IT Audit & Assurance

Rigorous, independent evaluation of technology controls, financial systems, infrastructure integrity, and regulatory compliance to safeguard corporate reputation and operating resilience.

Executive Overview

Turning Technology Audits into Strategic Business Assurance

In an interconnected digital economy, technology failures, unmonitored privileged access, and unauthorized system changes do not merely cause operational downtime; they trigger catastrophic financial loss, regulatory fines, and boardroom reputational damage.

ACE ICT Consult provides comprehensive, objective IT Audit and Assurance services across Nigeria and West Africa. We help Boards, Audit & Risk Committees, Chief Internal Auditors, and Chief Information Officers (CIOs) independently verify that their core digital assets, ERP platforms, and operational controls are designed effectively and operating continuously.

COBIT 2019CBN IT StandardsISO/IEC 27001SOC 1 / SOC 2 (ISAE 3402)NDPA 2023

Core Domains

Comprehensive Audit Scope & Focus Areas

Our audit methodology examines every layer of the enterprise technology stack, ensuring no blind spots exist between physical hardware, operating systems, databases, and business applications.

Domain 01

IT General Controls (ITGC)

The foundational bedrock of IT reliability upon which all business applications and financial reporting rely:

Logical Access & Identity: Reviewing user provisioning, role-based access control (RBAC), multi-factor authentication (MFA), segregation of duties (SoD), and quarterly user access re-certifications.
Privileged Access Management (PAM): Scrutiny of domain administrator, database administrator (DBA), and super-user activities, ensuring dual-custody and immutable logging.
Change Management & SDLC: Validating that code promotion from Dev to Test to Production requires formal Change Advisory Board (CAB) sign-offs, automated testing, and rollback plans without developer write-access to live environments.
Computer Operations: Auditing job scheduling, batch processing, database maintenance windows, and monitoring of system event anomalies.

Domain 02

Business Application Controls (ITAC)

Automated and configured rules within core business systems, ERPs, and financial platforms:

Input Controls: Automated boundary checks, format validations, field length constraints, and duplicate transaction prevention at data entry.
Processing Controls: Automated 3-way matching between Purchase Orders, Goods Received Notes, and Invoices; automated payroll computation rules; currency conversions.
Interface & Integration Controls: Verifying API handshakes, cryptographic checksums, and batch file reconciliations between disparate internal and external banking systems.
Audit Trail Completeness: Confirming that system audit logs capture all record creations, edits, and deletions without the ability of privileged users to alter history.

Domain 03

Operational Resiliency & Disaster Recovery

Assessing an organization's true ability to survive physical or cyber disruption:

Backup Integrity: Auditing adherence to the 3-2-1 backup strategy, air-gapping, ransomware immutability, and offsite synchronization.
Restoration Testing: Inspecting verifiable evidence of recent database restores and bare-metal server recovery drills.
RTO & RPO Alignment: Ensuring technical disaster recovery runbooks meet the business's approved Recovery Time Objectives and Recovery Point Objectives.
Data Center & Environmental Controls: Reviewing physical badge access, biometric logging, FM-200 fire suppression, and dual-UPS redundant power infrastructure.

Domain 04

Regulatory & Third-Party Assurance

Navigating mandatory compliance frameworks enforced across Nigerian industries:

Central Bank of Nigeria (CBN) Compliance: Assessing compliance with the CBN IT Standards Blueprint, Risk-Based Cybersecurity Framework, and Payment Service Provider guidelines.
SOC 1 & SOC 2 Readiness: Preparing fintechs, data centers, and managed service providers for independent Service Organization Control attestations (SSAE 18 / ISAE 3402).
Vendor & Outsource Audits: Inspecting cloud hosting providers, external software houses, and outsourced IT contractors against contractual SLAs and data security covenants.
NDPA Data Audit: Verifying that data storage, encryption, and consent logs comply with the Nigeria Data Protection Act 2023.

Structured Methodology

The ACE ICT Consult Assurance Lifecycle

Our audit engagements follow a structured, non-disruptive lifecycle built upon ISACA ITAF standards, ensuring evidence-backed findings and practical remediation paths.

Scoping & Inherent Risk

We map critical business applications, identify high-risk assets, and interview key stakeholders to calibrate audit depth.

Design Testing (TOD)

We review formal IT policies, procedures, architecture diagrams, and system configurations to confirm controls are designed to succeed.

Operating Testing (TOE)

We inspect random statistical samples of real-world evidence (e.g., ticket approvals, access logs, restore logs) across the entire audit period.

Reporting & Action Plan

We deliver an executive summary for the Board/Audit Committee, a detailed deficiency matrix with root causes, and practical management recommendations.

Expert Insight

5 Critical IT Audit Deficiencies Encountered in Nigerian Enterprises

Drawing on over a decade of IT audit engagements across commercial banks, manufacturing conglomerates, and public sector agencies, our teams consistently uncover five preventable control breakdowns:

1. Unrestricted Developer Access to Production Environments

In many fast-moving organizations, software developers retain administrative or direct SSH/RDP credentials to live production servers. This bypasses change management controls entirely, allowing unreviewed code or database hot-fixes to be pushed directly into live financial data, introducing severe fraud and stability risks.

2. Orphaned Accounts & Missing User Access Recertifications

Employees who have resigned, been terminated, or switched departments frequently retain active Active Directory and core application credentials months after departure. A formal, documented quarterly User Access Review (UAR) signed off by department heads is a mandatory control to eliminate ghost accounts.

3. Untested Backups: Assuming Backup Means Recovery

IT departments frequently point to green backup logs as proof of business continuity. However, when auditors request a test restoration of an encrypted SQL database to an isolated server, the restore fails due to corrupt tape headers, missing encryption passphrases, or incompatible versions. Restoration testing is the only true audit evidence.

4. Shared Generic Accounts Without Attribution

The use of shared credentials such as root, administrator, or support makes individual non-repudiation impossible. When a malicious configuration change or unauthorized data export occurs, forensic auditors cannot attribute the action to a specific human user.

5. Unreviewed Third-Party Vendor Integrations

Modern enterprises connect dozens of external third-party APIs and remote vendor access tunnels for maintenance. Without automated expiry dates, IP whitelisting, and strict least-privilege scoping, third-party vendor networks represent the number one attack vector for external breaches.

Frequently Asked Questions

What is the difference between an IT Audit and a Cybersecurity Penetration Test?

A cybersecurity penetration test is an offensive simulation where ethical hackers attempt to exploit vulnerabilities and breach defenses at a point in time. An IT Audit is a broader governance assessment evaluating policies, segregation of duties, change management, operational resilience, and compliance over an extended operating period (e.g., 6 to 12 months).

How long does a standard IT General Controls (ITGC) review take?

A typical enterprise ITGC review takes between 3 to 6 weeks depending on the number of in-scope systems, data center locations, and complexity of integrations. We design our walkthroughs to minimize operational disruption to your technical teams.

What deliverables will our Board and Audit Committee receive?

You will receive: (1) An Executive Summary designed for Board Audit Committees, (2) A detailed Control Deficiencies Matrix ranked by risk severity (Critical, High, Medium, Low), (3) Practical Root Cause Analyses and Remediation Recommendations, and (4) A Remediation Roadmap tailored to your budget and resource capacity.

Your technology should enable the business, not expose it.

Speak to ACE ICT Consult about IT Audit & Assurance.

Book an Audit Review