Senior Officer – Information Systems Audit

The job holder will provide independent, objective assurance on the adequacy and effectiveness of the bank's IT governance, risk management, compliance, and internal control environment. He/she will lead and oversee the planning, execution, reporting, and follow-up of complex audit assignments in line with Information Technology Assurance Frameworks (ITAF) and Standards, CBK Prudential Guidelines, and the bank's policies and internal audit methodology.

• Lead comprehensive, risk-based planning for assigned audits by analyzing enterprise risks, regulatory expectations, historical audit results, emerging risks, and strategic priorities.
• Define audit objectives, scope, and detailed test procedures that directly address inherent, residual, and emerging risks, ensuring alignment with the annual audit plan.
• Conduct in-depth process understanding through system walkthroughs, Logs analysis, policy reviews, and stakeholder interviews to identify control gaps or vulnerabilities early.
• Determine the appropriate audit approach, sampling methodology, nature, timing, and extent of testing using risk-based and data-driven criteria.
• Review core banking systems, payment platforms and IT infrastructure controls.
• Conduct vulnerability assessments and penetration tests.
• Assess cybersecurity controls, access management and incident response.
• Evaluate IT governance, policies, and regulatory compliance.
• Evaluate vendor management processes, including IT service provider oversight, contract compliance, and SLA performance.
• Review the Bank's Business Continuity Management (BCM) framework, including disaster recovery testing.
• Perform audits in accordance with Global Internal Audit Standards (GIAS) and ISACA guidelines.
• Provide Quality assurance on ICT projects before Go-Live.
• Script and schedule continuous audit reports by use of CAATs.
• Conduct forensic reviews from time to time where need arises as directed by Head Of Internal Audit.
• Perform all other related duties as assigned from time to time.
• Prepare high-impact, concise, and well-supported audit reports that clearly articulate issues, underlying root causes, associated risks, and practical recommendations.
• Present audit findings confidently to departmental heads, senior management, and governance committees where required.
• Track and monitor management action plans, validate remediation, and perform follow-up reviews to ensure the effectiveness and sustainability of corrective actions.
• Provide independent and objective assurance on the effectiveness of the bank's IT risk management, compliance, and governance frameworks.
• Evaluate the adequacy and operating effectiveness of controls in key risk areas and across risk types (Cyber security, Access Controls, Business continuity and System related AML risks).
• Review and challenge the quality, completeness, and accuracy of risk assessments, KRIs, RCSAs, and mitigation plans developed by business units and second-line functions.
• Test compliance with relevant laws, regulatory requirements, CBK guidelines, internal policies, and industry best practices.
• Document and escalate control weaknesses, non-compliance, unethical conduct, and emerging risks promptly and in accordance with escalation protocols.
• Provide advisory insight on new regulatory developments and business initiatives while preserving audit independence.
• Maintain up-to-date professional knowledge on emerging ICT risks.
• Determine the audit approach, depth of testing, and

• Advanced analytical, critical thinking, and problem-solving capabilities.
• Strong report-writing and communication skills with the ability to articulate complex issues clearly.
• High professional skepticism, attention to detail, and ability to challenge status quo effectively.
• CISA certification mandatory; CISM, CEH, or ISO 27001 Lead Auditor an advantage.