OFFICER, INTERNAL AUDIT – SYSTEMS AND GENERAL AUDIT

KEY RESPONSIBILITIES

·   Audit planning and risk assessment

·   Systems and general audit execution

·   Audit reporting and communication

·   Monitoring and follow-up of audit recommendations

MAIN ACTIVITIES

Audit Planning

·   Plan and conduct assigned risk-based systems, operational, financial, branch and compliance audits in line with the approved Internal Audit Plan.

·   Prepare audit plans, programmes and testing procedures based on identified risks, audit objectives and key controls.

·   Determine the scope of systems audits covering IT infrastructure, applications, data and technology-enabled business processes.

Systems Audit Execution

·   Evaluate IT general and application controls, including user access, privileged access, segregation of duties, user account administration and transaction processing.

·   Review controls over the core banking system, digital banking platforms, system interfaces, data integrity, system logs and audit trails.

·   Assess cybersecurity controls, including security patching, vulnerability and incident management, and system monitoring.

·   Review system development, acquisition, change management, testing and implementation processes.

·   Evaluate IT operations, backups, disaster recovery, business continuity, database security and third-party technology services.

·   Assess compliance with applicable IT policies, data protection requirements and relevant CBK regulatory guidelines; analyse system-generated reports and electronic records to identify anomalies and control weaknesses.

General Audit Execution

·   Conduct assigned audits of business units, branches, financial and operational processes, transactions and regulatory compliance.

·   Test the design and operating effectiveness of internal controls through document review, transaction testing, staff interviews, reconciliations and other appropriate audit procedures.

·   Carry out spot checks, including cash counts, and review supporting documentation to assess compliance with approved policies, procedures and applicable laws and regulations.

·   Prepare and maintain complete audit working papers documenting procedures performed, evidence obtained and conclusions reached.

Audit Reporting

·   Prepare draft audit reports identifying control weaknesses, risks, root causes and practical recommendations.

·   Discuss findings with relevant IT personnel, departmental heads and other responsible staff; obtain management responses and agreed action plans.

·   Submit timely, clear and evidence-based reports to the Internal Audit Manager for review and escalate significant or urgent control weaknesses.

Monitoring and Follow-Up

·   Track implementation of agreed management action plans and verify corrective actions through supporting evidence and follow-up testing.

·   Report overdue actions, recurring deficiencies and unresolved high-risk findings to the Internal Audit Manager.

·   Undertake special reviews and investigations as assigned by the Internal Audit Manager or authorised governance bodies.

·   Perform other related duties assigned by the Internal Audit Manager, consistent with the role and the Bank’s Internal Audit Charter.

DECISION-MAKING AUTHORITY

The Officer’s authority is limited to assigned engagements and responsibilities under the approved Internal Audit Plan.

·   Develop audit programmes and determine appropriate testing procedures within the approved audit scope.

·   Document audit findings, recommend risk classifications and propose corrective actions.

·   Verify implementation of agreed management action plans and escalate significant control weaknesses or emerging risks.

The Officer makes recommendations to the Internal Audit Manager, who reviews the audit work and approves reports in accordance with the Bank’s governance framework. The Officer shall not implement, operate or manage the controls being audited.

GOVERNING FRAMEWORK

In performing the role, the Officer shall be guided by:

·   The Bank’s Internal Audit Charter, approved policies and procedures.

·   Applicable Kenyan laws and regulations, including the Banking Act, the Microfinance Act where applicable, and the Data Protection Act, 2019.

·   Applicable CBK prudential guidelines and relevant regulatory requirements, including AML/CFT obligations where relevant to the audit assignment.

·   The Global Internal Audit Standards and relevant IT audit and information security frameworks.