Meridian Alpha

Internal Controls

Financial operations Access & JML Customer Onboarding Third-Party Risk All controls

Meridian Alpha · assurance records
Q3 2026 Unified Program Review · as of 9 Oct 2026

All controls controls

5 high severity

Q3 test exceptions

0 with observation · 21 tested

linked to these findings

Validations pending

Controls tested by audit cycle

Q3 2026 Unified Program

21 of 27 controls

13 pass · 0 obs · 8 fail

Q2 2026 Unified Program

24 of 27 controls

8 pass · 3 obs · 13 fail

Control risk level by current test result

Fail

Pass with observation

Pass

High risk

Medium risk

Low risk

Click a cell to list its controls. Risk level is the control's recorded rating; result is the current-period test.

Open findings by application

SAP S/4HANA5 Salesforce (Sales + Financial Services Cloud)3 Microsoft Entra ID2 PayGate Payment Gateway2 Meridian Customer Portal2 Amazon Web Services (ap-south-1)1 Darwinbox HRMS1

Open findings by control domain

Third-Party Risk3 Segregation of Duties2 Access Control1 Customer Onboarding1 Joiner/Mover/Leaver1 Procure-to-Pay1

All controls findings

Control	Observation	Domain	Severity	Owner	Target	Action	Validation
VEN-02	Supplier agreement lacks information security clauses (A.5.20)	Third-Party Risk	Medium	Sanjay Kulkarni	31 Oct 2026	In Progress	Pending
SOD-01	Unmitigated SoD conflict: payments approval and GL posting held by transferred employee	Segregation of Duties	High	Priya Sharma	10 Oct 2026	In Progress	Pending
ACC-03	Standing privileged access in production AWS	Access Control	Medium	Rahul Nair	16 Oct 2026	In Progress	Pending
P2P-01	Purchase order released by requester above delegation threshold	Procure-to-Pay	High	Priya Sharma	20 Oct 2026	In Progress	Pending
SOD-01	Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1)	Segregation of Duties	High	Priya Sharma	5 Nov 2026	In Progress	Pending
VEN-01	Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)	Third-Party Risk	Medium	Sanjay Kulkarni	20 Oct 2026	Open	Pending
VEN-03	Payment provider incident — incomplete credential rotation	Third-Party Risk	High	Deepa Menon	10 Oct 2026	In Progress	Pending
KYC-01	Credit line activated before KYC completion (KYC MD §16)	Customer Onboarding	High	Arjun Kapoor	22 Oct 2026	In Progress	Pending
JML-02	Mover access not removed timely (deviation in CC6.2 testing)	Joiner/Mover/Leaver	Medium	Neha Iyer	31 Oct 2026	Open	Pending

Q3 test results

Pass with observation

All controls remediation timeline

SeptOctNovDecJan

Today

REM-F-ITGC-01 Priya Sharma REM-F-RBI-03 Deepa Menon REM-F-ITGC-02 Rahul Nair REM-F-ITGC-03 Priya Sharma REM-F-RBI-02 Sanjay Kulkarni REM-F-RBI-04 Arjun Kapoor REM-F-ISO-02 Sanjay Kulkarni REM-F-SOC2-02 Neha Iyer REM-F-RBI-01 Priya Sharma

ClosedIn progressOpenValidation (planned / failed / passed)Bars run from the cycle close when the finding was raised to the action target date.

VEN-03 Supplier security incidents are assessed for impact and tracked

Open control →

ISO-A.5.19 · ISO-A.5.24 · RBI-CSF-NBFC-Annex-1-2 · RBI-OITS-2023-9 · SOC2-CC7.3 · SOC2-CC9.2

Vendor & IT Outsourcing Risk Policy

Supplier security incidents are assessed for impact and tracked

PayGate Payment Gateway · Meridian Customer Portal

2 approved · 1 pending · 1 rejected

TST-RBI-VEN-03 · High confidence

F-RBI-03 · High

REM-F-RBI-03 · In Progress