Finding · F-RBI-02
Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)
OpenVEN-01 · Critical third parties are risk-assessed before onboarding and annuallyThird-Party RiskQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.19 · ISO-A.5.22 · RBI-OITS-2023-6 · RBI-OITS-2023-9 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-01
Critical third parties are risk-assessed before onboarding and annually
Application
PayGate Payment Gateway · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-VEN-01 · Medium confidence
Finding
F-RBI-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-RBI-02 · Open
Validation
Pending
as recorded
Observation
Raised 2026-10-07 in the RBI Regulatory Controls — Q4 2026 Periodic Internal Audit (Meridian Internal Audit (IS Audit cell)). PayGate annual pen test summary expired 2026-08-12. Northstar BPO annual reassessment due 2026-08-20 not started.
Applications: PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud).
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Vendor assurance tracker had no escalation for lapsed artefacts or overdue reassessments.
Agreed action plan
PayGate pen test summary requested; Northstar reassessment scheduled 2026-10-20. Tracked as T-013 in Prismet Tasks.
Management response: PayGate pen test summary requested; Northstar reassessment scheduled 2026-10-20.
- Action
- REM-F-RBI-02
- Owner (FPR)
- Sanjay Kulkarni
- Target date
- 20 Oct 2026
- Priority
- Medium
- Status
- Open
- Validation
- Pending · planned 20 Oct 2026
Evidence for this control (5)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| Q2-EV-032 | Salesforce (Sales + Financial Services Cloud) · configuration report (Q2) | VEN-01 | Salesforce (Sales + Financial Services Cloud) | 19 Jun 2026 | Rejected |
| Q2-EV-033 | PayGate Payment Gateway · ticket sample (Q2) | VEN-01 | PayGate Payment Gateway | 24 Jun 2026 | Rejected |
| RBI-REQ-027 | Salesforce: Vendor assessment records current | VEN-01 | 9 Oct 2026 | Accepted | |
| RBI-REQ-028 | PayGate: PayGate assurance artefacts current | VEN-01 | 8 Oct 2026 | Accepted | |
| SOC2-REQ-038 | PayGate: PayGate assurance artefacts current | VEN-01 | 6 Oct 2026 | Under review |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-VEN-01 | VEN-01 · Critical third parties are risk-assessed before onboarding and annually | Q3 2026 Unified Program Review | 2 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-VEN-01 | VEN-01 · Critical third parties are risk-assessed before onboarding and annually | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |