Banking, Islamic Banking and Development Finance

What we do for banks

• Independent gap assessment and internal audit against the SBP technology governance framework.
• IT general controls audit over core banking, the surrounding infrastructure and the directory service.
• Application control and segregation of duties review within the core banking platform.
• Digital channel assurance — internet banking, mobile, and the APIs behind them.
• Penetration testing of internet-facing and internal infrastructure.
• SWIFT CSP independent assessment supporting the annual attestation.
• Business continuity and disaster recovery audit, including live invocation observation.
• Third-party and outsourcing assurance, including cloud service arrangements.
• Co-sourced IT internal audit for institutions without in-house technology audit capability.

The recurring issues in this sector

Across banking engagements the same weaknesses recur, and they are rarely exotic. Privileged access to core banking that was granted for a migration and never revoked. Emergency access procedures that are used routinely rather than exceptionally. User access recertification performed as a formality, with managers approving lists they have not read. Change management that works well for planned releases and collapses for emergency fixes. And recovery objectives in the continuity plan that the backup regime has never been capable of meeting.

Working alongside your external auditor

Where the objective is to support external audit reliance, we recommend introducing us at planning so scope, sampling basis and documentation standards are agreed in advance. Reliance is always the external auditor's decision, but it is far more likely when the approach was agreed before fieldwork rather than justified afterwards.