Module M5
Audit plan and test plan
Autonomy: L2
Meridian Trust Bank1 Nov 2025 – 31 Oct 2026
Risk-Based Audit Plan (AP-01 / AP-07)
Scope prioritised on recent incidents, risk register entries, and control changes. Version 0.3 · Status: Draft
| Control | Title | Risk Rating | Risk Basis / Rationale | Test Method | Sampling Strategy | Auditor | Effort |
|---|---|---|---|---|---|---|---|
| 9.2 | Internal audit programme | High | Programme not evidenced for Q2; no audit of the outsourced data centre | Document + interview | 2 audits from the cycle | A. Menon | 0.5 d |
| 6.1.3 | Risk treatment and SoA | High | SoA last approved 14 months ago; 6 controls show no owner | Data test on all 93 controls | Full population | A. Menon | 1.0 d |
| A.5.18 | Access rights | High | Two incidents in the period involved ex-staff credentials | Full-population leaver match | 212 leavers (full) | R. Iyer | 0.5 d |
| A.5.16 | Identity management | High | Orphan account count rising in the IAM export | Data analytics | All accounts (full) | R. Iyer | 1.0 d |
| A.8.8 | Technical vulnerabilities | High | 42 criticals older than the 14-day deadline | Ticket ageing test | All criticals (full) | S. Kaur | 1.5 d |
| A.8.15 | Logging | Medium | 6 of 47 critical systems not onboarded to SIEM | Coverage test + review sample | 47 systems / 12 reviews | S. Kaur | 1.0 d |
| A.6.3 | Awareness and training | Medium | Completion at 88%; contractors excluded from the platform | Data analytics | All staff (full) | P. Nair | 0.5 d |
| A.5.19 | Supplier relationships | Medium | 3 of 14 critical suppliers have no security assessment | Document + sample | 14 critical suppliers | P. Nair | 1.0 d |
| A.8.13 | Information backup | Medium | Restore test due; no evidence for ERP database | Records + one walkthrough | Quarterly records | R. Iyer | 0.5 d |
| A.7.2 | Physical entry | Low | Phase 1 has no Twin skill — manual checklist only (P1-04) | Walk-through | 2 secure areas | A. Menon | 0.5 d |
Stage 1 Readiness Assessment
Preliminary document evaluation surfaced two critical prerequisites: SoA review is 14 months old (needs management re-endorsement), and the logging scope excludes 6 core systems.
2 Gaps Highlighted· Prioritised into fieldwork week 1
Full Population Mandate (AE-03)
Sampling is restricted to controls where digital records do not exist. Where CSV/API feeds are present (access rights, ticket logs), 100% of transactions are analysed deterministically.
4 Full Population Tests Scheduled