- Home
- Sectors
- Technology, Data and AI
- Algorithm and Vendor Audits
Flagship · Technology, Data and AI
Algorithm and Vendor Audits
Independent audits of automated decision systems and the vendors behind them, testing legality, accuracy, fairness, security and contract terms.
- Sector
- Technology, Data and AI
- Typical timeline
- 6 to 12 weeks per system
- Delivery
- Onsite or virtual
- Deliverables
- 6
The problem
Kenyan institutions increasingly decide through software they did not build: eligibility tools in social programmes, credit and fraud models in finance, triage and claims tools in health, and revenue systems in counties. Section 35 of the Data Protection Act, 2019 restricts decisions based solely on automated processing that significantly affect a person, and regulators expect institutions to understand the systems they deploy. Yet procurement documents rarely give the buyer rights to inspect a model, its training data or its error rates.
The risks are concrete: an unexplained denial, a biased score, a breach at a processor, or payment flows that auditors cannot trace, the concern raised in the Auditor-General's 2025 special audit of eCitizen. The Artificial Intelligence Bill, 2026 would add audits, impact assessments and a public register for high-risk systems. An independent audit gives accounting officers and boards evidence that their systems work as claimed, and lawfully.
Policy anchors
- Data Protection Act, 2019
- Data Protection (General) Regulations, 2021
- Artificial Intelligence Bill, 2026
- Computer Misuse and Cybercrimes Act, 2018
How we work
Scoping
We agree the systems, decisions and questions in scope with the client and, where needed, the vendor, and secure access to documentation, data and staff.
Legal and governance review
We test the system against the Data Protection Act, 2019, sector rules and the institution's own policies, including lawful basis, impact assessments and human review of significant decisions.
Technical testing
We examine accuracy, error rates, stability and outcomes across groups using sample or synthetic data, and review security controls and access logs.
Vendor and contract review
We assess the vendor's controls, data handling, subcontracting and hosting location, and the contract's audit, data return and exit provisions.
Findings and remediation
We report findings by severity with a remediation plan and, where agreed, re-test after fixes.
- Audit plan and scope agreement
- Legal and governance compliance assessment
- Technical test report on accuracy, fairness and security
- Vendor risk assessment and contract gap analysis
- Audit report with severity-rated findings and a remediation plan
- Model contract clauses for future procurement
Accounting officers, audit committees, boards and heads of internal audit in public bodies, counties, banks, insurers and health providers that rely on third-party systems.
Questions clients ask
What if the vendor will not give access to its model?
We can test a system from the outside, through its inputs and outputs, and still produce reliable findings on accuracy and fairness. We also report the access gap itself as a finding and recommend contract terms that close it at renewal.
Is this the same as an ICT audit?
No. An ICT audit focuses on infrastructure and general controls; an algorithm audit asks whether specific automated decisions are lawful, accurate and fair to the people they affect. The two are complementary, and we coordinate with internal and external auditors.