Internal Auditor (ICT) – Risk‑Based IT Audits

About the role

The ICT Internal Auditor conducts risk‑based audits of information systems, cybersecurity controls, technology infrastructure and digital platforms. The role evaluates IT governance, general and application controls, data management, business continuity, cloud services and third‑party technology controls, using data analytics to identify weaknesses and improvement opportunities.

Key responsibilities

• Plan and execute ICT audits across the organization and subsidiaries, assessing compliance with internal policies, regulations and standards.
• Develop audit plans, risk and control matrices, audit programs and working papers; identify control weaknesses and recommend practical improvements.
• Use data analytics to support audit planning, testing and reporting, analysing system and transaction data for anomalies, control failures and fraud indicators.
• Review IT general controls such as access, change, operations, system development, backup and recovery, as well as cybersecurity governance, vulnerability management and incident response.
• Evaluate third‑party technology, cloud security and outsourced service controls, and follow up on identified weaknesses.
• Audit ICT projects, system implementations, upgrades and migrations, assessing governance, risk management, testing and data migration controls.
• Conduct application audits of digital lending platforms, USSD services, core business applications and other critical systems, reviewing user access, transaction processing and audit trails.
• Support audit‑management, data‑analytics and automation platforms; develop and maintain data queries, scripts, dashboards and automated tests.
• Prepare clear, evidence‑based audit findings and reports, discuss observations with process owners, and present results to management and board committees.