28 findings
As of 9 Oct 2026
As of 9 Oct 2026
| Finding | Observation | Control | Applications | Severity | Status | Owner | Action | Validation |
|---|---|---|---|---|---|---|---|---|
| F-ITGC-01 | Unmitigated SoD conflict: payments approval and GL posting held by transferred employee | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-ITGC-01 · In Progress | Pending |
| F-ITGC-03 | Purchase order released by requester above delegation threshold | P2P-01 | SAP S/4HANA | High | Open | Priya Sharma | REM-F-ITGC-03 · In Progress | Pending |
| F-RBI-01 | Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1) | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-RBI-01 · In Progress | Pending |
| F-RBI-03 | Payment provider incident — incomplete credential rotation | VEN-03 | PayGate Payment Gateway, Meridian Customer Portal | High | In Progress | Deepa Menon | REM-F-RBI-03 · In Progress | Pending |
| F-RBI-04 | Credit line activated before KYC completion (KYC MD §16) | KYC-01 | Meridian Customer Portal, Salesforce (Sales + Financial Services Cloud) | High | Open | Arjun Kapoor | REM-F-RBI-04 · In Progress | Pending |
| F-ISO-02 | Supplier agreement lacks information security clauses (A.5.20) | VEN-02 | Salesforce (Sales + Financial Services Cloud) | Medium | Open | Sanjay Kulkarni | REM-F-ISO-02 · In Progress | Pending |
| F-ITGC-02 | Standing privileged access in production AWS | ACC-03 | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Medium | In Progress | Rahul Nair | REM-F-ITGC-02 · In Progress | Pending |
| F-RBI-02 | Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9) | VEN-01 | PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud) | Medium | Open | Sanjay Kulkarni | REM-F-RBI-02 · Open | Pending |
| F-SOC2-02 | Mover access not removed timely (deviation in CC6.2 testing) | JML-02 | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Medium | Open | Neha Iyer | REM-F-SOC2-02 · Open | Pending |
| F-IAQ2-ACC-02 | Access granted in SAP without recorded approval | ACC-02 | Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM | High | Closed | Ananya Rao | REM-F-IAQ2-ACC-02 · Closed | Validated |
| F-IAQ2-ACC-03 | Standing privileged access in Entra and AWS | ACC-03 | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | High | Closed | Ananya Rao | REM-F-IAQ2-ACC-03 · Closed | Failed |
| F-IAQ2-CHG-03 | Developers held standing production access | CHG-03 | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | High | Closed | Aditya Singh | REM-F-IAQ2-CHG-03 · Closed | Validated |
| F-IAQ2-P2P-01 | Purchase orders released above delegated threshold | P2P-01 | SAP S/4HANA | High | Closed | Priya Sharma | REM-F-IAQ2-P2P-01 · Closed | Failed |
| F-IAQ2-PAY-01 | Bulk payout API accepted requests without customer 2FA | PAY-01 | PayGate Payment Gateway, Meridian Customer Portal | High | Closed | Deepa Menon | REM-F-IAQ2-PAY-01 · Closed | Validated |
| F-IAQ2-SOD-01 | Unmitigated SAP SoD conflicts | SOD-01 | SAP S/4HANA | High | Closed | Priya Sharma | REM-F-IAQ2-SOD-01 · Closed | Validated |
| F-IAQ2-VUL-01 | Critical vulnerabilities past remediation SLA | VUL-01 | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | High | Closed | Ananya Rao | REM-F-IAQ2-VUL-01 · Closed | Pending |
| F-IAQ2-ACC-04 | Salesforce user access review not completed | ACC-04 | Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA | Medium | Closed | Ananya Rao | REM-F-IAQ2-ACC-04 · Closed | Pending |
| F-IAQ2-BCP-01 | Restore test evidence incomplete | BCP-01 | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Medium | Closed | Rahul Nair | REM-F-IAQ2-BCP-01 · Closed | Validated |
| F-IAQ2-CHG-01 | Portal changes merged without second reviewer | CHG-01 | GitHub Enterprise Cloud, Meridian Customer Portal | Medium | Closed | Aditya Singh | REM-F-IAQ2-CHG-01 · Closed | Validated |
| F-IAQ2-CHG-02 | Emergency changes without retrospective CAB approval | CHG-02 | GitHub Enterprise Cloud, ServiceNow ITSM | Medium | Closed | Aditya Singh | REM-F-IAQ2-CHG-02 · Closed | Failed |
| F-IAQ2-JML-01 | Leaver de-provisioning occasionally exceeds 24 hours | JML-01 | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Medium | Closed | Neha Iyer | REM-F-IAQ2-JML-01 · Closed | Validated |
| F-IAQ2-KYC-01 | KYC document checks performed after account activation | KYC-01 | Meridian Customer Portal, Salesforce (Sales + Financial Services Cloud) | Medium | Closed | Arjun Kapoor | REM-F-IAQ2-KYC-01 · Closed | Failed |
| F-IAQ2-LOG-01 | Customer portal not onboarded to the SIEM | LOG-01 | Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal | Medium | Closed | Ananya Rao | REM-F-IAQ2-LOG-01 · Closed | Validated |
| F-IAQ2-OPS-01 | Failed backup jobs not followed up | OPS-01 | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Medium | Closed | Rahul Nair | REM-F-IAQ2-OPS-01 · Closed | Validated |
| F-IAQ2-VEN-01 | Critical vendor reassessments not tracked | VEN-01 | PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud) | Medium | Closed | Sanjay Kulkarni | REM-F-IAQ2-VEN-01 · Closed | Failed |
| F-ISO-01 | SAP HANA restore test exceeded RTO (internal ISMS audit, carried into surveillance) | BCP-01 | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Medium | Closed | Rahul Nair | REM-F-ISO-01 · Closed | Validated |
| F-RBI-05 | Privileged access to production previously standing (MD-ITGRCA §7.1) | ACC-03 | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Medium | Closed | Ananya Rao | REM-F-RBI-05 · Closed | Validated |
| F-SOC2-01 | Emergency changes deployed without timely CAB approval | CHG-02 | GitHub Enterprise Cloud, ServiceNow ITSM | Medium | Closed | Aditya Singh | REM-F-SOC2-01 · Closed | Validated |