Business

Internal Auditor

Provides independent, objective assurance and consulting services to help organisations achieve their objectives — evaluating risk management, internal controls, governance processes and operational efficiency. Combines accounting expertise, risk assessment, compliance knowledge and analytical skills. In Kenya's evolving regulatory environment (CBK, IRA, CMA, KRA, Data Protection Act), internal auditors are essential for corporate governance, fraud prevention and operational integrity.

AI exposure: 79 of 100, high exposure
Hiring trend: Rising
Hiring rate: 50%

The role

What the work is, what it pays, and what it costs you.

At a glance

Remote friendly: Yes
Freelance potential: Medium
Time to senior: 8 years

A day in the role

Conducts a financial audit of the procurement department — testing tender procedures, supplier payments and contract compliance. Performs IT audit testing — reviewing user access controls, password policies and change management logs. Investigates a suspected fraud case — tracing transactions and interviewing staff. Prepares an audit report identifying 5 control deficiencies and recommending corrective actions. Presents audit findings to the board's audit committee. Follows up on previous audit recommendations — verifying implementation.

What it pays

Kenyan market, per month

Entry: KES 55,000-100,000
Mid: KES 130,000-280,000
Senior: KES 320,000-700,000

Exposure

How much of this a machine can already do, and how that was worked out.

Where this rating sits

1,516 rated careers

lowmoderatehigh

020406080100

Rated above 96% of the 1,516 careers in the catalogue, which averages 43. Inside business the mean is 55, across 118 careers.

Named task by task

Already automated

AI-powered anomaly detection in financial transactions and expense claims
Automated control testing using continuous control monitoring platforms
AI-assisted risk assessment from organisational data and historical audit findings
Generating audit reports and management letter drafts from test results

Still human

Developing risk-based audit plans — identifying key risks, assessing control adequacy, prioritising audit areas based on risk and organisational objectives
Conducting financial audits — verifying financial records, testing accounting controls, ensuring IFRS compliance, assessing financial reporting accuracy
Conducting operational audits — evaluating efficiency and effectiveness of operations, identifying process improvements, cost-saving opportunities
Conducting compliance audits — testing compliance with CBK, IRA, CMA, KRA, Data Protection Act, labour law and internal policies
Conducting IT audits — assessing information security controls, data integrity, system access management, change management, business continuity
Evaluating risk management — assessing the organisation's risk identification, assessment, mitigation and monitoring processes
Reporting audit findings — preparing audit reports, management letters, recommending corrective actions, tracking implementation
Providing consulting services — advising management on controls, risk mitigation, process improvements and governance

Task counts

Displacing: AI automates control testing, transaction sampling and anomaly detection — reducing manual audit testing.
Augmenting: AI anomaly detection identifies suspicious transactions. Automated control monitoring enables continuous auditing. AI risk assessment improves audit planning.
Creating: AI-driven audit platforms create new roles for auditors who can interpret AI findings, investigate anomalies and provide strategic risk advisory.

Sources

Behind the rating

IIA Kenya chapter
ICPAK membership data
CBK internal audit requirements
Kenya corporate governance trends

Getting in

The routes into the role and what each one asks for.

What to study

8 courses

How people get in

BCom Accounting + CPA + CIA
6-8 yearsVery high cost
BCom from UoN, KU, Strathmore or USIU plus CPA (KASNEB) plus CIA (IIA) — the standard path for professional internal audit careers
BCom + Big 4 experience + CIA
6-9 yearsVery high cost
BCom plus 2-3 years at Big 4 audit firm plus CIA certification — transition from external to internal audit

Who hires

Big 4 Audit Firms (KPMG, PwC, Deloitte, EY)
Banks (Equity, KCB, Standard Chartered)
Safaricom
Government (Kenya National Audit Office)
NGOs
Manufacturing Companies

Common misconceptions

Internal auditors are just fault-finders
Modern internal audit is a value-adding function — providing assurance, consulting and risk advisory services. Internal auditors help organisations achieve objectives, improve processes and manage risks. They are business partners, not just critics.
Internal audit is the same as external audit
External audit (Big 4) focuses on financial statement accuracy for shareholders and regulators. Internal audit covers all organisational risks — financial, operational, compliance, IT, strategic. Internal auditors work year-round within the organisation; external auditors come periodically.
AI will replace auditors
AI automates control testing and anomaly detection, but audit judgement, risk assessment, fraud investigation and advisory services require human expertise. AI augments auditors — enabling continuous auditing and real-time monitoring rather than replacing the need for professional judgement.

What happens next

How the role changes from here, and where it leads.

Growth outlook

Net demand change: +15%
Over: 2026-2028
Drivers: Regulatory requirements (CBK, CMA, Data Protection Act),Corporate governance focus,Digital transformation requiring IT audit,Fraud prevention demand,ESG and sustainability audit emerging
Headwinds: AI automating routine audit tasks,Independence challenges in some organisations,Keeping up with regulatory changes,IT audit skills shortage

What to learn

AI-powered audit and continuous control monitoring platforms
Data analytics for audit (ACL, IDEA, Python)
IT audit and cybersecurity (CISA, ISO 27001)
Data Protection Act compliance auditing
ESG and sustainability audit frameworks

Kenyan market notes

Internal audit is a well-established profession in Kenya with strong demand. Key employers: Big 4 audit firms (KPMG, PwC, Deloitte, EY — provide internal audit outsourcing and co-sourcing), banks (all major banks have internal audit departments — CBK requires robust internal audit), telecom (Safaricom — large internal audit function), government (Kenya National Audit Office — KENAO, county governments), NGOs (UN agencies, international NGOs), manufacturing (EABL, Unilever, Bidco). Professional bodies: IIA Kenya (Institute of Internal Auditors Kenya), ICPAK (Institute of Certified Public Accountants of Kenya), ISACA Kenya (for IT auditors — CISA certification). Key certifications: CPA (KASNEB — for accounting foundation), CIA (Certified Internal Auditor — IIA, the gold standard for internal auditors), CISA (Certified Information Systems Auditor — for IT audit), CFE (Certified Fraud Examiner — for fraud audit). Regulatory requirements: CBK requires banks to have internal audit functions reporting to the board, CMA requires listed companies to have internal audit, Mwongozo Code of Governance for state corporations. Key audit areas: financial audits (revenue, expenses, assets, liabilities), operational audits (procurement, HR, IT, production), compliance audits (regulatory, policy), IT audits (security, data integrity, systems), fraud investigations. Growing demand for IT auditors due to digital transformation and cybersecurity threats. Data Protection Act (2019) compliance audits are a new growth area. Key challenges: independence (internal auditors sometimes face pressure from management), keeping up with regulatory changes, IT audit skills shortage, and AI transforming audit methodology. Salary: entry KES 50,000-90,000 (audit associate), mid KES 120,000-260,000 (internal audit manager), senior KES 300,000-650,000+ (head of internal audit or chief audit executive). Big 4 firms pay higher than most in-house roles.