisticated data analysis and extraction through computer assisted audit techniques (CAATs);
• Monitor and validate implementation of agreed audit actions and escalate overdue, recurring or inadequately addressed issues;

• Information systems auditing
• Core banking systems
• Digital financial services
• Application controls
• Databases
• Networks
• Technology infrastructure
• Banking regulations
• Cybersecurity regulations
• Data-protection regulations
• ICT regulatory requirements
• Professional frameworks
• CAATs
• Data analytics
• Technology-enabled audit tools
• Numerical skills
• Analytical skills
• Problem-solving skills
• Communication skills
• Report-writing skills
• Professional judgment
• Audit evidence evaluation
• Priority management
• Supervision
• Team collaboration
• Integrity
• Ethical standards
• Professionalism
• Independence
• Objectivity
• Change management
• Continuous improvement
• Emotional intelligence
• Stakeholder management
• Computer applications proficiency

• Master’s degree in either Accounting, Finance or Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity or equivalent qualification from a recognized institution
• Bachelor’s degree in either Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science or equivalent qualification from a recognized institution
• Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or equivalent relevant professional qualification from a recognized professional body
• Registered member of ISACA or equivalent relevant recognized professional body in good standing
• Attended a Management Course lasting not less than four (4) weeks from a recognized institution