Test · TST-RBI-VEN-01
VEN-01 · Critical third parties are risk-assessed before onboarding and annually
FailQ3 2026 Unified Program ReviewTested 2 Oct 2026 by Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)
Requirement to validation
Requirement
ISO-A.5.19 · ISO-A.5.22 · RBI-OITS-2023-6 · RBI-OITS-2023-9 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-01
Critical third parties are risk-assessed before onboarding and annually
Application
PayGate Payment Gateway · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-VEN-01 · Medium confidence
Finding
F-RBI-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-RBI-02 · Open
Validation
Pending
as recorded
Procedure and result
- Procedure
- Prismet vendor register + questionnaire; evidence collected as forms. Tests: Salesforce (Sales + Financial Services Cloud): Vendor assessment records current; PayGate Payment Gateway: PayGate assurance artefacts current. Frequency annual.
- Sample
- 1 item sampled (inspection)
- Expected
- Tier 1 and Tier 2 providers are assessed before onboarding and at least annually, including review of SOC 2 / ISO reports and penetration test summaries; lapses are tracked to resolution.
- Observed
- Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9).
- Confidence
- Medium
- Evidence
- RBI-REQ-027RBI-REQ-028