Meridian Alpha

Internal Controls

Financial operationsAccess & JMLCustomer OnboardingThird-Party RiskAll controls
Meridian Alpha · assurance records
Q3 2026 Unified Program Review · as of 9 Oct 2026
All controls controls
27
13 domains
Open findings
9
5 high severity
Q3 test exceptions
8
0 with observation · 21 tested
Open actions
9
linked to these findings
Validations pending
9
0 failed

Controls tested by audit cycle

Tests →
Q3 2026 Unified Program
Active
78%
tested
21 of 27 controls
13 pass · 0 obs · 8 fail
Q2 2026 Unified Program
Closed
89%
tested
24 of 27 controls
8 pass · 3 obs · 13 fail

Control risk level by current test result

Fail
Pass with observation
Pass
High risk
Medium risk
Low risk
Click a cell to list its controls. Risk level is the control's recorded rating; result is the current-period test.

Open findings by application

SAP S/4HANA5Salesforce (Sales + Financial Services Cloud)3Microsoft Entra ID2PayGate Payment Gateway2Meridian Customer Portal2Amazon Web Services (ap-south-1)1Darwinbox HRMS1

Open findings by control domain

Third-Party Risk3Segregation of Duties2Access Control1Customer Onboarding1Joiner/Mover/Leaver1Procure-to-Pay1

All controls findings

Explore →
ControlObservationDomainSeverityOwnerTargetActionValidation
VEN-02Supplier agreement lacks information security clauses (A.5.20)Third-Party RiskMediumSanjay Kulkarni31 Oct 2026In ProgressPending
SOD-01Unmitigated SoD conflict: payments approval and GL posting held by transferred employeeSegregation of DutiesHighPriya Sharma10 Oct 2026In ProgressPending
ACC-03Standing privileged access in production AWSAccess ControlMediumRahul Nair16 Oct 2026In ProgressPending
P2P-01Purchase order released by requester above delegation thresholdProcure-to-PayHighPriya Sharma20 Oct 2026In ProgressPending
SOD-01Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1)Segregation of DutiesHighPriya Sharma5 Nov 2026In ProgressPending
VEN-01Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)Third-Party RiskMediumSanjay Kulkarni20 Oct 2026OpenPending
VEN-03Payment provider incident — incomplete credential rotationThird-Party RiskHighDeepa Menon10 Oct 2026In ProgressPending
KYC-01Credit line activated before KYC completion (KYC MD §16)Customer OnboardingHighArjun Kapoor22 Oct 2026In ProgressPending
JML-02Mover access not removed timely (deviation in CC6.2 testing)Joiner/Mover/LeaverMediumNeha Iyer31 Oct 2026OpenPending

Q3 test results

All controls remediation timeline

SeptOctNovDecJan
Today
REM-F-ITGC-01 Priya SharmaREM-F-RBI-03 Deepa MenonREM-F-ITGC-02 Rahul NairREM-F-ITGC-03 Priya SharmaREM-F-RBI-02 Sanjay KulkarniREM-F-RBI-04 Arjun KapoorREM-F-ISO-02 Sanjay KulkarniREM-F-SOC2-02 Neha IyerREM-F-RBI-01 Priya Sharma
ClosedIn progressOpenValidation (planned / failed / passed)Bars run from the cycle close when the finding was raised to the action target date.

JML-02 Mover access is recertified on role change

Open control →
Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-02
Mover access is recertified on role change
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-JML-02 · High confidence
Finding
F-SOC2-02 · Medium
Open
Action
Neha Iyer
REM-F-SOC2-02 · Open
Validation
Pending
as recorded