Security Testing & Assurance

IT Audit & Control Review

Review IT controls using evidence to support governance, oversight and practical improvement.

Start your enquiry

IT General Controls
Bank of Thailand
Office of Insurance Commission
E-Policy

SERVICE IN DETAIL

From the first assessment to practical outcomes

Who this service is for

Boards, management, internal audit and regulated organisations that need an evidence-based view of controls.

How we work

Scope & audit planning
Audit universe, business-critical systems and IT control objectives
Confirm the business activities, systems, locations and assessment criteria. Establish the audit period, evidence request list and sampling approach, taking account of the independence required for the engagement.
Evidence-based assessment
Access administration, system changes, operations, backups and supplier controls
Interview control owners and trace selected transactions or activities to supporting records. Evaluate both control design and operation, validate exceptions with the responsible teams and document the basis for findings.
Reporting & follow-up
Risk-rated findings, management responses and remediation verification
Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.

What you receive

Audit plan and evidence request list
Findings report with evidence, risk and recommendations
Management action register and agreed follow-up results

Before we begin

We confirm the scope, responsibilities, evidence, timetable and deliverables in the proposal. The activities above are tailored to the systems and objectives agreed with your organisation.

Discuss your scope

Specialist services

Biometric System Control Assessment

Review biometric system controls and supporting evidence against the assessment criteria agreed for your organisation.

View scope, process and deliverables

Who this service is for

Boards, management, internal audit and regulated organisations that need an evidence-based view of controls.

How we work

Scope & audit planning
Biometric capture, enrolment, matching flows and assessment criteria
Confirm the business activities, systems, locations and assessment criteria. Establish the audit period, evidence request list and sampling approach, taking account of the independence required for the engagement.
Evidence-based assessment
Template protection, access, consent interfaces and supplier control evidence
Interview control owners and trace selected transactions or activities to supporting records. Evaluate both control design and operation, validate exceptions with the responsible teams and document the basis for findings.
Reporting & follow-up
Control gaps, evidence traceability and recommendations for the selected criteria
Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.

What you receive

Audit plan and evidence request list
Findings report with evidence, risk and recommendations
Management action register and agreed follow-up results

Discuss this service

IT Audit — SEC สธ. 38/2565

Assess IT governance, security and audit controls under SEC Notification สธ. 38/2565 and applicable amendments, including สธ. 33/2567. Review evidence, report findings and support remediation planning for the agreed scope.

View scope, process and deliverables

Who this service is for

Boards, management, internal audit and regulated organisations that need an evidence-based view of controls.

How we work

Scope & audit planning
Securities business activities, relevant IT systems and applicable SEC requirements
Confirm the business activities, systems, locations and assessment criteria. Establish the audit period, evidence request list and sampling approach, taking account of the independence required for the engagement.
Evidence-based assessment
IT governance, IT security and IT audit evidence under the applicable framework
Interview control owners and trace selected transactions or activities to supporting records. Evaluate both control design and operation, validate exceptions with the responsible teams and document the basis for findings.
Reporting & follow-up
Findings mapped to สธ. 38/2565 and applicable amendments with management actions
Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.