Finding · F-IAQ2-OPS-01
Failed backup jobs not followed up
ClosedOPS-01 · Backups are performed daily and monitoredOperations & ResilienceQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.13 · ITGC-OP-01 · RBI-ITGRCA-2023-8 · SOC2-A1.2
mapped
Policy
Business Continuity & Backup Policy
pol-bcp
Control
OPS-01
Backups are performed daily and monitored
Application
Amazon Web Services (ap-south-1) · Microsoft Azure (corporate)
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-OPS-01 · High confidence
Finding
F-IAQ2-OPS-01 · Medium
Closed
Action
Rahul Nair
REM-F-IAQ2-OPS-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. Azure backup vault reported 4 failed nightly jobs in April with no incident raised; one database had no successful backup for 3 days.
Applications: Amazon Web Services (ap-south-1), Microsoft Azure (corporate).
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Backup failure alerts were routed to a shared mailbox nobody monitored.
Agreed action plan
Remediate: failed backup jobs not followed up.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-OPS-01
- Owner (FPR)
- Rahul Nair
- Target date
- 31 Jul 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Validated · planned 26 Sep 2026
Evidence for this control (8)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-027 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 4 Oct 2026 | Accepted | |
| ITGC-REQ-028 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 9 Oct 2026 | Accepted | |
| Q2-EV-026 | Amazon Web Services (ap-south-1) · policy document (Q2) | OPS-01 | Amazon Web Services (ap-south-1) | 13 Jun 2026 | Accepted |
| Q2-EV-027 | Microsoft Azure (corporate) · screenshot (Q2) | OPS-01 | Microsoft Azure (corporate) | 18 Jun 2026 | Rejected |
| RBI-REQ-023 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 5 Oct 2026 | Accepted | |
| RBI-REQ-024 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 4 Oct 2026 | Accepted | |
| SOC2-REQ-031 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 4 Oct 2026 | Accepted | |
| SOC2-REQ-032 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 9 Oct 2026 | Accepted |
Tests of this control (4)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 7 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-ITGC-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 4 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Pass | High |
| TST-SOC2-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 3 Oct 2026 | Laura Bennett · Kestrel Assurance LLP | Pass | High |
| TST-Q2-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |