Skip to content
CyberAudit CyberAudit
 Request a proposal

Pakistan — Corporate

SECP-Regulated Entities: IT Governance and Assurance

Listed companies, insurers, NBFCs and other entities under Securities and Exchange Commission of Pakistan oversight face growing expectations around technology governance, control over financial reporting systems, and data protection.

Where technology assurance intersects with SECP obligations

The most direct link is control over financial reporting. Where financial statements depend on system-generated data, the reliability of that data depends on the general IT controls beneath it. External auditors test this, and deficiencies surface in management letters and, where material, in reporting to those charged with governance.

Beyond financial reporting, boards of listed entities carry a broad duty of oversight that increasingly includes technology and cyber risk. Audit committees are asking for assurance they can rely on, and the IT function auditing itself does not provide it.

  • IT general controls supporting financial reporting systems and the ERP.
  • Application controls within the financial close and revenue processes.
  • Board and audit committee oversight of technology risk, with evidenced reporting.
  • Technology and cyber risk within the enterprise risk management framework.
  • Data protection and privacy obligations for personal data held.
  • Third-party and outsourcing arrangements covering critical systems.
  • Business continuity for operations the market depends on.

The practical trigger

Most engagements here start in one of three ways: the external auditor has raised an ITGC deficiency in the management letter; the audit committee has asked a question about cyber risk that management could not answer with evidence; or a new ERP has gone live and nobody has independently validated the control configuration.

Controls over financial reporting systems

Access to programs & data Provisioning, recertification,privileged access, segregation ofduties Program change management Request, approval, testing,segregated migration to production Program development Project governance, data migration,authorised go-live Computer operations Scheduling, incidents, backup andrestore, environment
Where financial statements depend on system-generated data, ITGC is what makes it reliable.

What we do not claim

We are not lawyers and this is not legal advice on your regulatory obligations. Where a specific SECP regulation, circular or code provision applies to your entity type, confirm the requirement with your legal advisers. What we provide is the technology control assurance that supports whatever position you and your advisers determine you need to take.

How the engagement runs

  1. 1

    Obligation review

    Establish, with your advisers, which technology-related obligations actually bind your entity type.

  2. 2

    Scope agreement

    Agree systems in scope by financial and regulatory relevance with the audit committee.

  3. 3

    Control assessment

    Test general and application controls over the in-scope systems.

  4. 4

    Governance review

    Assess board and committee oversight, reporting and risk escalation.

  5. 5

    Gap analysis

    Report the position with evidence and a defined closure condition per gap.

  6. 6

    Committee reporting

    Present to the audit committee in language it can act on.

What you receive

IT general controls assessment over financial reporting systems
Application control review across material financial processes
Technology governance and board oversight assessment
Findings register with significance ratings and management responses
Remediation roadmap sequenced against the reporting calendar
Audit committee presentation

Frequently asked questions

The external auditor tests ITGC only to the extent needed to support their financial statement opinion, at the point in the year that suits their timetable, and they report deficiencies rather than helping you close them. An independent review scoped for management gives you broader coverage, earlier warning, and a remediation plan — which is usually what stops the same deficiency reappearing next year.

Yes — co-sourcing is the most common arrangement. Your Chief Audit Executive owns the plan and the opinion; we supply the IT audit specialists for the technology portion of it.

Related services

IT General Controls (ITGC) Information Systems Audit IT Governance & COBIT

Not sure this is the framework that binds you?

Six questions, ninety seconds, runs in your browser. It will tell you which frameworks apply and why.

Request a proposal
Top