Meridian Alpha

Internal Controls

Financial operationsAccess & JMLCustomer OnboardingThird-Party RiskAll controls
Meridian Alpha · assurance records
Q3 2026 Unified Program Review · as of 9 Oct 2026
All controls controls
27
13 domains
Open findings
9
5 high severity
Q3 test exceptions
8
0 with observation · 21 tested
Open actions
9
linked to these findings
Validations pending
9
0 failed

Controls tested by audit cycle

Tests →
Q3 2026 Unified Program
Active
78%
tested
21 of 27 controls
13 pass · 0 obs · 8 fail
Q2 2026 Unified Program
Closed
89%
tested
24 of 27 controls
8 pass · 3 obs · 13 fail

Control risk level by current test result

Fail
Pass with observation
Pass
High risk
Medium risk
Low risk
Click a cell to list its controls. Risk level is the control's recorded rating; result is the current-period test.

Open findings by application

SAP S/4HANA5Salesforce (Sales + Financial Services Cloud)3Microsoft Entra ID2PayGate Payment Gateway2Meridian Customer Portal2Amazon Web Services (ap-south-1)1Darwinbox HRMS1

Open findings by control domain

Third-Party Risk3Segregation of Duties2Access Control1Customer Onboarding1Joiner/Mover/Leaver1Procure-to-Pay1

All controls findings

Explore →
ControlObservationDomainSeverityOwnerTargetActionValidation
VEN-02Supplier agreement lacks information security clauses (A.5.20)Third-Party RiskMediumSanjay Kulkarni31 Oct 2026In ProgressPending
SOD-01Unmitigated SoD conflict: payments approval and GL posting held by transferred employeeSegregation of DutiesHighPriya Sharma10 Oct 2026In ProgressPending
ACC-03Standing privileged access in production AWSAccess ControlMediumRahul Nair16 Oct 2026In ProgressPending
P2P-01Purchase order released by requester above delegation thresholdProcure-to-PayHighPriya Sharma20 Oct 2026In ProgressPending
SOD-01Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1)Segregation of DutiesHighPriya Sharma5 Nov 2026In ProgressPending
VEN-01Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)Third-Party RiskMediumSanjay Kulkarni20 Oct 2026OpenPending
VEN-03Payment provider incident — incomplete credential rotationThird-Party RiskHighDeepa Menon10 Oct 2026In ProgressPending
KYC-01Credit line activated before KYC completion (KYC MD §16)Customer OnboardingHighArjun Kapoor22 Oct 2026In ProgressPending
JML-02Mover access not removed timely (deviation in CC6.2 testing)Joiner/Mover/LeaverMediumNeha Iyer31 Oct 2026OpenPending

Q3 test results

All controls remediation timeline

SeptOctNovDecJan
Today
REM-F-ITGC-01 Priya SharmaREM-F-RBI-03 Deepa MenonREM-F-ITGC-02 Rahul NairREM-F-ITGC-03 Priya SharmaREM-F-RBI-02 Sanjay KulkarniREM-F-RBI-04 Arjun KapoorREM-F-ISO-02 Sanjay KulkarniREM-F-SOC2-02 Neha IyerREM-F-RBI-01 Priya Sharma
ClosedIn progressOpenValidation (planned / failed / passed)Bars run from the cycle close when the finding was raised to the action target date.

VEN-02 Provider contracts include data protection and RBI audit clauses

Open control →
Requirement
ISO-A.5.20 · RBI-OITS-2023-6 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-02
Provider contracts include data protection and RBI audit clauses
Application
Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
1 items
0 approved · 1 pending · 0 rejected
Test · Q3
Not tested
Finding
F-ISO-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-ISO-02 · In Progress
Validation
Pending
as recorded