Job Purpose Statement

Provide independent, reliable, valued, insightful and timely assurance to the Board and Executive Management over the effectiveness of governance, risk management and control over current and evolving ICT risks, in the context of the current and evolving business environment.

Key Accountabilities (Duties and Responsibilities)

Financial 5%

• Manage the Internal Audit costs in line with the approved IA budget.
• Conduct audit reviews that seek to optimize the bank’s costs.

Internal business processes 65%

• Perform annual ICT audit planning and scoping in line with the bank’s ICT strategy.
• Provide Business and ICT management with guidance on ICT risk management matters, particularly on application and infrastructure security.
• Conduct audits and reviews of systems, applications and IT processes. Prepare reports/ results to the Executive Management, Group, and Board Audit Committees. These include:
  • Perform pre and post- implementation reviews of system implementations or enhancements.
  • IT security audits (e.g. network, operating system and data centre), including evaluating if security vulnerabilities are properly identified and mitigated.
  • Coordinate the scope and performance of these reviews with business units and external security experts (where necessary).
  • Evaluate information general computing controls and provide value added feedback. Test compliance with those controls
  • Perform various other reviews of ICT management policies and procedures such as change management, business continuity management/ disaster recovery, and information security to ensure that controls surrounding these processes are adequate.
  • Develop, build & implement tools to analyse data to improve audit efficiency and effectiveness. Ultimately be a source for analytics that Internal Auditors (Business) and Management adopt to provide business insights or for continuous auditing.
  • Track audit issues and perform issues validation to confirm adequacy of ICT issues closure by management.
  • Conduct continuous business monitoring highlighting significant issues impacting the bank’s ICT environment, and suggest solutions to overcome them.
  • Perform independent assessment of ICT risks including identifying areas where the bank should consider additional investment and areas internal audit should focus. Evaluate impact on the overall bank’s risk profile and audit universe.
  • Coordinate external auditors, regulatory examiners and assessors in performing their reviews.
  • Monitor whistleblowing process in line with the bank’s whistleblowing policy.
  • Assist in review of Internal Audit policies, procedures, and methodology to promote efficiency in audit execution and provide greater value to the bank.
  • Carrying out special investigation/tasks as may be directed from time to time by the Head of Internal Audit.

Customer 10%

• Understand the needs of clients and make decisions using this knowledge, and perform customer centric audits targeting at improving process efficiency.
• Conduct advisory and consulting audit reviews targeting at customer value addition.
• Build strong relationships and mutual trust with all internal and external stakeholders.
• Timely discuss and agree on the factual accuracy of audit observations with audit clients.
• Produce timely audit reports, and follow-up on timely remediation of audit findings

Learning and growth 10%

• Embrace continuous learning and professional development.
• Be a change agent and be positive to change.
• Open-minded spirit, receive and implement feedback
• Achieve mandatory 40 hours L&D through E-Learning Courses and classroom training
• Stewardship-be passionate about leaving things better than you found them.

Job Specifications

Academic:

• Bachelor degree preferably in Computer Science, Accountancy, or Finance. Master’s Degree in Finance, Accounting, Computer Science, ICT Risk Management/ Governance, Business Administration is an added advantage.

Professional:

• Qualified as CISA,CPA,CIA,CISSP or equivalent

Desired work experience:

• At least 4 years’ (managerial) experience in ICT auditing or ICT risk/control assurance activities preferably in financial services industry or reputable Audit Firm.
• Relevant knowledge about new and emerging banking products and services.
• Understanding of multiple technology domains including software development, Windows, database management, networking, SAP, and T24 system (preferred).
• Understanding of information security standards, best practices for securing computer systems, and applicable laws and regulations.
• Practical understanding of regulatory environment.
• Proven track record of good conduct and high performance in previous roles.

Job Dimensions

Reporting Relationships:

• Direct Reports – N/A
• Indirect Reports – N/A

Stakeholder Management:

• Internal:
  • Internal Audit colleagues
  • Management
  • Group IA Management
  • Board Audit Committee
• External:
  • Customers
  • Shareholders
  • Regulators
  • External Auditors

Decision Making Authority /Mandates/Constraints:

N/A

Work cycle and impact:

N/A

• Manage the Internal Audit costs in line with the approved IA budget.
• Conduct audit reviews that seek to optimize the bank’s costs.
• Perform annual ICT audit planning and scoping in line with the bank’s ICT strategy.
• Provide Business and ICT management with guidance on ICT risk management matters, particularly on application and infrastructure security.
• Conduct audits and reviews of systems, applications and IT processes. Prepare reports/ results to the Executive Management, Group, and Board Audit Committees.
• Perform pre and post- implementation reviews of system implementations or enhancements.
• Perform IT security audits (e.g. network, operating system and data centre), including evaluating if security vulnerabilities are properly identified and mitigated.
• Coordinate the scope and performance of these reviews with business units and external security experts (where necessary).
• Evaluate information general computing controls and provide value added feedback. Test compliance with those controls
• Perform various other reviews of ICT management policies and procedures such as change management, business continuity management/ disaster recovery, and information security to ensure that controls surrounding these processes are adequate.
• Develop, build & implement tools to analyse data to improve audit efficiency and effectiveness. Ultimately be a source for analytics that Internal Auditors (Business) and Management adopt to provide business insights or for continuous auditing.
• Track audit issues and perform issues validation to confirm adequacy of ICT issues closure by management.
• Conduct continuous business monitoring highlighting significant issues impacting the bank’s ICT environment, and suggest solutions to overcome them.
• Perform independent assessment of ICT risks including identifying areas where the bank should consider additional investment and areas internal audit should focus. Evaluate impact on the overall bank’s risk profile and audit universe.
• Coordinate external auditors, regulatory examiners and assessors in performing their reviews.
• Monitor whistleblowing process in line with the bank’s whistleblowing policy.
• Assist in review of Internal Audit policies, procedures, and methodology to promote efficiency in audit execution and provide greater value to the bank.
• Carrying out special investigation/tasks as may be directed from time to time by the Head of Internal Audit.
• Understand the needs of clients and make decisions using this knowledge, and perform customer centric audits targeting at improving process efficiency.
• Conduct advisory and consulting audit reviews targeting at customer value addition.
• Build strong relationships and mutual trust with all internal and external stakeholders.
• Timely discuss and agree on the factual accuracy of audit observations with audit clients.
• Produce timely audit reports, and follow-up on timely remediation of audit findings
• Embrace continuous learning and professional development.
• Be a change agent and be positive to change.
• Open-minded spirit, receive and implement feedback
• Achieve mandatory 40 hours L&D through E-Learning Courses and classroom training
• Stewardship-be passionate about leaving things better than you found them.

• ICT risk management
• Application and infrastructure security
• IT security audits
• Information general computing controls
• Change management
• Business continuity management/ disaster recovery
• Information security
• Data analysis tools
• Audit issue tracking and validation
• Continuous business monitoring
• ICT risk assessment
• Whistleblowing process monitoring
• Customer centric audits
• Advisory and consulting audit reviews
• Stakeholder relationship management
• Continuous learning and professional development
• Change management (as a change agent)
• Feedback implementation

• Bachelor degree preferably in Computer Science, Accountancy, or Finance.
• Master’s Degree in Finance, Accounting, Computer Science, ICT Risk Management/ Governance, Business Administration is an added advantage.
• Qualified as CISA,CPA,CIA,CISSP or equivalent
• At least 4 years’ (managerial) experience in ICT auditing or ICT risk/control assurance activities preferably in financial services industry or reputable Audit Firm.
• Relevant knowledge about new and emerging banking products and services.
• Understanding of multiple technology domains including software development, Windows, database management, networking, SAP, and T24 system (preferred).
• Understanding of information security standards, best practices for securing computer systems, and applicable laws and regulations.
• Practical understanding of regulatory environment.
• Proven track record of good conduct and high performance in previous roles.