Raised 2026-06-24 in the Q2 2026 internal audit baseline. 2 of 40 sampled onboardings had the address proof verified a day after activation; documents were valid.

Applications: Meridian Customer Portal, Salesforce (Sales + Financial Services Cloud).

Potential risk

The control may not operate consistently, weakening reliance by auditors and the regulator.

Root cause

Salesforce validation rule checked document presence, not verification status.

Agreed action plan

Remediate: kyc document checks performed after account activation.

Management response: Management agreed and committed to remediate before the Q3 review.

Action: REM-F-IAQ2-KYC-01
Owner (FPR): Arjun Kapoor
Target date: 31 Jul 2026
Priority: Medium
Status: Closed
Validation: Failed · planned 26 Sep 2026

Evidence for this control (5)

Open list →

Evidence	Title	Control	Source system	Collected	Status
ITGC-REQ-033	Meridian Customer Portal: Activated accounts linked to approved case	KYC-01	Meridian Customer Portal	6 Oct 2026	Under review
Q2-EV-037	Salesforce (Sales + Financial Services Cloud) · policy document (Q2)	KYC-01	Salesforce (Sales + Financial Services Cloud)	20 Jun 2026	Accepted
Q2-EV-038	Meridian Customer Portal · screenshot (Q2)	KYC-01	Meridian Customer Portal	25 Jun 2026	Accepted
RBI-REQ-032	Salesforce: Approved onboarding cases have complete KYC checklist	KYC-01		6 Oct 2026	Accepted
RBI-REQ-033	Meridian Customer Portal: Activated accounts linked to approved case	KYC-01	Meridian Customer Portal	5 Oct 2026	Accepted

Tests of this control (2)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-RBI-KYC-01	KYC-01 · Customer accounts are activated only with complete KYC	Q3 2026 Unified Program Review	4 Oct 2026	Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)	Fail	Medium
TST-Q2-KYC-01	KYC-01 · Customer accounts are activated only with complete KYC	Q2 2026 Unified Program Review	20 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Pass with Observation	High