RBI requires regulated entities to have their information systems, IT governance and cyber security controls independently audited on a risk-based schedule.
We perform IS audits covering IT governance, risk management, information security, IT operations, business continuity and outsourcing — and report observations in a format your board and RBI inspectors expect.
Objectives
- Assess IT governance and oversight by the board and IT strategy committee
- Evaluate information security and cyber security controls
- Review IT operations, change management, BCP and DR
- Assess outsourcing and third-party IT risk
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review