Principal Information Systems Auditor  .T. Auditors  Supporting the principal information systems auditor and head of internal audit in examining, evaluating and verifying information systems, internal controls, recorded data for information technology, information security, assessing adequacy of risk mitigants and recommending appropriate course of action to ensure secure, effective and efficient operating environment that enables accomplishment of organisational objectives. 1. Plans risk based information system audits in a manner consistent with professional standards of conduct of the Institute of Internal Auditors (IIA) and Information Systems Audit and Control Association (ISACA) guidelines.
2. Decides on and prioritises functional areas to audit based on percieved risk and enterprise risk ratings.
3. Develops audit objectives for reviewing computer systems and prepare audit procedures to be executed in application controls review, information systems operational general controls review, systems architecture, information systems post implementation review, network architecture, systems access, security review and quality assurance for IT projects.
4. Analyses and documents all information systems and related controls and develop appropriate audit programs to serve as a minimum guideline for Information Systems Auditors.
5. Conducts information systems audits to assess adequacy, effectiveness and efficiency of internal controls and operational procedures.
6. Supervises audit assigments, review audit working papers and draft reports prepared by IT Auditors.
7. Reviewes accuracy, timeliness and relevance of financial information using Computer Assisted Audit Techniques (CAATS e.g. Audit Command Language - ACL, Interactive Data Exchange and Analysis - IDEA, Ms Access, Ms Excel)
8. Discusses audit findings and recomendations with line managers and report significant/material issues to senior management through detailed audit reports circulated to relevant stakeholders.
9. Provides an opinion on the adequacy, effectiveness and efficiency of internal controls, overall risk rating from the audit and direction of risk e.g. improving, stable or deteriorating.
10. Monitors the timely implementation of agreed management action/ remedial action by line managers.
11. Represents Group Internal Audit in meetings where independent IT quality assurance function is required
12. Assists and guides External Auditors (currently KPMG) during IT Assurance reviews.
13. Performs any other related duties as may be assigned by the Principal IT Auditor from time to time.
14. Delegates tasks to and manages the performance of subordinates.
 Audit Report
Annual Audit Plan
Data Analysis Files
Departmental Meetings

 Audit Working Papers
Draft Audit Reports
Progress Meetings

  Document application systems, operating system, network architecture, hardware specifications and general IT environment.
 Establish audit objective, scope of work and design audit programmes 
 Communicate with appropriate stakeholders.
 Research on activities to be audited and keeping abreast with trends in technology and new risks. 
 Formulating an audit strategy and work plan.
 Decide how, when and to whom audit results will be communicated.
 Performing as appropriate, an on-site survey of the control activities to be reviewed, identify areas of audit emphasis and invite line managers comments and suggestions.
 Consider the use of audit software (BarnOwl), CAATS and test data as this has an effect on the nature, timing and extent of audit tests.
   Degree in Accounting, Computer Science, Information System or related field   Certified Information Systems Audit (C.I.S.A)
 Certified Information Security Management (C.I.S.M)
 6 years  Must have thorough knowledge of Basel II/III Risk Management 
 Must have thorough knowledge of BarnOwl Risk Management and Auditing Software 
 Must have thorough technical knowledge of computer applications, operating systems, hardware, networks and general IT environment. 
 Ability to understand, analyse and assess business information technology issues and make logical conclusions and recommending appropriate action.
 Working knowledge of computer based auditing toolkits e.g. ACL, IDEA 
 Excellent data analysis and evaluation skills 
 Must be technically savvy, continously researching and informed on latest trends in technology and related risk
  Decides on audit objectives for a particular IT Audit assignment 
 Decides on audit procedures to perform 
 Decides on time budgets, staffing and other resources for audit engagements 
 Decides on control weaknesses and percieved risk in operational procedures, application system and IT Architecture. 
 Decides on approriate remedial action to recommend to management for each perceived control weakness or identified risk.
 Decides appropriate course of action during meetings
  Ensuring compliance with ZB Group IT Policy Framework 
 Ensuring compliance with ZB Group Information Security Management Policy 
 Ensuring compliance with RBZ Guidelines on IT systems
 Ensuring compliance with IT systems guidelines from ISACA, best practice and system vendors like IBM.
 Convincing management on perceived or actual risk and adoption/implementation of remedial action.
 Attending to adhoc, emergency, disaster and/or unstructure assignments


Job evaluation subgrade: D