Internal Audit Officer - Systems and General Audit

About the role

Salaam Microfinance Bank is hiring a full-time Internal Audit Officer in Westlands, Nairobi, to carry out systems and general audits. The role covers risk-based audits of IT infrastructure, applications, data and business processes, as well as audits of business units, branches and financial and operational processes. The officer's authority is limited to assigned engagements under the Internal Audit Plan, and recommendations go to the Internal Audit Manager.

Key responsibilities

• Plan and conduct risk-based systems, operational, financial, branch and compliance audits in line with the approved Internal Audit Plan, preparing audit plans, programmes and testing procedures.
• Evaluate IT general and application controls, including user access, privileged access, segregation of duties, user account administration and transaction processing.
• Review controls over the core banking system, digital banking platforms, system interfaces, data integrity, logs and audit trails.
• Assess cybersecurity controls such as security patching, vulnerability and incident management, and system monitoring.
• Review system development, acquisition, change management, testing and implementation, and evaluate IT operations, backups, disaster recovery, business continuity, database security and third-party technology services.
• Check compliance with IT policies, data protection requirements and CBK regulatory guidelines, analysing system-generated reports and electronic records for anomalies.
• Test the design and operating effectiveness of internal controls through document review, transaction testing, staff interviews and reconciliations, and carry out spot checks such as cash counts.
• Prepare audit working papers, draft reports with control weaknesses, risks, root causes and recommendations, discuss findings with stakeholders and obtain management responses.
• Track implementation of management action plans, report overdue actions and recurring deficiencies, and undertake special reviews and investigations as assigned.

Governing framework

• The Bank's Internal Audit Charter, approved policies and procedures.
• Kenyan laws and regulations, including the Banking Act, the Microfinance Act and the Data Protection Act, 2019.
• CBK prudential guidelines and AML/CFT obligations where relevant.
• Global Internal Audit Standards and IT audit and information security frameworks.