Services · IS / IT Audit

Findings and evidence a regulator will accept.

Information-systems audits, IT general controls (ITGC) reviews, SOC 2 readiness and control testing.

What this covers

System review: The application, database and operating layers in scope, tested against the controls they are relied on to provide.
Process evaluation: How a control is designed to run, how it runs on an ordinary week, and where those two diverge.
Performance analysis: Whether a control operates on time and every time, or only when somebody remembers to run it.
Compliance checks: Mapped to RBI ITGRCA, SEBI CSCRF and IRDAI expectations, with the clause recorded against each test.
Data integrity: Completeness and accuracy of the population established before a sample is drawn from it, not after.
Risk assessment: Scoping driven by risk, so that testing effort lands where a control failure would actually matter.

How the work runs

IS / IT Audit, end to end.

An audit that a regulator will accept is one where every number can be re-derived from the evidence behind it. This is how we get there.

Scope by risk
Which systems, which controls, which period, and why. Testing effort lands where a control failure would actually matter — not evenly across everything you happen to own.
OutputScope and risk assessment
Walk the process
How a control is designed to run, how it runs on an ordinary week, and where those two diverge. Walkthroughs with the people who operate it, not a reading of the policy.
OutputProcess narratives and control matrix
Test the controls
Completeness and accuracy of the population established before a sample is drawn from it. Then the sample is tested, and each exception is chased to its cause.
OutputTest results with exceptions
Build the workpapers
Every conclusion referenced to the evidence that supports it, pulled from the system of record. A workpaper cites a source, not a screenshot somebody took on a Tuesday.
OutputReferenced workpaper file
Findings and close
A findings register with an owner, a date and a management response against each item — then tracking through to close, so the report is the start of the remediation rather than the end of the engagement.
OutputFindings register, tracked to close