The Year Was 2019: From Cybersecurity Advocacy to the Reality of IT Auditing
Charles Ndolo Mutiso · 2026-10-28
The Year Was 2019…
The year was 2019. On a chilly morning, at Nairobi's Donholm Estate, exactly three days after I bagged my GRC (Governance, Risk, and Compliance) certification, and two months after facing retrenchment, lol, tough times in life, no? I felt ready for the world to offer me an opportunity to do what I loved: secure workspaces.
My first instinct was simple: how would these people know about this don in the field?
I had been active in national cybersecurity groups, discussing secure networks, security benchmarks, Zero Trust, and the 'assume breach' approach. Yet nobody seemed willing to open up about the chaos within their own IT environments.
Then Charlie, the freelancing boy from Mbilini, Kangundo, had an idea.
Why not invite WhatsApp group cohorts to congratulate him on his newly acquired certification? Some turned out to be directors somewhere, and others business owners. It was quite a dare.
Then Boom! Two jobs. Then three.
And just like that, I entered the seemingly endless world of discovering what organisational IT chaos actually looked like.
Spaghetti networks. Shared administrator credentials. Undocumented configurations. Unmanaged infrastructure. Servers nobody dared touch because nobody knew what might break.
I had officially been initiated into the headache of securing environments without disrupting business operations.
And believe me, it was never easy.
Management set high expectations, and limited resources and technical realities often diverged from what existed on paper.
The greatest lesson? Security must coexist with business continuity.
What does an IT audit actually examine?
An IT or Management Information Systems (MIS) audit independently evaluates how an organisation manages, protects, and operates its technology.
For SMEs, the assessment typically covers:
Access controls: Who accesses systems, and are privileges appropriately restricted?
Backup and recovery: Are backups reliable, protected, and regularly tested?
Change management: Are system modifications authorised, documented, and tested?
Infrastructure security: Are networks, servers, firewalls, and endpoints properly secured?
Software management: Are applications licensed, supported, and updated?
Policies and compliance: Do documented procedures reflect operational reality?
Business continuity: Can critical services survive disruptions?
An audit establishes what exists, where vulnerabilities lie, and which improvements deserve priority.
Signs Your Business Needs an IT Audit
Several circumstances should trigger an independent assessment.
Rapid growth: Infrastructure designed for ten employees may struggle to securely support fifty.
New technology: ERP deployments, payment integrations, and cloud migrations introduce additional risks.
Security incidents: Ransomware, phishing, unauthorised transactions, and suspicious activities demand closer examination.
Compliance requirements: Regulators, lenders, and business partners increasingly expect evidence of effective IT controls.
Undocumented infrastructure: When only one technician understands the network, the organisation faces significant operational risk.
The Spaghetti Network Problem
One thing became clear during those early engagements: a functioning network is not necessarily a controlled network.
Some environments had evolved through years of temporary fixes.
A switch added here. A firewall exception there. Shared passwords everywhere.
Everything worked until someone attempted an upgrade.
Then chaos.
An effective audit must therefore go beyond identifying vulnerabilities. It should establish system dependencies, evaluate business risks, and recommend realistic improvements.
The Auditor's Dilemma: Security Versus Downtime
It is easy to recommend disabling obsolete protocols, restructuring network segments, or upgrading unsupported servers.
However, implementing those recommendations without interrupting operations is a different challenge.
Imagine securing a system only to discover that payroll processing has stopped.
The recommendation may be technically sound, but its implementation has created a business crisis.
Successful remediation requires risk prioritisation, approved change windows, tested backups, rollback procedures, and management involvement.
The objective is not to achieve security by shutting down the business. It is to strengthen security while preserving operations.
What Should an IT Audit Deliver?
A meaningful audit should provide management with:
An executive summary that explains the organisation's technology risk position.
Risk-rated findings identifying weaknesses and potential business impacts.
Practical recommendations addressing the underlying control deficiencies.
A remediation roadmap assigning responsibilities, priorities, and timelines.
The value of an audit is measured not by the number of findings but by the improvements implemented.
The Lesson That Stayed With Me
Looking back at that chilly morning in 2019, I realise that certification opened the door, but experience taught me what IT assurance truly means.
Not every chaotic environment results from negligence. Sometimes businesses grow faster than their infrastructure. Sometimes resources are limited. Sometimes temporary solutions become permanent.
The auditor's responsibility is to identify risks, ask difficult questions, and recommend sustainable improvements.
From the freelancing boy in Mbilini, Kangundo, to the world of IT assurance, my guiding principle remains:
Secure the environment. Manage the risk. Preserve business continuity. Minimise downtime.
After all, what good is a secure system if nobody can use it?
Get an Independent IT Audit
APOPS Assurance Ltd provides IT and MIS audits, cybersecurity assessments, and technology risk management services focused on practical, sustainable improvements.
IT Audit Services: https://apopsassurance.com/it-audit-kenya
Contact: https://apopsassurance.com/contact
Call or WhatsApp: +254 722 102 317
APOPS Assurance Ltd
Technology | Security | Assurance