IT Audit Services in Kenya: The Complete Guide for Boards, Regulators, and Technology Risk Functions
From CBK IT risk guidelines and SASRA requirements to ISO 27001, PCI DSS, and continuous auditing — a practitioner’s guide for Kenyan and East African organisations navigating the digital compliance landscape.
IT audit has moved from a back-office discipline to a boardroom imperative. Across Kenya, East Africa, and the broader continent, regulators are tightening technology risk frameworks, boards are demanding credible assurance over digital systems, and the consequences of inadequate IT controls — regulatory sanctions, financial fraud, and reputational collapse — are measured in millions of shillings. This guide provides the definitive reference for understanding, preparing for, and executing IT audit in the Kenyan regulatory context.
Building an IT Audit Capability Fit for Kenya’s Digital Economy
Kenya’s digital economy is the most sophisticated in sub-Saharan Africa, and the IT audit discipline must evolve at the same pace as the technology it assesses. Regulators from the CBK, SASRA, CMA, ODPC, and ICT Authority are collectively raising the bar for technology risk governance — and the organisations that invest in genuinely capable, technically credible IT audit functions will be better positioned to attract capital, withstand regulatory scrutiny, and sustain the trust of customers and stakeholders across the region.
The journey toward IT audit maturity is not achieved through compliance checkboxes or policy documents that collect dust between regulatory visits. It demands risk-based thinking, technical depth, data-driven methodology, continuous investment in professional capability, and an unwavering commitment to communicating risk in terms that decision-makers can act upon. For Kenyan financial institutions, SACCOs, digital businesses, and public sector entities, the question is not whether to invest in IT audit capability — it is whether that investment will be made proactively, or only after a significant incident, regulatory enforcement action, or fraud event forces the issue.
Key IT Audit Risks in Digital Business
Kenya’s digital economy has expanded at a pace that has consistently outrun control frameworks. The technology risks that IT auditors must navigate in 2026 are materially different from those of five years ago — shaped by cloud migration, open banking APIs, artificial intelligence adoption, and a threat actor community that specifically targets African financial institutions.
Excessive, unmonitored privileged access to core banking databases — including vendor remote access accounts, shared DBA accounts, and legacy administrator profiles created during implementation — remains the single highest-consequence IT audit finding across Kenyan financial institutions. Compromised privileged accounts enable fraud that is extraordinarily difficult to detect and reverse.
Many Kenyan organisations have migrated critical workloads to AWS, Azure, or Google Cloud without establishing cloud-specific control frameworks, shared responsibility matrices, or cloud security posture management tooling. The result is a control vacuum that traditional IT audit approaches — designed for on-premise environments — systematically fail to detect.
The growth of open banking and fintech partnerships has created complex API ecosystems where sensitive financial data flows between institutions and third parties without adequate API security controls, contractual protections, or ongoing monitoring. Each unreviewed integration point represents a potential audit gap and regulatory exposure under both CBK outsourcing guidelines and the KDPA.
ERP systems used by Kenyan corporates and government entities routinely carry conflicting access entitlements that create segregation of duties violations enabling fraud. Automated SoD analysis tools identify thousands of violations in large ERP environments that manual access reviews systematically miss. IT auditors without data analytics capability in this area are providing incomplete assurance.
IT Audit Best Practices for Kenyan Organisations
Elevating IT audit from a compliance function to a genuine strategic risk assurance capability requires deliberate investment in methodology, technology, talent, and stakeholder communication. The following practices define high-maturity IT audit functions across East Africa’s most sophisticated organisations.
IT audit plans must be driven by the organisation’s strategic technology agenda and current risk profile, not by a rolling calendar of familiar topics. If the organisation is migrating core banking systems, implementing mobile banking, or expanding across borders, the IT audit plan must reflect these risk shifts in real time.
IDEA, ACL Analytics, SQL, and Python-based pipelines enable IT auditors to analyse entire populations of transactions, access logs, and system events. For institutions processing millions of daily transactions, sampling is no longer a credible assurance approach — data analytics is the baseline.
IT auditors reviewing cloud configurations, API security, or database access controls must possess the technical competence to evaluate what they are examining. Organisations that assign IT audits to non-technical staff produce assurance outputs that provide false comfort rather than genuine risk insight.
High-maturity IT audit functions track CBK, SASRA, CMA, and ODPC regulatory developments as they emerge, and pre-emptively adjust audit plans to cover new requirements before examination cycles. Coordinating audit scopes with external auditors and regulators avoids duplication and closes assurance gaps proactively.
IT audit value is only realised when findings are communicated in terms that non-technical board members can understand and act upon. Every IT audit report should answer one question clearly: what does this finding mean for the organisation’s ability to achieve its objectives, and what is the cost of inaction?
Leading internal audit functions benchmark their IT audit methodology against the IIA’s Global Technology Audit Guides (GTAGs), ISACA’s COBIT framework, and peer organisations across the region. External quality assessment of the IT audit function, conducted at least once every five years, is now a requirement of the IIA Standards and a CBK expectation for supervised institutions.
IT General Controls (ITGC) Explained
IT General Controls are the foundational technology controls that determine whether any IT-dependent business process can be trusted. Unlike application controls, which are embedded within specific systems, ITGCs apply across the entire technology environment and underpin the reliability of automated processing, the integrity of system-generated reports, and the validity of all IT-dependent financial and operational data. External auditors cannot rely on weak ITGCs and must substantially expand their substantive testing, driving up audit cost and timelines.
The Five Core ITGC Domains
Controls ensuring that only authorised users can access systems, data, and functionality appropriate to their role. Covers logical access management, IAM, privileged access, segregation of duties enforcement, and periodic access certification. Consistently the most deficient ITGC domain across Kenyan organisations of all sizes.
Controls governing how changes to applications, databases, and infrastructure are requested, approved, tested, and deployed. Prevents unauthorised or poorly tested modifications that could corrupt processing logic or data integrity — particularly critical for core banking, ERP, and payment systems.
Controls over job scheduling, batch processing, data backup and recovery, and the operational integrity of the IT environment. Includes monitoring of scheduled jobs, incident management, and capacity management — frequently underaudited in smaller Kenyan institutions.
Controls ensuring that critical systems can be recovered within defined timeframes following disruption. Includes backup integrity verification, DR site readiness, RTO/RPO definition, and documented, tested recovery procedures. CBK, SASRA, and CMA all require documented and periodically tested BCP/DR.
The overarching framework of policies, structures, and accountability mechanisms governing IT decision-making and risk oversight, including third-party technology risk management. Vendor risk is a rapidly growing concern as Kenyan organisations outsource critical functions to cloud providers and managed service providers with unvalidated security postures.
Vulnerability management, patch management, network segmentation, endpoint protection, and security monitoring capabilities. CBK specifically requires that supervised institutions demonstrate operational vulnerability management programmes with evidence of remediation tracking and escalation for critical findings.
How to Perform an ITGC Audit: Step by Step
A rigorous ITGC audit follows a structured methodology that moves from planning and scoping through control design assessment, operating effectiveness testing, and findings reporting. The following approach reflects international best practice (ISACA, IIA) adapted for the Kenyan and East African regulatory context.
Identify in-scope systems based on financial and operational materiality, and map the key automated controls and system-generated reports that management and external auditors rely upon. For a Kenyan bank, this will typically include the core banking system, internet banking platform, mobile banking application, and payment gateway. The IT risk assessment should drive scope, not administrative convenience.
For each ITGC domain, evaluate whether documented controls are designed to achieve their stated objective. Review policies, procedures, system configurations, and organisational structures. Identify design gaps — the absence of a formal access review process, for example, or the lack of documented approval workflows for system changes — before proceeding to operating effectiveness testing. Design deficiencies cannot be remediated by good test results.
Conduct structured walkthroughs with process owners, tracing individual transactions through each ITGC domain. Obtain and examine evidence including access provisioning records, change management tickets, job scheduling logs, backup verification reports, and vendor contracts. Use data analytics tools — SQL, Python, or IDEA — to analyse user access entitlements at population level rather than relying on samples that may miss systemic issues.
Select statistically valid samples for testing of each key control. For access management: test user provisioning, modification, and termination transactions for evidence of appropriate approval and timeliness. For change management: test a sample of changes deployed to production for evidence of authorisation, testing, and segregation from the development function. For computer operations: test job completion logs and backup restoration evidence.
Classify deficiencies as control deficiencies, significant deficiencies, or material weaknesses based on potential impact. Perform root cause analysis to identify whether findings reflect a technology gap, a process failure, a resource constraint, or a governance accountability gap. Root cause analysis that identifies the governance failure, not just the technical symptom, produces management action plans that actually prevent recurrence.
Issue a structured IT audit report with executive summary, detailed findings, risk ratings, root cause analysis, and time-bound management action plans. Map findings to applicable regulatory requirements (CBK, SASRA, KDPA). Present material findings to the audit committee in plain language — technical jargon that non-technical board members cannot interpret produces no governance value.
IT Audit Checklist for SMEs in Kenya
Small and medium enterprises represent the vast majority of Kenyan businesses by number, and are increasingly subject to data protection obligations under the KDPA, cybersecurity expectations from corporate customers, and technology risk requirements from financial partners. Most SMEs lack dedicated IT audit capability — but a structured self-assessment provides a practical starting point for identifying and prioritising control gaps.
SME IT Audit Self-Assessment — Priority Controls
- User accounts reviewed; leavers’ access removed within 24 hours
- Strong password policy enforced across all systems and cloud platforms
- Multi-factor authentication on email, cloud services, and VPN
- Regular automated backups with documented restoration tests
- Software patches applied within 30 days of release
- Antivirus and endpoint protection on all devices
- Vendor and third-party access reviewed and time-limited
- Staff cyber awareness training conducted annually
- ODPC registration completed; privacy notice published
- Data inventory documenting what personal data is held and where
- Incident response procedure with ODPC notification obligations assigned
- Wi-Fi networks segmented (guest vs. corporate)
- Physical access to server rooms and network equipment controlled
- Payment system access restricted to authorised personnel
- Segregation of duties in financial payment and approval workflows
- Business continuity plan documented, tested, and board-approved
CBK IT Risk Management Guidelines Explained
The Central Bank of Kenya is the most consequential technology risk regulator for Kenya’s financial sector. Its Guidance Note on Cybersecurity and the broader Risk Management Guidelines establish a comprehensive framework that all licensed banks, microfinance banks, payment service providers, and digital lenders must adhere to. These guidelines are not aspirational — they are examined during on-site supervisory reviews, and deficiencies result in formal supervisory actions.
The CBK framework is structured around six core pillars: governance and accountability, risk identification and assessment, control implementation, monitoring and detection, incident response, and third-party risk management. Each pillar maps to specific IT audit procedures that an organisation must be able to demonstrate. The CBK expects a board-approved IT risk management policy, a designated Chief Information Security Officer (CISO) or equivalent, annual independent IT assessments, and quarterly technology risk reporting to senior management and the board audit committee.
What CBK Examiners Actually Look For
During on-site CBK technology risk examinations, examiners consistently focus on four areas: the completeness and currency of IT policies and procedures; the adequacy of user access controls over core banking systems; the integrity of the change management process; and the organisation’s demonstrated ability to recover from a system outage within documented RTOs. Organisations that present policies signed three years ago, shared administrator accounts, and untested disaster recovery plans consistently receive supervisory findings that attract formal remediation timelines.
How to Prepare for a Central Bank IT Audit in Kenya
Preparation for a CBK IT examination should be a continuous programme, not a reactive scramble triggered by an examination notice. Institutions that perform well under CBK scrutiny maintain an evergreen state of audit readiness across all technology risk domains. The following structured preparation pathway reflects the expectations of CBK examiners and the findings that consistently appear in supervisory reports.
-
Step 1Policy and Governance Documentation Ensure all IT-related policies — information security, acceptable use, change management, business continuity, vendor management, incident response — are current (reviewed within 12 months), board-approved, and accessible to staff. CBK examiners will request this documentation on day one. Policies that are unsigned, undated, or inconsistent with current practice are an immediate red flag.
-
Step 2Access Control Review and Remediation Conduct a full review of user access entitlements across all in-scope systems, with particular focus on privileged accounts, terminated employee access, and segregation of duties conflicts. CBK examiners regularly extract user access lists and compare them against HR records — any discrepancy is a finding. Remove or disable all unnecessary accounts before the examination.
-
Step 3Change Management Evidence Assembly Compile evidence of the change management process for the past 12 months, including change request logs, approval records, test results, and post-implementation reviews. Particular attention should be given to emergency changes, which CBK examiners scrutinise for evidence of adequate retrospective review and approval.
-
Step 4Vulnerability and Penetration Test Results Confirm that a vulnerability assessment and penetration test has been conducted by a qualified third party within the past 12 months. Prepare evidence of findings, management response, and remediation progress. CBK expects that critical and high vulnerabilities are remediated within defined timeframes, typically 30 and 90 days respectively.
-
Step 5BCP/DR Testing Evidence Assemble documentation of the most recent business continuity and disaster recovery test, including test objectives, scenarios, results, and lessons learned. CBK examiners will ask whether the test was a genuine functional exercise or merely a paper walkthrough. Institutions without evidence of a tested DR environment are consistently cited.
-
Step 6Incident Register and Prior Finding Closure Prepare a complete log of all IT security incidents in the past 12 months, including root cause, impact assessment, and remediation actions. Critically, compile evidence that all findings from the previous CBK examination have been formally closed — repeat findings attract the most severe supervisory responses and signal a governance failure rather than a technical deficiency.
ICT Authority Cybersecurity Standards Kenya
The ICT Authority of Kenya, operating under the Ministry of Information, Communications and the Digital Economy, has progressively developed a national cybersecurity framework applicable to government ministries, departments, agencies, state corporations, and county governments. The Kenya National Cybersecurity Strategy and the associated Government of Kenya Cybersecurity Framework establish baseline security standards that IT auditors must assess in public sector engagements.
Key ICT Authority requirements include: mandatory adoption of the Kenya National Public Key Infrastructure (PKI) for digital transaction authentication; compliance with the Government ICT Standards and Guidelines covering network security, data management, and system procurement; and alignment with the National Cyber Response Strategy for incident reporting to the National KE-CIRT/CC (Kenya Computer Incident Response Team Coordination Centre). For IT auditors working in the public sector, the ICT Authority framework must be layered alongside sector-specific regulations from the Controller of Budget, Auditor General, and Public Finance Management Act requirements.
Kenya Data Protection Act Compliance & ODPC Audit Requirements
The Kenya Data Protection Act 2019 (KDPA) and its subsidiary regulations impose direct compliance obligations on any organisation that processes the personal data of Kenyan data subjects — regardless of where that organisation is based. The Office of the Data Protection Commissioner (ODPC) has the authority to conduct compliance audits, investigate complaints, and impose financial penalties of up to KES 5 million or 1% of annual gross turnover for violations.
Data Protection Compliance Checklist
Data controllers and processors processing personal data beyond personal use must register with the ODPC. Non-registration is an independent violation, irrespective of the organisation’s substantive compliance posture.
Each category of personal data must be processed on an identified lawful basis: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Consent must be freely given, specific, informed, and unambiguous, and records of consent must be maintained.
Clear, accessible privacy notices must be provided at the point of data collection. Organisations must have operational processes for handling data subject access requests, correction requests, and erasure requests within the KDPA’s prescribed timeframes.
DPIAs are mandatory before undertaking processing activities that are likely to result in high risk to data subjects. For Kenyan financial institutions deploying new digital products, biometric systems, or AI-based decisioning, DPIAs are a regulatory requirement, not a best-practice exercise.
Material data breaches must be notified to the ODPC within 72 hours of discovery. Notification to affected data subjects is required where the breach is likely to result in high risk. Most Kenyan organisations have not tested their ability to meet this timeline operationally.
Transfers of personal data outside Kenya require either a finding of adequacy in respect of the recipient country or execution of appropriate safeguards such as standard contractual clauses. This is a frequently overlooked obligation for organisations using cloud services hosted outside Kenya.
ODPC compliance audits focus on documentation adequacy, the existence and testing of data breach response processes, the completeness of data inventories, and the effectiveness of data subject rights management. Organisations that have not conducted a formal data protection gap assessment against the KDPA and its regulations since 2021 should treat this as a priority remediation item.
ISO 27001 Certification in Kenya — Cost, Process, and Timeline
ISO/IEC 27001:2022 is the internationally recognised standard for information security management systems (ISMS) and is increasingly required by Kenyan regulators, multinationals, and enterprise clients as evidence of a credible information security posture. CBK has referenced ISO 27001 alignment in its cybersecurity guidance, and several East African governments have mandated ISO 27001 for technology service providers contracting with public sector entities.
A structured assessment of the organisation’s current information security controls against the 93 controls in ISO 27001:2022 Annex A. The output is a gap report identifying what exists, what is absent, and what requires enhancement before a certification audit is achievable.
Development and implementation of the ISMS documentation framework: information security policy, risk assessment methodology, Statement of Applicability, risk treatment plan, and operational procedures. This phase requires genuine organisational engagement — it cannot be delegated entirely to a consultant.
An internal audit of the ISMS against ISO 27001 requirements, followed by a formal management review. The internal audit must be conducted by a qualified lead auditor and documented to demonstrate the ISMS is operating effectively before the certification body is engaged.
Stage 1 is a documentary review by the accredited certification body. Stage 2 is an on-site audit of ISMS implementation and effectiveness. Non-conformities identified during Stage 2 must be closed before certification is granted. Major non-conformities require a re-audit.
ISO 27001 Certification in Kenya — What to Budget
- Gap assessment and implementation advisory: KES 800,000 – KES 2,500,000 depending on organisation size and complexity, and whether external consultants are engaged.
- Certification body fees (Stage 1 & 2 audit): KES 400,000 – KES 900,000 for a typical Kenyan SME or mid-sized institution. Multi-site organisations attract higher fees.
- Annual surveillance audits: KES 250,000 – KES 500,000 per year for the two annual surveillance visits required to maintain certification between three-year recertification cycles.
- Internal staff time: Often the largest hidden cost — implementing an ISMS genuinely requires substantial management time for policy development, risk assessment participation, and control implementation.
- Typical total timeline: 6 to 12 months from gap assessment to certification for a well-resourced organisation. Organisations with significant control gaps or limited internal capacity should plan for 12 to 18 months.
PCI DSS Compliance for Kenyan Banks & Fintechs
The Payment Card Industry Data Security Standard (PCI DSS) applies to all entities that store, process, or transmit cardholder data — including Kenyan commercial banks, payment service providers, digital wallets, and fintech companies that handle Visa, Mastercard, or other card scheme transactions. Version 4.0, effective from March 2024, introduces significant changes to authentication requirements, customised implementation approaches, and expanded scope for e-commerce and cloud environments that are directly relevant to Kenya’s rapidly growing digital payments sector.
PCI DSS compliance level is determined by annual transaction volume. Level 1 merchants and service providers — those processing over 6 million transactions annually — must undergo an annual on-site audit by a Qualified Security Assessor (QSA). Smaller entities complete a Self-Assessment Questionnaire (SAQ). The most common PCI DSS failures in the Kenyan context include inadequate network segmentation between cardholder data environments and other systems, insufficient logging and monitoring of access to cardholder data, and weak key management practices for encryption of stored card data.
PCI DSS 4.0 — The 12 Core Requirements
- Install and maintain network security controls
- Apply secure configurations to all system components
- Protect stored account data
- Protect cardholder data in transit with encryption
- Protect all systems against malware
- Develop and maintain secure systems and software
- Restrict access to system components by business need
- Identify users and authenticate access to system components
- Restrict physical access to cardholder data
- Log and monitor all access to network resources and cardholder data
- Test security of systems and networks regularly
- Support information security with organisational policies
SACCO Regulatory IT Audit Requirements (SASRA)
The SACCO Societies Regulatory Authority (SASRA) has made technology governance and IT audit a central focus of its supervisory programme, reflecting the rapid digitalisation of Kenya’s SACCO sector. Deposit-taking SACCOs (DT-SACCOs) face the most stringent requirements, but non-deposit-taking SACCOs are increasingly subject to technology risk expectations as they deploy member-facing digital platforms.
SASRA’s technology risk supervisory expectations align broadly with CBK’s framework and require: a board-approved IT governance policy; a designated information security responsible officer; annual IT risk assessments reported to the supervisory committee; documented and tested business continuity and disaster recovery plans; and evidence of access control management and change management processes. SACCOs that have digitalised their operations — through mobile apps, USSD platforms, or agent networks — must demonstrate that the controls over these channels have been independently assessed.
Many Kenyan SACCOs operate core banking systems that were implemented rapidly during the COVID-19 period without adequate security configuration, access control design, or vendor due diligence. SASRA examiners have identified shared administrator accounts, absent change management records, and untested backup systems as the most common findings across the sector — all of which are straightforwardly addressable with a structured ITGC remediation programme.
SACCOs process substantial quantities of member personal and financial data. Beyond SASRA requirements, this data is subject to the Kenya Data Protection Act 2019, creating a dual compliance obligation that most SACCOs have not fully mapped. An effective IT audit for a SACCO must therefore encompass both SASRA technology risk requirements and KDPA data protection obligations.
Continuous Auditing: The Future of IT Assurance in Africa
Traditional point-in-time IT audits — conducted annually and reporting on a control environment that may have changed significantly since the testing period — are increasingly inadequate for the pace of technological change in African financial services. Continuous auditing uses automated tools, data analytics, and real-time monitoring to provide ongoing assurance over key IT controls, enabling internal audit functions to shift from retrospective reporting to proactive risk identification.
For Kenyan organisations, continuous auditing is particularly valuable in three high-volume, high-risk domains: user access management (where automated tools can continuously monitor entitlement changes and flag anomalies against the joiners/movers/leavers process); transaction monitoring (where analytics can identify unusual patterns in mobile money or core banking transactions in near real-time); and configuration management (where automated tools detect unauthorised changes to system configurations and alert audit teams before damage is done).
Starting Continuous Auditing Without Large Technology Investment
Continuous auditing does not require a large technology investment to begin. Kenyan internal audit functions can start immediately with readily available tools: SQL scripts to extract and analyse access logs from core banking systems on a monthly basis; scheduled Active Directory reports identifying new, modified, or disabled accounts against the HR joiner-mover-leaver process; and automated reconciliation of key financial control totals. The discipline required is analytical consistency and the organisational will to follow up on exceptions — the technology itself is a means to an end, not the end. Once this discipline is established, investment in purpose-built continuous auditing platforms such as Galvanize or TeamMate Analytics becomes significantly easier to justify.
Continuous Auditing Maturity Pathway
Internal audit develops scripts or uses existing tools to extract relevant data from key systems on a scheduled basis — monthly user access lists, change management logs, exception transaction reports. No real-time monitoring, but population coverage improves dramatically compared to annual sample-based testing. This is achievable by any Kenyan organisation with a single technically capable auditor and access to the relevant systems.
Automated rules identify exceptions and anomalies that are reported to internal audit for investigation and follow-up. Examples include automated alerts for access provisioned outside the joiner process, changes deployed outside approved change windows, transaction values exceeding defined thresholds, or login attempts from unexpected locations. The audit team shifts from data extraction to exception investigation and remediation tracking.
IT audit operates a fully integrated continuous assurance programme with real-time dashboards, automated exception workflows, and dynamic audit plans that respond to emerging risk signals. At this maturity level — increasingly the expectation of CBK and sophisticated audit committees at major Kenyan financial institutions — IT audit provides the board with a continuously updated view of the control environment, not annual point-in-time snapshots.
Your IT Audit Partner in Kenya & East Africa
Sentinel Assurance Partners provides specialist IT audit, ITGC reviews, CBK and SASRA readiness assessments, ISO 27001 implementation advisory, PCI DSS compliance support, ODPC compliance gap assessments, and continuous auditing programme design for financial institutions, SACCOs, fintechs, and corporates across Kenya and East Africa.
