IT and information systems audit in Nairobi, Kenya
Boards, regulators and external auditors need evidence that your systems are secure, reliable and well controlled. APOPS Assurance carries out independent IT and information systems audits for banks, SACCOs, insurers, NGOs, schools, government agencies and growing companies, and writes reports that management can act on.
Audits we carry out
- General computer controls (GCC / ITGC) review: access management, change management, backups and IT operations
- Application controls review: input, processing and output controls, interfaces, reports and segregation of duties
- Review of the integrity, reliability and availability of your information systems
- IT infrastructure audits: servers, networks, end-user devices, data rooms and cloud services
- Application and core-system audits (ERP, core banking, SACCO and payroll systems)
- Cybersecurity and network security audits, including vulnerability assessment
- IT governance audits against COBIT and ISO/IEC 27001
- Data protection compliance reviews under the Kenya Data Protection Act, 2019
- Business continuity and disaster recovery (BCP/DR) reviews
- Pre-implementation and post-implementation reviews of new systems
- Penetration testing as part of the audit, when the scope needs it
How we work
- Scoping meeting: what the audit must cover and who will rely on it
- Fieldwork: interviews, walkthroughs, system testing and evidence collection
- Findings discussed with management before the report is final
- Report rated by risk, with practical recommendations and owners
- Follow-up review to confirm the issues are fixed
Advice alongside the audit
- Network systems design and integration
- Hardware and software selection, installation and configuration
- Systems integration and analysis: ensuring your systems exchange accurate and consistent data
- Disaster recovery planning and tested recovery drills
Reporting to management
Every finding is discussed with management before the report is final. The report rates each finding by risk, gives a practical recommendation and names an owner and a date, with a one-page summary for the board. A follow-up review confirms that agreed actions have been implemented.
Who does the work
Our team holds CISA, CISM, CISSP, CEH and ISO/IEC 27001 Lead Auditor certifications, and works independently of the systems it audits. Engagements are led from Nairobi and delivered across Kenya and East Africa.
Why APOPS Assurance
- Established in Nairobi in 2016 as Angstrompal Ventures and incorporated as APOPS Assurance Ltd in 2026, serving organisations across Kenya
- IT audit, cybersecurity and compliance delivered by one team, so findings, remediation and monitoring stay connected
- Our team holds CISA, CISM, CISSP, CEH and ISO/IEC 27001 Lead Auditor certifications
- Clear written proposals, signed confidentiality agreements and a follow-up review after every engagement
Frequently asked questions
What is the difference between an IT audit and a financial audit?
A financial audit gives an opinion on the financial statements. An IT audit tests the controls over the systems that produce them, and over security, availability and data. External auditors often rely on IT audit work.
How often should we have an IT audit?
Most organisations audit key systems at least once a year, and again after major changes such as a new core system, a migration to the cloud or a security incident. Your regulator may require a set frequency.
Do you do SACCO and bank IT audits?
Yes. We audit core systems, IT general controls and cybersecurity for financial institutions, and align the work with the expectations of their regulators.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.