Practice area
IT audit.
IT audit built around business risk, not a checklist. Infrastructure, applications, data, and vendor relationships — assessed with the judgment to separate real exposure from noise.
IT controls that pass examination — and stay passable.
Examiners ask 'show me.' We build for that.
IT audit is where most institutions discover their controls are theoretical. The policy says backups are tested quarterly; the evidence shows no completed test on record. The access matrix says terminated users are removed promptly; the report shows accounts still active after separation. We find these gaps before the examiner does.
Our scope covers infrastructure (servers, network, cloud), application controls (core banking, loan origination, payments), identity and access management, change management, vulnerability and patch management, data classification, and third-party / vendor risk. We run testing on a frequency that matches your examination cycle, with workpapers that travel.
The work in this practice, named.
- Infrastructure controls — Server hardening, network segmentation, cloud configuration, encryption at rest and in transit.
- Application controls — Input validation, authorization, segregation of duties, calculation accuracy in core systems.
- Identity & access — Provisioning, deprovisioning, privileged access, periodic access reviews, MFA enforcement.
- Change & release — Change tickets, approval workflow, segregation between development and production.
- Vulnerability & patch — Scan cadence, exception tracking, remediation timelines, exemption governance.
- Third-party / vendor risk — Onboarding diligence, ongoing monitoring, SOC report review, concentration risk.
An IT audit cycle, end to end.
| Phase | Deliverable |
|---|---|
| Scoping | System inventory, control universe, prior-examination findings reviewed. |
| Testing | Walkthroughs, sample selection, evidence requested, exceptions tracked. |
| Findings | Exceptions analyzed, root cause named, severity rated, remediation discussed. |
| Reporting | Report drafted, vetted with IT and management, presented to the committee. |