IT and information systems audit in Kenya
Boards, regulators and external auditors need evidence that your systems are secure, reliable and well controlled. APOPS Assurance carries out independent IT and information systems audits for banks, SACCOs, insurers, NGOs, schools, government agencies and growing companies, and writes reports that management can act on.
Audits we carry out
- IT general controls (ITGC): access management, change management, backups and IT operations
- Application and core-system audits (ERP, core banking, SACCO and payroll systems)
- Cybersecurity and network security audits, including vulnerability assessment
- IT governance audits against COBIT and ISO/IEC 27001
- Data protection compliance reviews under the Kenya Data Protection Act, 2019
- Business continuity and disaster recovery (BCP/DR) reviews
- Pre-implementation and post-implementation reviews of new systems
How we work
- Scoping meeting: what the audit must cover and who will rely on it
- Fieldwork: interviews, walkthroughs, system testing and evidence collection
- Findings discussed with management before the report is final
- Report rated by risk, with practical recommendations and owners
- Follow-up review to confirm the issues are fixed
Who does the work
Our audit team includes practitioners trained in information systems auditing, controls and assurance, and ISO/IEC 27001 Lead Auditors and Implementers. We work independently of the systems we audit.
Why APOPS Assurance
- Founded in 2016 in Nairobi, working with businesses and institutions across Kenya
- One team for both IT security and physical security, so cameras, access control and networks are designed together
- Our own technicians and auditors, with ISO/IEC 27001 Lead Auditor and information systems audit expertise
- Clear written quotations, and help after installation
Frequently asked questions
What is the difference between an IT audit and a financial audit?
A financial audit gives an opinion on the financial statements. An IT audit tests the controls over the systems that produce them, and over security, availability and data. External auditors often rely on IT audit work.
How often should we have an IT audit?
Most organisations audit key systems at least once a year, and again after major changes such as a new core system, a migration to the cloud or a security incident. Your regulator may require a set frequency.
Do you do SACCO and bank IT audits?
Yes. We audit core systems, IT general controls and cybersecurity for financial institutions, and align the work with the expectations of their regulators.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.