Account aggregators handle consent-based sharing of financial data and are expected to maintain strong technology, data protection and consent management controls.
We audit consent flows, API security, encryption and data handling, along with your IT governance and operations.
Objectives
- Assess consent management and data-sharing controls
- Test AA APIs and integration security
- Review encryption, key management and data minimisation
- Evaluate IT governance and operations
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review