Stephen O

Manager, Information Systems Audit - CPF Group.

CPF Financial Services • Full-time

Aug 2024 - Jun 2026 • 1 yr 10 mos

Key Achievement: Elevated the IS Audit function by establishing direct reporting lines to the Board and automating IT audit review. - Board Audit Committee Reporting: Present quarterly IT audit findings, emerging cyber risks, and control maturity assessments directly to the Board Audit Committee, facilitating high-level decision-making and ensuring executive oversight on technology risks. - IS Audit Planning & Strategy: Lead the annual Technology and Information Systems risk assessment process to develop and execute a risk-based Group IS audit plan, ensuring alignment with organizational strategic objectives. IT Governance & Compliance: Direct reviews of IT Governance frameworks to assure the effectiveness of the control environment, ensuring strict adherence to internal policies and regulatory guidelines. - Automation & Scripting: Automated over 10 IT control tests using Bash, SQL and IDEA scripts, reducing manual audit testing time by 30% and enabling 100% population testing versus traditional sampling. - Stakeholder & Remediation Management: Maintain a proactive approach to risk management through continuous engagement with senior management; track all audit issue action plans to closure within agreed timelines to ensure risk mitigation. - Team Leadership: Mentor and develop the IS audit team, sharing knowledge on emerging threats and advanced audit methodologies to enhance departmental capabilities.

Senior Consultant ( IT Risk, IT Audit, Enterprise Risk Management)

Deloitte • Full-time

Jul 2019 - May 2022 • 2 yrs 10 mos

Key Achievement: Developed comprehensive training programs focused on IT risk management, cybersecurity, and compliance, delivering sessions via in person and virtual workshops to enhance firm-wide capabilities. - Regional Audit Leadership: Served as IT audit and advisory field lead for over 70 clients across East Africa, reviewing policies to manage information risk effectively. - Reporting & Communication: Prepared detailed reports on audit conclusions and presented findings to client management, ensuring clear communication of risks and recommendations. - ERP Audit: Conducted deep-dive reviews of ERP application controls, focusing on segregation of duties (SoD), master data integrity, and privileged access management (PAM) for Business Central and SAP. - Business Development: Contributed to business development through proposal writing and maintaining constant communication with client management. - Team Leadership: Provided structured feedback to team members and acted on leadership feedback to enhance engagement execution quality.