IS Audit & ITGC Review India: Documents and Evidence
Most delay on IS Audit & ITGC Review India comes down to paperwork that was not ready, so it is worth knowing what will be asked for. The questions below are the ones raised most often in practice; the full scope of the service is on the IS Audit & ITGC Review India page.
What happens if the review finds a Critical-rated finding — what does that actually mean?
A Critical rating means the control gap creates a material and immediate risk — for example, several exited employees with active privileged access to the financial system, or evidence of unauthorised changes made directly to production without any approval trail. Critical findings are escalated to the Audit Committee or Board immediately upon identification during fieldwork, rather than held back for the final report, and PNPC recommends an interim validation check (rather than waiting for the next full annual cycle) to confirm remediation before it becomes a statutory audit issue.
In practice: We do not sit on Critical findings until the report is finalised. If we find something that represents live, exploitable exposure, we flag it to management the same week — an ITGC review is an assurance exercise, not a game of withholding bad news until the final slide deck.
Our IT is entirely outsourced to a managed service provider. Does that change the scope?
It changes the evidence sources but not the underlying control objectives — the organisation remains accountable for the effectiveness of controls even when IT operations are outsourced. We review the managed service provider's contractual obligations around access control, change management, and incident notification, request relevant third-party attestations (SOC 2 report, ISO 27001 certificate) where available, and test the organisation's own oversight controls over the outsourced arrangement — because 'we outsourced it' is not itself a control.
In practice: One of the most common gaps we find in outsourced-IT organisations is the absence of any structured vendor oversight — no periodic review of the MSP's access grants, no confirmation that exit tickets were actioned by the vendor. Accountability for control effectiveness cannot be outsourced even when the operational task is.
Does PNPC test the operating effectiveness of controls, or just whether policies exist on paper?
Operating effectiveness — meaning we test actual evidence (access logs, change tickets, approval records, backup restore logs) over the audit period, not just whether a policy document exists. A documented access management policy that is not actually followed provides no real assurance, and testing only the existence of policy would give a false sense of comfort to the Board.
In practice: The gap between 'policy exists' and 'policy is followed' is where findings commonly originate. We have reviewed beautifully written IT policy manuals sitting alongside access lists that show dozens of exited employees with active credentials — the two facts coexist far more often than management expects.
Do you test whether our backups actually work, or just that backups are scheduled?
We specifically look for evidence of periodic restore or recovery testing — an untested backup provides no real assurance of recoverability and is, in practical terms, not yet a proven control. We review the backup schedule and retention policy, and separately request evidence (a restore test log, a DR drill report) confirming that a backup was actually restored successfully within the audit period.
In practice: Organisations can discover during an actual incident that their backups had been silently failing, because no one had tried to restore from them. Scheduled backups without restore testing is one of the most dangerous false-comfort gaps in IT operations.
Can this review help with our SEBI-listed company's IFC-FR certification specifically?
Yes — this is one of the most common reasons listed companies commission a dedicated ITGC review. The findings and remediated evidence directly support the Board's basis for its Section 134(5)(e) internal financial controls certification, and give the CFO and Audit Committee documented assurance ahead of the statutory auditor's own IFC-FR testing, reducing the risk of a late-discovered gap becoming a CARO qualification or audit management letter point at year-end.
In practice: We time engagements for listed clients specifically to complete well ahead of year-end statutory audit fieldwork — findings discovered in March, when the statutory auditor is already testing IFC-FR, leave far less room for orderly remediation than findings discovered in the preceding quarter.
Our NBFC/bank has an internal audit function already. Why do we need a separate IS Audit?
Most internal audit teams, even well-resourced ones, are staffed primarily with finance and operations audit skills rather than IT audit specialists trained to independently test access logs, change tickets, database configuration, and system-level evidence. RBI's IT governance and outsourcing frameworks for regulated entities typically expect a level of specialist IT audit rigour that general internal audit resourcing does not always provide. A dedicated IS Audit/ITGC review, whether performed by PNPC directly or used to strengthen and train the internal audit function's approach, closes that specialist gap.
In practice: An ITGC review can sit alongside a client's existing internal audit function rather than replacing it — providing the specialist IT audit depth for the ITGC domains while internal audit continues to own the broader annual audit plan.
What deliverables do we actually receive at the end of the engagement?
A detailed findings report with each finding rated by severity, mapped to the relevant control domain and risk, accompanied by a specific recommendation; a management response and remediation roadmap document with named owners and timelines; and an executive summary presentation delivered directly to the Audit Committee or Board in plain-language terms. For engagements linked to statutory audit or regulatory submission, we also prepare a summary memo cross-referencing findings to the relevant CARO/IFC-FR or regulatory reporting requirement.
In practice: We deliberately produce two versions of the findings — a full technical report for the IT team to action, and an executive summary for the Board — because a 40-page technical document with control-domain jargon does not serve a non-technical director's decision-making needs.
How much CA and IT staff involvement is required from our side during the engagement?
We minimise disruption by requesting evidence in structured batches rather than ad-hoc, and scheduling interviews with IT and process owners in defined windows rather than open-ended access. For a mid-sized single-location engagement, realistic internal effort is typically a designated IT coordinator's part-time involvement across the fieldwork period, plus brief interview time from a handful of process owners (access administrator, change manager, backup/DR owner).
In practice: We ask clients to nominate a single internal coordination point at kickoff — engagements where evidence requests are scattered across multiple uncoordinated IT staff consistently take longer and produce more incomplete evidence trails than those with one clear coordinator.
Where this sits in the wider engagement
IS Audit & ITGC Review India rarely arrives on its own. The statutory basis and the current requirements are set out on the IS Audit & ITGC Review India service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On IS Audit & ITGC Review India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.