Utku Fidan — Internal audit that reads all the data, not just the sample.

• 01

  Continuous Auditing and Monitoring

  Scenarios that test controls on the full data and keep running between audits, not only during them.

• 02

  Anomaly Detection and AI

  Machine-learning models, automated control analytics and locally run LLMs that flag irregularities and control weaknesses early.

• 03

  IT Audit and Security Analytics

  Access management, privileged accounts and segregation of duties, plus analytics on security data (SIEM, DLP, firewall, Active Directory) that the audit team can act on.

• 04

  Banking Audit and Model Risk

  Audits of credit-risk models (scorecard, collection, IFRS) and of loans, provisions, collateral management and ESG compliance.

• Generative AI · Audit Methodology

  An AI audit tool that maps the audit end to end

  I created a tool that lays out the audit path from planning and risk assessment through testing to findings, with a findings-tracking dashboard. Source-grounded language models draft the work, every output is cited to its evidence, and an auditor approves or rejects it.

  • LLMs
  • Retrieval-Augmented Generation
  • Dashboards
  • AI Governance

• Generative AI · Data Protection

  Running language models locally on audit data

  I run language models on-premise and on local machines, so sensitive audit data never leaves the organisation's environment.

  • Local LLMs
  • On-Premise Deployment
  • Retrieval-Augmented Generation
  • Python

• Fraud Analytics · Machine Learning

  A fraud-detection model that tells auditors why a case was flagged

  A supervised model trained on past confirmed cases scores transactions by fraud risk, using behavioural features and class-imbalance handling. A per-case explanation lets auditors review and challenge each flag.

  • Gradient Boosting
  • Feature Engineering
  • Class Imbalance
  • SHAP Explanations
  • Python

• Revenue Assurance · Anomaly Detection

  Scoring metered-versus-billed gaps so auditors start with the riskiest cases

  Reconciling metered with billed consumption and giving each metering point an anomaly score.

  • Z-Score / IQR
  • Isolation Forest
  • Local Outlier Factor
  • One-Class SVM
  • Time-Series Anomaly Detection

• IT Audit · Security Analytics

  Ranking security alerts from database-activity logs

  Unsupervised anomaly detection on raw database-activity logs groups false positives and ranks alerts by user and access-path risk.

  • Isolation Forest
  • Local Outlier Factor
  • Clustering
  • Frequency Features

• Continuous Monitoring · Time Series

  Detecting abnormal fuel drops in fleet telematics

  Flagging abnormal fuel-level drops and sensor spikes in vehicle telematics (fuel level, speed, ignition, location) against per-vehicle baselines and peer groups.

  • Feature Engineering
  • Time-Series Analysis
  • Peer Comparison

• IT Audit · Access Management

  Finding segregation-of-duties conflicts across systems

  Mapping users, roles and permissions across applications against a conflict matrix, so that toxic combinations show up as a full list to remediate rather than a sample to test.

  • SQL
  • Rule-Based Testing
  • Role Analysis

• IT Audit · Identity Data

  Checking that leavers and movers lose their access

  Joining HR records with directory and application accounts to flag active accounts of leavers, dormant privileged accounts and access that no longer matches the job.

  • SQL
  • Python
  • Fuzzy Matching
  • Active Directory Data

• IT Audit · SIEM

  Measuring whether security logs are complete

  Comparing the inventory of critical systems with the log sources a SIEM actually receives, and tracking volume drops and gaps that would leave monitoring blind.

  • Coverage Metrics
  • Time-Series Monitoring
  • Python

• Security Analytics · Data Leakage

  Spotting unusual data movement in DLP events

  Building per-user baselines on DLP, firewall and directory events to flag unusual volumes, destinations or timing, and cutting the noise before alerts reach reviewers.

  • User Baselines
  • Isolation Forest
  • Python

• Continuous Auditing · Procure-to-Pay

  Testing every payment for duplicates and splits

  Full-population tests on vendor payments for duplicate invoices, purchases split to stay under approval limits and vendor bank-detail changes made shortly before payment.

  • SQL
  • Fuzzy Matching
  • Benford’s Law
  • Rule-Based Tests

• Model Risk · Banking

  Auditing credit-risk models beyond the documentation

  Re-running checks on scorecard and provisioning models (population stability, discriminatory power, calibration and overrides) so the audit opinion rests on the data, not only on the model documentation.

  • PSI
  • Gini / AUC
  • Calibration Tests
  • SAS
  • Python

• Audit Analytics · NLP

  Reading past audit findings with NLP

  Clustering the text of past findings and action plans to surface recurring root causes and repeat issues across units, as input to risk assessment and audit planning.

  • Topic Modelling
  • Embeddings
  • Python

1. Jul 2025 – Present

   Internal Audit Data Analytics Process Leader

   Enerjisa Enerji A.Ş. · Istanbul

   • Lead internal audit data analytics, integrating machine learning and advanced analytics into audit, risk and control frameworks.
   • Develop continuous auditing and monitoring scenarios, anomaly-detection models and automated control analytics that surface emerging risks and control weaknesses.
   • Perform IT audit on access management, privileged accounts and segregation of duties, and security analytics on SIEM, DLP, firewall and Active Directory data.
   • Automate recurring audit tests and build reusable analytics libraries, on end-to-end SQL, Python and SAS pipelines.

2. Apr 2022 – Jul 2025

   Internal Auditor

   Garanti BBVA · Istanbul

   • Audited credit-risk models (scorecard, collection and IFRS) under regulatory and non-regulatory frameworks.
   • Audited loans, provisions and collateral management, ESG, personal data protection (PDPL), subsidiaries, and compliance with Turkish and European Central Bank requirements.
   • Promoted from Assistant Internal Auditor in August 2023; worked as the team’s data scientist and Agile Ambassador.

3. Jun 2021 – Apr 2022

   Internal Auditor

   Şekerbank T.A.Ş. · Istanbul

   • Built SQL, Python and SAS-based audit pipelines for credit-risk and branch audits.
   • Identified risk factors and control weaknesses, recommended corrective actions and reported findings to management.

Earlier Roles

1. Sep 2020 – Jun 2021

   SME Specialist

   Albaraka Türk Katılım Bankası A.Ş. · Istanbul

   Managed payroll-account portfolios and client relationships for small and medium-sized businesses.

2. Jan 2020 – Sep 2020

   Content Moderator

   Conectys Türkiye A.Ş. · Remote

   Reviewed user-generated content against platform policies and helped test new moderation tools.

3. Jul 2019 – Jan 2020

   Assistant Specialist

   Turkon Holding A.Ş. · Istanbul

   Supported corporate communications, marketing content and project coordination.

• 26 October 2023LinkedIn

  Agile Working and Productivity: An Auditor’s Perspective

  Read on LinkedIn: Agile Working and Productivity: An Auditor’s Perspective

• 24 October 2023LinkedIn

  Unlocking the Power of Data: Transforming Audit Culture in Banking

  Read on LinkedIn: Unlocking the Power of Data: Transforming Audit Culture in Banking