In modernized business operations powered by Enterprise Resource Planning (ERP) platforms, cloud infrastructure, and fintech integrations, automated system controls underpin the integrity of financial and operational reporting. Governed by the Standard on Assurance Engagements (SAE 3402) issued by the Institute of Chartered Accountants of India (ICAI) and global ISAE 3402 frameworks, our Information Systems Audit practice delivers independent attestation on technology governance, automated business cycle controls, cybersecurity safeguards, and statutory compliance with MCA audit trail regulations and the Digital Personal Data Protection Act, 2023 (DPDP Act).
SOC 1 & SOC 2 (Type I & Type II) Attestation Reports
For SaaS providers, cloud hosts, third-party payment aggregators, and BPO operations, we issue independent SOC 1 reports (evaluating internal controls over financial reporting under SAE 3402) and SOC 2 reports (evaluating Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy). Our engagements include walkthroughs, design adequacy testing, and periodic sampling across 6-to-12-month operating effectiveness windows.
IT General Controls (ITGC) & Automated Business Application Controls
We evaluate IT governance across four fundamental ITGC pillars: User Access Management (privileged access reviews, multi-factor authentication, segregation of duties), Change Management (code reviews, testing signoffs, deployment pipelines), Computer Operations (batch processing, data backup verification, incident management), and System Development. Additionally, we test automated business logic, tolerance limits, and three-way matching within ERP environments.
MCA Audit Trail (Rule 11g) & RBI IT Governance Compliance
Under Section 143(3)(j) of the Companies Act, 2013 read with Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, statutory auditors must report whether the company has operated accounting software featuring a tamper-proof audit trail (edit log) enabled continuously throughout the year with no admin override. We perform technical audit trail verification. For financial entities, we benchmark IT frameworks against the updated RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices.
