Strengthen IT governance, manage enterprise technology and information-security risk, and provide defensible evidence of control design, operation and regulatory readiness.
Understand technology risk, test critical controls and build evidence for audit, regulatory and management decisions.
Typically for: CIO, CISO, CRO, IT risk, compliance and internal audit
Select a focused assessment or combine specialist modules under a defined statement of work.
Define or improve risk accountability, control objectives, policies and governance.
Discuss this scopeEvaluate ITGC and technology control design/operation against agreed criteria.
Discuss this scopeMap applicable requirements to evidence, gaps, remediation and management decisions.
Discuss this scopeExplore the modules relevant to your environment. Each module is selected against objectives and competencies confirmed during scoping.
Accountability, policies, governance structures, control ownership, COBIT-aligned reviews and operating maturity.
Inherent and residual risk, business impact, risk appetite, treatment plans, risk registers and reporting.
Logical access, change management, IT operations, privileged access, application controls and test evidence.
Gap assessment and evidence mapping against relevant HKMA, SFC, IA, MAS, APRA and public-sector expectations.
Information-security governance, vulnerability and incident controls, identity, security operations oversight and control effectiveness.
ISO/IEC 27001 preparation, NIST CSF alignment, information-security policies and risk-treatment controls.
Enterprise supplier risk framework, materiality tiers, due diligence policy and ongoing oversight standards.
Data classification, retention, privacy control design, access governance and sensitive information protection.
Custody control governance, key and signing processes, blockchain risk, DLT operating controls and relevant virtual-asset requirements.
Risk-based review of personal-information processing, data classification, access, retention, security controls and cross-border data arrangements under applicable laws.
AI risk policies, ownership, use-case inventory, third-party AI dependencies and control evidence; specialised AI testing is scoped under Service 05.
Risk-based control assessment for HK privacy requirements and applicable Mainland CSL, DSL, PIPL, MLPS, Network Data Security Regulations and cross-border transfer mechanisms; related Singapore and APAC obligations as scoped.
Review segregation of duties, privileged access, identity life cycle, transaction approvals, fraud-related technology controls and evidence of control operation.
Defined scope and evidence standards make the specialist work useful to both technical owners and senior management.
Agree entity, frameworks, control objectives, period and independence requirements.
Relate key technology risks to owners, policies, processes and evidence.
Examine control design and sample operating evidence as agreed.
Document findings, risk ratings, ownership, remediation and limitations.
Illustrative samples use fictional data. Actual deliverables and report depth are defined by your engagement scope.
Enterprise technology risk can include cybersecurity, personal-information and data governance, AI oversight and the regulatory treatment of cross-border processing. The required assessment criteria depend on the entity, industry, data and jurisdiction. Detailed AI system security testing remains within Service 05.
Previous specialist experience helps inform our assessment approach to the relevant technical, regulatory and business risks.
Senior internal audit and operational-risk experience across international financial institutions, spanning treasury and trade finance, equities trading, enterprise infrastructure, application controls and risk reporting.
Technology programme leadership supporting the establishment and operational launch of a cross-border securities joint venture in Mainland China, integrating systems, cybersecurity, risk controls and regulatory-readiness coordination.
Assess cybersecurity governance, IT controls, privacy obligations, AI governance and regulatory technology risk through structured evidence review and actionable findings.
Assess CSL, DSL, PIPL, MLPS, important-data controls and applicable cross-border data transfer arrangements.
ITGC, logical access, segregation of duties, audit findings, fraud-risk controls and evidence of operational effectiveness.
CISA, CPA Australia, CIPM, CIPP and CFE expertise strengthens control assessment, privacy governance and fraud-risk review.