Technology risk · assurance · governance
We test the controls behind your core systems and tell you, plainly, where they hold and where they don’t. Independent assurance for banks, telcos and development organisations across eleven African markets.
11
African markets
6
professional certifications held
4
client sectors served
2016
practising since
The practice
Rosewood is an independent technology risk and assurance firm in Nairobi. We test whether the controls inside your core systems are designed properly and operating the way you believe they are — then we write down what we found, rank it by consequence, and retest until it is closed.
Five practices cover the ground: control reviews, information security assurance including CEH-led penetration testing, technology governance, business continuity, and assurance over technology programmes while they are still in flight.
In the field
01/06
00 · Nairobi
Engagements are delivered from Nairobi and on site. That keeps the day rate closer to a local one than a fly-in one, and it means the team has already met the regulator you are answering to.
SVC-01 · System reviews
Every control in scope is named, owned, tested and scored. Where one fails, the exceptions register says what it exposes and what it costs to leave open — so the remediation argument is already made for you.
SVC-02 · Security
Findings arrive with reproduction steps, not just a score. Anything critical reaches you the day we confirm it, and we retest and confirm closure in writing for your evidence file.
SVC-03 · Governance
Decision rights, escalation paths and a risk register short enough that the board reads all of it. The same figures each quarter, meaning the same thing each quarter.
SVC-04 · Continuity
The business impact analysis says what breaks first, what it costs per hour and in what order it comes back. Then we test it, and the test results go in the file next to the plan.
SVC-05 · Programmes
We sit alongside the programme, not after it. Each gate produces a one-page risk position and the decisions it demands — a defensible yes or no on go-live, with the conditions attached.
The firm
Founded by technology professionals who had spent their careers on the other side of the audit.
Rosewood was founded by technology professionals with risk and technology management experience across eleven African markets — Kenya, Uganda, Tanzania, Zimbabwe, Mauritius, Rwanda, Egypt, Zambia, Ghana, South Africa and Mozambique.
The team holds local and international qualifications across the spectrum of technology and its risk: qualified information risk managers, IT system auditors (CISA), information security specialists (CEH), and system management practitioners (CISM, ITIL). Qualified accountants — CPA and ACCA — sit inside the team rather than beside it, which is why our findings survive contact with finance and audit.
That mix gives us an in-depth understanding of the strategic, operational and technology management issues facing leading financial service providers, telcos, international development agencies and NGOs.
We consider the team’s experience vital in contextualising the working realities and operating challenges that face organisations. A control that cannot be operated on a Tuesday afternoon in a branch is not a control.
Individual professional qualifications held by members of the team. Rosewood does not claim firm-level accreditation it has not been granted.
Practices
Five parallel practices. Most engagements draw on two or three of them.
Independent testing of the controls inside the systems you already run.
Read SVC-01Security programmes, control reviews and CEH-led penetration testing.
Read SVC-02Board-level accountability for technology risk, and the framework that carries it.
Read SVC-03Recovery strategies that have been tested, not just written.
Read SVC-04Assurance over the technology programme while it can still change course.
Read SVC-05Describe the problem in your own words. We will tell you which practice fits, or tell you that none of them does.
Footprint
Regulators, market practice and vendor behaviour differ by country. So does the risk.
Eleven markets, one team. Work is delivered from Nairobi and on site, which keeps engagement costs closer to a local rate than a fly-in one.
Standards
Named, because buyers search by standard rather than by service.
Briefings
Written for the person who has to act on it.
Kenya’s Data Protection Act has been in force since 2019. What the regulator wants to see is narrower, and more boring, than most compliance programmes assume.
6 min readAn untested recovery plan is a document, not a capability. The gap between the two is discovered at the worst possible moment, and it is measurable in advance.
6 min readA first penetration test report tends to arrive with a red bar chart and a lot of findings. Here is how to work out which ones actually matter this week.
7 min readNext step
Send a short brief and we will come back within two working days with the scope we would propose, what it would cost, and how long it would take. No pitch deck.
+254 721 687846 taarifa@techrisk.co.ke