IT Audit and Regulatory Compliance
What this domain tests
Independent assurance over IT controls and compliance with RBI and statutory requirements. Expect IS audit planning, audit evidence, control testing, regulatory reporting, and the distinction between internal audit, concurrent audit and external audit.
Core rules
- An IS audit charter gives the function authority and independence; the audit committee approves the risk-based plan and receives findings; management owns remediation.
- Scope includes general IT controls (access, change, operations, backup, incident) and application controls (input validation, authorisation, interface reconciliation, output).
- Evidence should be sufficient and reliable: configuration exports, system-generated logs, sample testing, reperformance, CAAT/analytics. Management representations alone are weak evidence.
- Key regulatory themes: KYC/AML, cybersecurity framework compliance, outsourcing and cloud, data localisation, payment system operations, customer grievance redressal and fraud reporting.
- Findings need risk rating, root cause, management action, owner and due date; audit tracks closure and escalates overdue high-risk issues.
Worked example
Auditing privileged access to the CBS: obtain the user list for domain administrators and CBS superusers, compare with approved role matrix, test whether maker-checker exists for user creation, inspect logs for direct database changes, and verify joiner-mover-leaver timeliness. A finding is raised if two superusers share a generic ID: the risk is non-attribution. Evidence is the system export and observation, not the IT manager's email saying access is controlled.
Traps that cost marks
- Auditing only financial reporting controls and ignoring IT general controls.
- Accepting screenshots without checking system date or source.
- Closing findings when a policy is written but not operating.