Meridian Alpha

Internal Controls

Financial operationsAccess & JMLCustomer OnboardingThird-Party RiskAll controls
Meridian Alpha · assurance records
Q3 2026 Unified Program Review · as of 9 Oct 2026
Third-Party Risk controls
3
Third-Party Risk
Open findings
3
1 high severity
Q3 test exceptions
2
0 with observation · 2 tested
Open actions
3
linked to these findings
Validations pending
3
0 failed

Controls tested by audit cycle

Tests →
Q3 2026 Unified Program
Active
78%
tested
21 of 27 controls
13 pass · 0 obs · 8 fail
Q2 2026 Unified Program
Closed
89%
tested
24 of 27 controls
8 pass · 3 obs · 13 fail

Control risk level by current test result

Fail
Pass with observation
Pass
High risk
Medium risk
Low risk
Click a cell to list its controls. Risk level is the control's recorded rating; result is the current-period test.

Open findings by application

PayGate Payment Gateway2Salesforce (Sales + Financial Services Cloud)2Meridian Customer Portal1

Open findings by control domain

Third-Party Risk3

Third-Party Risk findings

Explore →
ControlObservationDomainSeverityOwnerTargetActionValidation
VEN-02Supplier agreement lacks information security clauses (A.5.20)Third-Party RiskMediumSanjay Kulkarni31 Oct 2026In ProgressPending
VEN-01Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)Third-Party RiskMediumSanjay Kulkarni20 Oct 2026OpenPending
VEN-03Payment provider incident — incomplete credential rotationThird-Party RiskHighDeepa Menon10 Oct 2026In ProgressPending

Q3 test results

Third-Party Risk remediation timeline

SeptOctNovDecJan
Today
REM-F-RBI-03 Deepa MenonREM-F-RBI-02 Sanjay KulkarniREM-F-ISO-02 Sanjay Kulkarni
ClosedIn progressOpenValidation (planned / failed / passed)Bars run from the cycle close when the finding was raised to the action target date.

VEN-01 Critical third parties are risk-assessed before onboarding and annually

Open control →
Requirement
ISO-A.5.19 · ISO-A.5.22 · RBI-OITS-2023-6 · RBI-OITS-2023-9 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-01
Critical third parties are risk-assessed before onboarding and annually
Application
PayGate Payment Gateway · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-VEN-01 · Medium confidence
Finding
F-RBI-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-RBI-02 · Open
Validation
Pending
as recorded