Finding · F-IAQ2-VEN-01
Critical vendor reassessments not tracked
ClosedVEN-01 · Critical third parties are risk-assessed before onboarding and annuallyThird-Party RiskQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.19 · ISO-A.5.22 · RBI-OITS-2023-6 · RBI-OITS-2023-9 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-01
Critical third parties are risk-assessed before onboarding and annually
Application
PayGate Payment Gateway · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-VEN-01 · Medium confidence
Finding
F-IAQ2-VEN-01 · Medium
Closed
Action
Sanjay Kulkarni
REM-F-IAQ2-VEN-01 · Closed
Validation
Failed
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. Annual risk reassessments for 2 of 4 critical third parties had no evidence of completion; the tracker had no due-date alerting.
Applications: PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud).
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Third-party reassessment calendar maintained manually by one analyst.
Agreed action plan
Remediate: critical vendor reassessments not tracked.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-VEN-01
- Owner (FPR)
- Sanjay Kulkarni
- Target date
- 31 Jul 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Failed · planned 26 Sep 2026
Evidence for this control (5)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| Q2-EV-032 | Salesforce (Sales + Financial Services Cloud) · configuration report (Q2) | VEN-01 | Salesforce (Sales + Financial Services Cloud) | 19 Jun 2026 | Rejected |
| Q2-EV-033 | PayGate Payment Gateway · ticket sample (Q2) | VEN-01 | PayGate Payment Gateway | 24 Jun 2026 | Rejected |
| RBI-REQ-027 | Salesforce: Vendor assessment records current | VEN-01 | 9 Oct 2026 | Accepted | |
| RBI-REQ-028 | PayGate: PayGate assurance artefacts current | VEN-01 | 8 Oct 2026 | Accepted | |
| SOC2-REQ-038 | PayGate: PayGate assurance artefacts current | VEN-01 | 6 Oct 2026 | Under review |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-VEN-01 | VEN-01 · Critical third parties are risk-assessed before onboarding and annually | Q3 2026 Unified Program Review | 2 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-VEN-01 | VEN-01 · Critical third parties are risk-assessed before onboarding and annually | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |