SASRA IT Compliance Bundle for SACCOs
The complete SASRA IT compliance toolkit purpose-built for Kenya’s DT-SACCOs — Risk Register with 190 Controls, 190+ Audit Procedures, 6 Management Dashboards, IT Audit findings log, Evidence request log, and Board-ready Report templates. Walk into your SASRA examination with every document ready.
The compliance challenge
New SASRA and CBK regulations have raised the bar — is your SACCO examination-ready?
The SASRA and CBK regulations state the mandatory requirements for all regulated SACCOs, including offering digital financial services. Non-compliance is no longer a management letter observation — it is an examination finding that attracts directed remediation, financial penalties, and in serious cases, licence conditions.
Digital channel scrutiny is at an all-time high
SASRA examiners are specifically testing ATM, mobile money, and internet banking controls. SACCOs without documented, tested procedures are failing examinations they were passing 12 months ago.
Third-party risk is now a primary examination focus
The directive explicitly requires documented oversight of technology vendors and system integrators. Undocumented vendor relationships and missing contractual controls are the most common new findings.
Generic audit templates are not enough
Generic IT audit programs do not reference SASRA’s specific regulatory instruments, do not cover SACCO-specific digital channels, and do not align to the requirements. Examiners notice.
Time pressure is real
Building a SASRA-aligned audit program from scratch takes experienced IT auditors weeks of research and drafting time. The examination cycle does not wait for internal capacity to catch up.
What’s included
190 audit controls across 14 domains — including a full Risk Register and Overall Audit Program
A complete SASRA compliance bundle — Risk Register (190 controls), Overall Audit Program (190+ audit procedures), 6 Dashboards, IT Audit findings log, Evidence request log, and 5 Board-ready report templates. Every document a DT-SACCO needs for SASRA examination readiness. Ready to deploy.
- Board-approved IT and cybersecurity policy review
- IT governance function and CISO accountability
- Digital channel risk assessment (within 12 months)
- IT strategy alignment to business plan
- Policy coverage of digital channel security obligations
- ATM asset inventory and network connectivity
- Logical access and MFA for ATM management systems
- Physical security, CCTV, and anti-skimming controls
- Firmware patch management and version currency
- Real-time transaction monitoring and alert thresholds
- Network encryption and certificate management
- Mobile money integration inventory and contracts
- API security — authentication, rate limiting, input validation
- Transaction limits, velocity controls, and risk appetite alignment
- Mobile money reconciliation frequency and exception handling
- Member authentication and step-up for high-value transactions
- Encryption in transit and at rest (TLS 1.2+ minimum)
- SIM-swap detection and fraud prevention procedures
- Platform architecture and hosting arrangement review
- Multi-factor authentication — members and administrators
- Session management, timeout, and re-authentication
- Web application penetration test and OWASP Top 10
- Maker/checker workflows and transaction signing
- Audit logging — tamper-resistance and retention
- Web Application Firewall (WAF) implementation
- DDoS mitigation capabilities
- Complete vendor inventory with criticality classification
- Pre-engagement security due diligence procedures
- Contract review — DPA, right-to-audit, SLA, exit clauses
- Vendor access management — time-bounded and logged
- Ongoing monitoring — SOC 2, ISO 27001, annual reviews
- Vendor incident escalation and notification timelines
- Concentration risk analysis and contingency planning
- System integrator change control and security testing
- ODPC registration and DPO appointment verification
- Data classification and handling for member data
- Privacy notices and consent mechanisms
- Data retention schedules and deletion evidence
- Data subject request handling procedures
- Incident Response Plan covering all digital channel scenarios
- SIEM and alert detection capability assessment
- SASRA 24-hour and ODPC 72-hour reporting procedures
- Documented and Tested BCP/DRP with defined RTOs and RPOs
- Cybersecurity awareness training, coverage and completion
- Tabletop exercise results and action item tracking
- Board IT strategy, steering committee oversight
- IT policies, standards and procedures — all key domains
- Independent IT assurance and audit committee
- IT risk register, risk appetite and KRI metrics
- SASRA statutory return generation (Forms 1A–4B)
- GL-to-MIS reconciliation, maker-checker SoD
- IT asset inventory and lifecycle management
- Server build standards, hardening and patch currency
- Database security, access control and activity monitoring
- Network perimeter — firewall rule-base, segmentation and IDS/IPS
- Network device hardening and configuration baselines
- Remote access & VPN — MFA, split-tunnel policy and session logging
- Capacity planning, performance monitoring and data-centre physical access
- Dual-authorised user provisioning and RBAC
- SoD conflict checking before access grant
- Privileged Access Management (PAM) — logging and quarterly review
- Access termination within 1 business day — automated workflow
- Monthly IT-vs-HR active user reconciliation
- Semi-annual User Access Review (UAR) with sign-off
- MFA and password policy enforcement
- Formal RFC process — documented, risk-assessed, authorised
- Non-production testing, UAT sign-off, masked test data
- Emergency change controls with retroactive approval
- Change Advisory Board (CAB) for significant changes
- Rollback plan — documented and validated during testing
- Separation of development and production environments
- Source code repository access control and version management
- RPO/RTO-aligned backup schedules — full, incremental, differential
- Offsite and encrypted backup storage
- Backup restoration testing — minimum annually
- Documented BCP covering critical processes and roles
- Documented DRP with defined RTO/RPO for critical IT systems
- Annual BCP/DRP testing — tabletop or full failover
- CVSS-prioritised vulnerability scanning — minimum monthly
- Threat intelligence feeds and CVE monitoring
- Patch testing, deployment SLAs, and monthly KPI compliance
- Unpatchable asset exception with CISO approval
- Documented SIRP — tested annually
- SASRA 24-hour and ODPC 72-hour incident notification
- Root cause analysis and post-incident review within 5 days
- Risk-based vendor due diligence before onboarding
- ODPC-compliant Data Processing Agreements (DPAs)
- Annual vendor performance review — SOC 2, ISO 27001
- Project charter, steering committee, and scope change control
- SAST/DAST, SCA, and penetration testing before go-live
- Data masking for test environments
- Post-implementation review and lessons learned
Built-in management dashboards
6 Board-ready dashboards
Most audit programs give you a spreadsheet. The SASRA IT Compliance Bundle gives you a complete management intelligence system. The Risk Register workbook includes 6 pre-built dashboards that auto-populate directly from your data — open the file, populate your controls, and your board-ready risk reports are ready instantly. No additional configuration. No extra software.
What the data reveals
What every DT-SACCO discovers when it runs this audit framework
These numbers come from real SASRA IT audit engagements conducted using this framework. They are what your Audit Committee and SASRA examiner will see — and they are why documentation matters.
The investment case
KES 50,000 — versus building it yourself
Every DT-SACCO needs exactly what is in this bundle. Here is what producing each component independently would cost — versus purchasing the complete SASRA IT Compliance Bundle today.
Regulatory alignment
Built on Kenya’s actual regulatory instruments
Every audit procedure is anchored to a specific regulatory requirement — not generic best practice. When SASRA examiners ask for your audit evidence, you point to the specific control and the specific regulatory instrument it satisfies.
Who this is for
Built for every professional involved in SACCO IT assurance
Whether you are an external IT auditor, an internal audit function, a SACCO board member, or a compliance officer, this program gives you a structured, defensible audit approach that satisfies SASRA’s examination expectations — ready to tailor and deploy. Costs less than a single day of IT Audit consulting.
What you receive
Everything you need — ready to use on your next SASRA IT Audit engagement
-
Excel FilesRisk Control Matrix / Risk RegisterFully populated RCM with 190 individual controls across 14 domains. Captures risk statement, likelihood, impact, inherent risk rating, control statement, control type, nature, frequency, ownership, regulatory mapping, and residual risk. The living document SASRA expects your SACCO to maintain.
-
Overall Audit ProgramStep-by-step audit program with 190+ test procedures linked by Control ID to the Risk Register. Each procedure includes the control objective, detailed test steps, evidence required, SASRA regulatory reference, sample size guidance, and 28 fieldwork and reporting columns for the auditor to complete.
-
IT Audit Findings LogRemediation tracking workflow from finding to closure and includes a Summary dashboard and domain breakdown
-
Evidence Request LogThe complete tracking register from Evidence request to receipt.Evidence items across 190 controls and all 14 domains.
-
Dashboards (built into the Risk Register)6 Board-Ready Management DashboardsSix pre-built dashboards auto-populate directly from the Risk Register — no configuration required: Inherent Risk Dashboard, Residual Risk Dashboard, Risk Reduction Analysis, Risk Responses Dashboard, Controls Dashboard, and Risk Appetite Dashboard. Populate your data once and all six reports update automatically.
-
Board & Management ReportsBoard RCM PresentationBoard-level PowerPoint presentation covering the full Risk profiles. Structured for Audit Committee Board with executive KPIs, domain scorecard, and governance action items.
-
IT Management ReportDetailed IT management PowerPoint deck covering full domain analysis, control effectiveness breakdown, residual risk by domain, structural insights, and the complete Management Action Plan register.
-
Board MAP Status DashboardBoard-facing Management Action Plan status presentation — executive summary of overdue actions, Critical/High escalations, owner accountability scoreboard, remediation timeline heat map by domain and month, and five specific governance actions for the Audit Committee to action.
-
IT Management MAP DashboardOperational MAP dashboard for IT management — full overdue register, 90-day critical path, complete action plan register, domain risk analysis, owner accountability scoreboard, and owner-specific management actions.
-
Audit Programme InsightsThe governance intelligence layer on top of the full audit dataset. Analytics presentation derived from the Overall Audit Program — remediation velocity, owner accountability scoreboard, due-date heat map by domain and month, conclusion quality scorecard, SASRA regulatory coverage map, and the 90-day critical path.
-
Regulatory CoverageFull Regulatory Mapping — SASRA, ODPC, CBK, BCBS, NIST, COBITCitation-ready for SASRA examination responses. Every control maps to specific regulatory instruments: SASRA, Kenya DPA 2019, CBK BCBS Principles etc.
-
Ready to customise and deployAll fields are unlocked for modification. Update risk ratings, control effectiveness, ownership, and findings based on your own fieldwork. The Index sheet includes usage instructions and notes. Costs less than a single day of IT audit consulting.
Complete bundle — all files, dashboards & reports included
- Risk Register / RCM (190 controls, 14 domains)
- Overall Audit Program (190+ procedures, 28 columns)
- IT audit findings log (findings, recommendations, action plans, due dates & owners)
- Evidence Request Log
- Risk Impact & Occurrence Matrix
- 6 built-in management dashboards
- Board RCM Presentation (PowerPoint)
- IT Management Report (PowerPoint)
- Board MAP Status Dashboard (PowerPoint)
- IT Management MAP Dashboard (PowerPoint)
- Audit Programme Insights (PowerPoint)
- SASRA, ODPC, CBK, BCBS, NIST & COBIT mapping
- Email support from Sentinel’s audit team
🔒 Secure payment | Instant delivery by email
Multi-SACCO & firm licensing available — contact us
Add-on services
Optional services to deploy the bundle faster
The KES 50,000 bundle is complete and ready to use on its own. For SACCOs that want hands-on support, Sentinel’s certified IT audit team offers these optional add-on services — priced separately depending on the size of your organization and the scope/statement of work.
We configure the Risk Register and Audit Program to your SACCO’s specific control environment, size and service model (DT-SACCO vs non-withdrawable) — populating ownership, scope and applicable domains so your team can begin testing immediately.
A remote or on-site working session where our team helps your IT and internal audit functions deploy the toolkit, calibrate risk ratings to your environment, and produce your first Board-ready risk report.
We populate a Management Action Plan tracker from your existing audit findings — each with a named owner, agreed due date and live status — giving your Board Audit Committee a ready remediation-tracking dashboard.
A structured review mapping your current controls against the SASRA Cybersecurity Directive, pinpointing exactly which controls need updating.
Sentinel independently tests and validates your populated Risk Register and controls — delivering the board and examiner-ready independent assurance that internal documentation alone cannot. Scope and fee depend on SACCO size.
For audit firms, consultancies and SACCO groups deploying the bundle across multiple clients or branches — discounted multi-engagement licensing tailored to the number of entities.
To add any of these services, email sales@sentinelassurancepartners.co.ke or call +254 769 546 128. Fees are per SACCO and scope of work.
Risk Control Matrix & Risk Register
A complete Risk Register — not just an audit checklist
Most IT audit programs tell you what to test. This toolkit goes further — it includes a Risk Control Matrix (RCM) / Risk Register with 190 individual controls mapped to risks, regulatory instruments, control types, ownership, and frequency. This is the living document SASRA expects your SACCO to maintain and your auditors to test against.
The Risk Register and Overall Audit Program are linked by Control ID — meaning every audit test procedure in the audit program traces directly back to a documented risk and control in the register. This is the standard examiners look for.
Controls classified as Critical address risks that — if the control fails — are likely to result in material financial loss, regulatory sanction, or irreversible member data loss. Every Critical control has a named owner, a documented regulatory reference, and a specific audit test procedure.
High-rated controls cover significant risks with elevated probability of exploitation. Each includes inherent risk assessment, control effectiveness column, residual risk rating, risk response (Avoid / Reduce / Transfer / Accept), and SASRA regulatory mapping.
Each risk is documented at three levels: Enterprise Risk (e.g. Operational Risk), Intermediary Risk (e.g. Information Security Risk), and Library Risk (e.g. External Data Breach Risk). This hierarchy aligns with SASRA’s risk-based supervisory approach and your SACCO’s own risk appetite framework.
Risk Register columns — what’s captured for every control
Overall Audit Program columns — what the auditor completes in the field
Why Sentinel
Written by certified IT auditors with 15+ years of financial sector experience
Sentinel Assurance Partners Ltd is Kenya’s dedicated IT audit, cybersecurity assurance, and technology risk advisory firm. Our team brings global experience covering various industries — Banking, Insurance, Gaming, and Finance — combined with deep understanding of Kenya’s SACCO regulatory environment.
This audit program was built by practitioners who have conducted IT audits in regulated financial institutions and understand exactly what SASRA examiners are lookin your IT environment.
We serve SACCOs, banks, fintechs, insurance companies, and government entities across East Africa, with regulatory fluency.
Our credentials
- Certified Information Systems Auditor (CISA) — ISACA
- Certified Information Systems Security Professional (CISSP)
- Certified in Risk and Information Systems Control (CRISC)
- Certified Cloud Security Professional (CCSP)
- Certified Data Privacy Solutions Engineer (CDPSE)
Read our SASRA 2026 compliance guide
Understand the full scope of SASRA’s April 2026 IT audit requirements before deploying this program.
Read the guide →Frequently asked questions
Common questions from SACCO auditors and compliance officers
Your SASRA examination is coming. Walk in with Confidence.
Get the complete SASRA IT Compliance Bundle — Risk Register with 190 Controls, 6 built-in Dashboards, and 190+ Audit procedures and demonstrate full IT governance documentation on examination day. Instant delivery. KES 50,000.
