In today's interconnected business landscape, a company's risk exposure extends far beyond its own premises, systems, and personnel. A recent report highlights that even with robust security measures in place, businesses in Kenya can still be vulnerable to risks through cloud platforms, payment partners, telecommunications networks, or software suppliers. This changing risk landscape necessitates a more comprehensive approach to risk management.
The traditional approach to risk management, built around organisational boundaries, is no longer sufficient. As services, data, and money move rapidly across ecosystems, risk can spread quickly, and a single failure can have far-reaching consequences. The impact of such failures can be felt across connected institutions and reach customers before conventional controls can register it. This underscores the need for a more holistic understanding of risk.
The financial services sector, in particular, is highly dependent on technology firms, payment platforms, and telecommunications infrastructure to deliver everyday services. While these relationships enable scale and innovation, they also create concentration and continuity risks that cannot be managed by reviewing contracts alone. To mitigate these risks, leaders need a current map of critical dependencies, clear accountability when services fail, and credible evidence that recovery arrangements will work across organisational boundaries.
The increasing adoption of cloud services, automated decisions, and artificial intelligence (AI) has further complicated the risk landscape. AI, while capable of improving processes, products, and customer experiences, can also magnify weak data, unclear decisions, and poorly governed access. As a result, assurance must evolve alongside adoption to ensure that risks are properly managed. Internal audit plays a critical role in this shift by connecting evidence across functions, entities, and suppliers.
Internal audit can provide valuable insights into emerging threats, help leaders understand how exposures combine, and respond at the speed of the business. To be effective, audit teams require expertise in data, cybersecurity, fraud, and technology, as well as the judgement to turn technical findings into practical decisions. By doing so, audit can challenge assumptions early and give boards and management greater confidence that growth is being pursued responsibly.
The importance of robust risk management is underscored by Kenya's cyber-threat landscape. According to the Communications Authority, more than 842 million cyber-threat events were reported between July and September 2025. The Authority's latest report indicates that ransomware, distributed denial-of-service attacks, and social-engineering scams remain prevalent. These threats can disrupt connected services and suppliers, erode customer trust, and impose real costs on the wider economy.
To navigate this complex risk landscape, business leaders must ask critical questions about their organisations' preparedness. They need to identify critical services that could fail if a key provider became unavailable, assess hidden concentrations in technology, data, and payment chains, and ensure that controls are adapting at the same pace as AI-driven changes. By doing so, leaders can ensure that their organisations are resilient and able to respond effectively to emerging threats.
Key points
- Internal audit must evolve to address the changing risk landscape in Kenya's connected economy.
- Risk management in Kenya's connected economy requires a broader approach beyond organisational boundaries.
- Cyber threats remain a significant challenge for businesses in Kenya, with over 842 million events reported between July and September 2025.
