servicesinformation technology consultancy
IT audit of the systems that carry the numbers, plus data-protection and cyber-risk review, so finance, audit committees, regulators, and donors can see whether access, change, and protection are actually under control.
01 / Paradigm
Current
The books, payroll, beneficiary records, and customer data run on systems nobody has tested. Access is shared, changes are undocumented, and personal data sits in a cloud tenancy nobody has traced. The risk is a set of numbers and filings the board cannot defend.
Target
IT general and application controls evidenced; personal data traced under Cap. 97; security risk owned by named people. Findings written in the language of ISA 315, COBIT, and Ugandan law — readable by a finance director, an audit committee, a donor, or a regulator.
02 / IT audit
01 Scope
An engagement letter fixes criteria, boundaries, and independence before any system is opened.
02 Walk through
We trace access, change, and processing with the people who operate them — not from a questionnaire.
03 Test
Samples, configuration evidence, and logs are tested against the matrix and retained as working papers.
04 Report
Exceptions are graded by risk and connected to reporting consequence, with owners and dates.
CriteriaEnvironment
Hover a stage to inspect what the review actually tests.
03 / Rooms
01 IT audit01 / 03
Walkthroughs and tests of the general and application controls around the systems that feed the financial statements. One offer, two families: who can change what, and what the system computes.
Two families. One file.
Next: Data protection
02 Data protection02 / 03
Mapping personal-data flows; classifying the organisation as collector, controller, or processor; checking registration with the Personal Data Protection Office and designation of a data protection officer; and reviewing lawful bases, retention, security measures, and cross-border transfers under Cap. 97.
Know where personal data goes.
Next: Cyber-risk
03 Cyber-risk03 / 03
Risk workshops and control reviews covering policies, vendor and cloud arrangements, incident-response plans, and business continuity — reported for audit committees and management. This is an assurance lens on security risk, not a monitoring service.
Know what fails under pressure.
Reference patterns
04 / Practice
Illustrative shapes of work, not client case studies. The actual scope depends on your entity type, systems, and the independence position we confirm before we start.
Supervised financial institutions
Bank of Uganda made cyber and technology-risk management requirements mandatory for supervised institutions from 1 December 2024, on top of the 2024 corporate-governance regulations that put IT strategy, outsourcing, and cyber infrastructure on the board. The usual buy is a cyber-risk review — sometimes paired with an IT audit of the systems the board is being asked to own.
Development partners & NGOs
Grant agreements and due-diligence questionnaires ask for evidence on beneficiary data, cloud hosting, access to finance systems, and incident handling. The usual buy is data protection under Cap. 97, often with an IT audit of the finance system — mapped to the donor questionnaire and to Uganda’s own law, which is not a copy of the GDPR.
Government & project units
The usual buy is an IT audit around IFMIS, payroll, and e-government systems, plus data protection for citizen and staff records. Reviews are written in NITA-U and National Information Security Framework language — usable by the accounting officer and internal audit.
Private companies
The usual buy is an IT audit: a pre-year-end diagnostic around a go-live or major upgrade — what changed, who has access now, whether the interfaces reconcile, and which exceptions the external auditor will otherwise raise in the management letter.
05 / Delivery
Most work is a defined project: an engagement letter, a short discovery week, fieldwork, and a closing report to management or the audit committee. This is not a penetration test or a SOC. Pre-year-end diagnostics are timed to feed the statutory audit. Data-protection readiness is usually a four-to-eight-week project around registration, a new system, or a donor questionnaire.
Deliverable · Scope
Scope, criteria, independence conclusions, and what remains management’s responsibility — agreed in writing before a single system is opened.
Deliverable · Evidence
An inventory of systems, owners, data stores, and interfaces, with design and — where in scope — operating-effectiveness test results against each control.
Deliverable · Reporting
Exceptions graded by risk with practical remediation owners and dates, plus a management letter or audit-committee briefing connecting IT exceptions to financial or donor reporting risk.
Deliverable · Follow-up
A remediation tracker, and an optional awareness pack for staff who handle personal or financial data. Follow-up testing if you want it.
Independence
Management decides, implements, and operates. We do not host your data, run your network or website, or implement a system we would later test. Where Kisaka & Company is also appointed as external auditor, conflict and self-review checks are documented before any IT work begins, and work that cannot be reconciled with the audit is declined or reshaped.
External auditTell us the entity, the systems, and the deadline. We will confirm scope, independence, and the right team before any work begins.
Start a conversation