Empowering Global Enterprises with Expert Advisory

Security & Risk Assessment

End-to-end cybersecurity and IT risk evaluation covering:

• Policy and configuration reviews
• Vulnerability assessment and penetration testing
• Risk identification, classification, and mitigation planning
• Cloud and infrastructure security posture assessment

Loan Staff (IT Audit Support)

Provision of audit-ready resources to augment client teams:

• Managers, Leads, and Analysts with ITGC/ITAC expertise
• Pre-trained professionals aligned with client methodologies
• Flexible deployment models to support peak audit cycles
• Experience across ERP systems (SAP, Oracle, Dynamics, Salesforce)

ITGC Testing (IT General Controls)

Execution and documentation of ITGC testing procedures, including:

• Access management
• Change management
• IT operations
• Backup, recovery, and incident management
• Logging and monitoring controls

All testing is performed using predefined templates with clear linkage to control IDs, evidence, and conclusions.

Access Control

Assessment and testing of user access management processes:

• User provisioning and de-provisioning
• Role-based access control (RBAC)
• Privileged access management (PAM)
• Periodic access reviews
• Segregation of Duties (SoD) validation

Change Management

Evaluation of change lifecycle controls:

• Change request authorization and approval
• Development, testing, and migration processes
• Segregation between development and production
• Post-implementation validation

IT Governance Assessment

Evaluation of IT governance structures based on frameworks such as COBIT, focusing on:

• IT strategy alignment with business objectives
• Policy and SOP review
• Risk management and oversight mechanisms
• Roles, responsibilities, and accountability structures
• Governance maturity benchmarking

IT Internal Control Audit

Comprehensive review of IT General Controls (ITGC) and IT Application Controls (ITAC), including:

• Design and operating effectiveness testing
• Risk and control matrix (RCM) validation
• Identification of control deficiencies and remediation recommendations
• Alignment with financial reporting controls and ICFR requirements

IT Compliance Audit

Assessment of compliance with regulatory and industry standards such as:

• SOX, ISO 27001, GDPR, DPDP
• Internal IT policies and procedures
• Security and data protection requirements
• Third-party and SOC report evaluations

Computer Operation

Review of operational controls ensuring system reliability:

• Job scheduling and monitoring
• Incident and problem management
• Backup and recovery procedures
• System performance and availability controls

SDLC Control

Assessment of system and testing lifecycle processes:

• SDLC policy adherence
• Test planning, execution, and documentation
• UAT approvals and sign-offs
• Traceability between requirements and test cases

Interface Control

Validation of automated interfaces between source and destination systems:

• Data transfer accuracy and completeness
• Interface reconciliation controls
• Error handling and monitoring mechanisms
• Evaluation of batch jobs / API's / Cron Jobs etc.

Configuration Control

Review of system configuration settings:

• Parameter configuration aligned with business requirements
• Change tracking and approval of configurations
• System hardening and baseline standards

Information Processing Testing

Comprehensive information processing testing covering:

• Input, processing, and output validation
• Automated and manual control checks
• Data integrity and completeness assurance
• Data integrity risk / data extraction risk / data manipulation risk

Segregation Control

Evaluation of segregation of duties across business processes:

• Identification of conflicting roles
• Maker-checker control implementation and validation
• SoD matrix validation
• Mitigation controls for identified conflicts