Module M8
Evidence portal (auditee workflow)
Autonomy: L2
Meridian Trust Bank1 Nov 2025 – 31 Oct 2026
Evidence Intake Portal (Module M8)
Auditee-facing workflow. Automated pre-intake checks on upload. Zero training required for department owners.
5 Accepted1 Overdue
| Req ID | Control | Description / Plain Ask | Department Owner | Due Date | Status | Intake Verdict |
|---|---|---|---|---|---|---|
| REQ-011 | A.5.18 | HR leavers export for the audit period and the directory account-disable log | HR Shared Services | 2026-11-03 | Accepted | Accepted. 212 rows, columns match the agreed template, period complete. |
| REQ-012 | A.5.16 | IAM account export with creation date, owner and last logon | Identity & Access Mgmt | 2026-11-05 | Accepted | Accepted. 4,118 accounts; 31 accounts have no owner. |
| REQ-013 | A.5.18 | Quarterly access review sign-offs (Q3 and Q4) | Core Banking Ops | 2026-11-12 | Needs correction | Rejected. Signature page missing for Q4; 2 of 5 review sheets cover a different scope. |
| REQ-014 | A.8.8 | Vulnerability scan reports and the critical/high ticket ageing export | Security Operations | 2026-11-07 | Accepted | Accepted. 9 scans, 1,244 findings, ageing columns present. |
| REQ-015 | A.8.15 | Log source inventory vs CMDB critical systems, plus log review records | Security Operations | 2026-11-06 | Accepted | Accepted with gap. Inventory lists 41 of 47 critical systems; no Q3 review records for the SIEM. |
| REQ-016 | A.6.3 | Training completion export by role, including contractors | HR / L&D | 2026-11-09 | Submitted | Under review — contractor rows missing a department column. |
| REQ-017 | 9.2 | Internal audit programme for the cycle, with plans, reports and action tracking | ISMS Office | 2026-11-02 | Accepted | Accepted. Programme covers 11 audits; 2 reports missing follow-up status. |
| REQ-018 | A.5.19 | Supplier register with risk tier and latest security assessment | Third-Party Risk | 2026-11-18 | Awaiting response | — |
| REQ-019 | A.8.32 | Change tickets for the period with approvals and test evidence | IT Change Mgmt | 2026-11-10 | Overdue | — |
| REQ-020 | A.5.26 | Incident tickets (30 sampled) with post-incident reviews | Incident Response | 2026-11-19 | Awaiting response | — |
| REQ-021 | A.8.13 | Backup job logs and restore test results | IT Infrastructure | 2026-11-13 | Submitted | Under review — ERP database restore evidence absent. |
| REQ-022 | 9.2 | Auditor competence and independence records | ISMS Office | 2026-11-20 | Not started | — |