Control · PAY-02
Payment release requires maker-checker
Payments SecuritySOC 2 · ISO 27001 · ITGC · RBIRisk High
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-BP-01 · ITGC-SOD-01 · RBI-DPSC-2021-4 · SOC2-CC6.3
mapped
Policy
Payments Security Policy
pol-payments
Control
PAY-02
Payment release requires maker-checker
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-PAY-02 · High confidence
Finding
None
Action
None
Validation
Not planned
What should be true
Outgoing payment runs in SAP are released only by a checker different from the maker and the invoice approver; payments > INR 50 lakh require a second Treasury checker.
- Requirements
- ISO-A.5.3 A.5.3 · Segregation of dutiesITGC-BP-01 ITGC-BP-01 · Automated application controls — approval workflow and thresholdsITGC-SOD-01 ITGC-SOD-01 · Segregation of incompatible duties in business applicationsRBI-DPSC-2021-4 RBI-DPSC-2021 §4 · Digital payment security — application security, API security, transaction authentication (RBI Master Direction on Digital Payment Security Controls, 2021)SOC2-CC6.3 CC6.3 · Role-based access, least privilege and segregation of duties; access modification and removal
- Applications
- SAP S/4HANA
- Third parties
- PayGate Payments Pvt. Ltd.
- Testing procedure
- SAP payment release workflow (BNK_APP). Tests: SAP S/4HANA: Payment runs released by independent checker. Frequency continuous.
Findings (0)
○ No data available
Evidence (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-031 | SAP S/4HANA: Payment runs released by independent checker | PAY-02 | SAP S/4HANA | 8 Oct 2026 | Accepted |
| Q2-EV-041 | SAP S/4HANA · configuration report (Q2) | PAY-02 | SAP S/4HANA | 16 Jun 2026 | Accepted |
| RBI-REQ-037 | SAP S/4HANA: Payment runs released by independent checker | PAY-02 | SAP S/4HANA | 9 Oct 2026 | Accepted |
Tests (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-PAY-02 | PAY-02 · Payment release requires maker-checker | Q3 2026 Unified Program Review | 6 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-ITGC-PAY-02 | PAY-02 · Payment release requires maker-checker | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Pass | High |
| TST-Q2-PAY-02 | PAY-02 · Payment release requires maker-checker | Q2 2026 Unified Program Review | 12 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Pass | High |