Tariq Mahmood Sahab - Senior IT Audit Executive and CISO
# Legacy of ## TARIQ MAHMOOD SAHAB

MBA, CISA, CISM, CGEIT, CRISC, CRMA, MBCI

**November 9, 1960 – 2022**

Senior IT Audit Executive • Chief Information Security Officer • IT Governance Pioneer

Teacher • Mentor • Father

"

رَّبِّ ارْحَمْهُمَا كَمَا رَبَّيَانِي صَغِيرًا

"My Lord, have mercy upon them as they brought me up when I was small."

— Surah Al-Isra (17:24)

## Who Was Tariq Mahmood Sahab? To the IT Audit world, he was a pioneer—one of Pakistan's first CISA-certified professionals, a Senior Manager at KPMG and Deloitte, a Lead IT Auditor at Kuwait Petroleum Corporation, and the CISO who secured Pakistan's largest depository. To his students at IBA Karachi, he was "Sir"—the professor who taught for 16 years and was consistently rated among the best faculty.
To the hundreds of professionals he trained, he was a mentor who gave generously of his knowledge. To me, he was Abbu jee. My father. The man who woke before Fajr, who never compromised on excellence, who believed that knowledge shared is knowledge multiplied.

40 Years of Service

1982
2022
Philips3yr
BCCI-FAST2yr
Systems Ltd5yr
KPMG6yr
Deloitte6yr
CDC2yr
KPC12yr
AlNafi1yr
📚 IBA Karachi (16 years, parallel)
## By the Numbers
40
Years of Professional Service
150+
Organizations Served
18
Years at Big Four Firms
1,200+
Hours of Training Delivered
16
Years Teaching at IBA

Career Journey

The Final Chapter: Giving Back

AlNafi.com — CEO & Founder

2021 – 2022

In his final year, he founded an online education platform to make professional IT certifications accessible. He taught CISA, CISM, CGEIT, and CRISC courses—ensuring his knowledge would outlive him.

The Crown Jewel

Kuwait Petroleum Corporation — Lead IT Auditor

2008 – 2020 (12 Years)

At a $75+ billion oil conglomerate with 25,000 employees across 10 subsidiaries:

  • Led comprehensive IT audit programs conducting 30+ audits annually
  • Directed audit teams covering governance, security, and business continuity
  • Presented findings directly to the Audit Committee and senior leadership
  • Applied COBIT, ISO 38500, ISO 27001, ISO 22301, and ITIL frameworks

The Security Leader

Central Depository Company of Pakistan — CISO

2006 – 2008

As Chief Information Security Officer of Pakistan's largest depository (handling all stock exchange transactions):

  • Achieved ISO 27001 certification
  • Built the Security Incident Management System from scratch
  • Implemented enterprise-wide Business Continuity Management
  • Reported directly to SECP regulators and the Audit Committee

The Big Four Years

Deloitte & KPMG Peat Marwick

12 Years Total

Across Pakistan, Dubai, Oman, and Abu Dhabi:

  • Delivered IT audit and consultancy to 50+ major clients
  • Conducted IT due diligence for billion-rupee banking mergers
  • Led ERP implementations (Oracle Financials, JD Edwards)
  • Developed IT strategies for national institutions

The Foundation Years

Systems Ltd, BCCI-FAST, Philips

1982 – 1992

Where it all began—software development, system design, and the foundations of a four-decade career.

  • Systems Pvt. Ltd. — Project Manager (5 years)
  • BCCI-FAST — Systems Analyst (2 years)
  • Philips Pakistan — Accounts Officer (3 years)
## The Teacher
### Institute of Business Administration (IBA), University of Karachi **Visiting Faculty** | 1992 – 2008 (16 Years) One of the oldest business schools outside North America (est. 1955). For sixteen years, he taught MBA students IT-related courses, consistently rated among the **best faculty members**.
### Training Programs Delivered | Client | Program | Impact | |--------|---------|--------| | State Bank of Pakistan | IT Audit Training | 100 auditors over 6 months | | Muslim Commercial Bank | Application Audit | 40 internal auditors over 4 months | | Sui Northern Gas | Internal Audit Restructuring | Department transformation | | Various | CISA Exam Preparation | 20+ candidates certified | **Total: 1,200+ hours of professional training delivered**

Certifications & Credentials

CISA ISACA 2004
CISM ISACA 2008
CGEIT ISACA 2008
CRISC ISACA 2010
CRMA IIA —
MBCI BCI —
ISO 27001 IRCA 95% ✓
## Education **MBA – Finance and Marketing** Institute of Business Administration (IBA), University of Karachi | 1987 – 1992 **Post Graduate Diploma – Systems Analysis and Design** Institute of Business Administration (IBA), University of Karachi | 1984 – 1985 **Islamic Sciences (8 Years of Dedicated Study)** Markaz Abdullah Al Mutawaa, Dar Ul Quran — Kuwait, Rumaithiyah A devoted student of Islamic knowledge who exemplified dedication and excellence. He was always the first person to enter the class and the last one to leave—an avid seeker of knowledge, hardworking and intelligent. **Subjects Studied:** - Fiqah (Islamic Jurisprudence) - Tafseer (Quranic Exegesis) - Hadith (Prophetic Traditions) - Seerah (Biography of the Prophet ﷺ) - Tajweed (Quranic Recitation Rules) - Tilawah (Quranic Recitation) - Hifz (Quran Memorization) - Aqeedah (Islamic Creed) - And more...
## Professional Affiliations - **ISACA Karachi Chapter** – Board of Directors, CISM Coordinator - **Institute of Chartered Accountants of Pakistan (ICAP)** – IT Subcommittee Member - **Business Continuity Institute (BCI)** – Member

Organizations He Served

🏦 Financial Institutions - State Bank of Pakistan - National Bank of Pakistan - United Bank Limited (800 branches) - Muslim Commercial Bank (1,200 branches) - Allied Bank of Pakistan (700 branches) - Saudi Pak Commercial Bank (200 branches) - Bank Al Habib (200 branches) - Hong Kong Shanghai Bank - ANZ Grindlays Bank (500 branches) - Soneri Bank (70 branches) - Credit Agricole - NIB Bank (NDLC-IFIC) - Bank Al Omani Al Fransi - Pak Oman Investment Company
⛽ Petroleum & Energy - Kuwait Petroleum Corporation (10 subsidiaries) - Oil and Gas Development Corporation (OGDC) - Pakistan Petroleum Limited - National Refinery of Pakistan - HUBCO Power Generation - AES Lalpir Power Generation - Sui Northern Gas Pakistan Limited - Petrochem Middle East
🏢 Multinational Corporations - Philips Pakistan - Proctor & Gamble - Siemens Pakistan - IBM - Gillette Pakistan - Cadbury Pakistan - SGS Pakistan - BASF - Agfa Geavert - Alstom Pakistan - JP Coats Pakistan
🏛️ Government & Public Sector - Pakistan Customs - Karachi Port Trust - National Investment Trust (NIT) - Employees Old Age Benefits Institution (EOBI) - General Civil Aviation Authority of UAE - Pakistan International Airlines Corporation
📚 Other Notable Organizations - Central Depository Company of Pakistan - Oxford University Press - Shifa International Hospital - Lucky Cement - Tata Group of Companies - Institute of Business Administration (IBA) - Diners Club Pakistan
## Frameworks & Methodologies He Mastered
🏛️

Governance

COBIT 4.1/5, ISO 38500, VAL IT

🔒

Security

ISO 27001/27002, ISO 27017, ISO 27018

🔄

Business Continuity

ISO 22301, BS 25999, BCI Good Practice Guidelines

⚠️

Risk Management

RISK IT, CRISC Framework

⚙️

Service Management

ITIL, ISO 20000

🔧

Audit Tools

ACL, TeamMate, NASSES, RATINA, Secure Audit, Deloitte AS/2

Documents

📄

Full Resume

Complete professional resume

 📜

Certificates

Professional certifications

 🖼️

Photos

Professional and personal photographs

 💬

Tributes

Memories from those who knew him
## For Those Who Knew Him If you worked with Tariq Mahmood Sahab, were trained by him, studied under him at IBA, or knew him in any capacity—I would be honored to hear from you. - 💬 [Share a memory](https://github.com/matx104/legacy-of-tariq-mahmood-sahab/issues/new?template=tribute.md&title=Tribute+from+[Your+Name]) by opening an issue - 🔗 Connect with me on [LinkedIn](https://linkedin.com/in/matx104) - 📧 Email: muhammad.atx@gmail.com Your words will be added to the [Tributes](tributes/) section with your permission.
## A Son's Reflection My father built his career before GitHub existed, before cloud computing, before the frameworks we now take for granted. He wrote COBOL on IBM mainframes. He implemented JD Edwards when ERP was a new concept. He was among Pakistan's first CISA-certified professionals. But his principles are timeless: - **Excellence is not negotiable** - **Document everything** - **Knowledge shared is knowledge multiplied** - **Your reputation is built one audit at a time** I now work as a Multi-Cloud DevOps Engineer—a field he never worked in, using tools he never touched. But every pipeline I build, every system I secure, every junior engineer I mentor—I do it standing on the foundation he laid. Abbu jee, you left me something far greater than material wealth: your name, your principles, your example, and your duas. Every success I achieve, every principle I uphold, every person I help—it all traces back to you. You taught me that true inheritance isn't counted in currency, but in character, knowledge, and faith. This repository is my promise that your legacy will live on in the digital world you helped shape.
## اِنَّا لِلّٰهِ وَاِنَّآ اِلَيْهِ رَاجِعُوْنَ *Indeed, to Allah we belong and to Him we shall return.* --- **أَنْتَ وَمَالُكَ لِأَبِيكَ** *"You and your wealth belong to your father."* — Hadith, Sunan Ibn Majah --- **رَّبِّ ارْحَمْهُمَا كَمَا رَبَّيَانِي صَغِيرًا** *"My Lord, have mercy upon them as they brought me up when I was small."* — Surah Al-Isra (17:24) --- ### Made with Love and Prayers by **Muhammad Abdullah Tariq** *Eldest Son* --- *May Allah grant him Jannatul Firdaus and elevate his ranks. Ameen.*