Skip to content
Start free trial

747 requirements · 28 areas · 5 tiers · 10 frameworks

Ebanta Comply is a product of Ebanta Africa.

Product

One engagement, from scope to signed report.

The audit team, the reviewer and the institution work in one place, with the Directive's structure built in. Here is how a CISD 2026 engagement runs, on real screens from the worked example.
01

Scope

Start from what the Bank of Ghana actually asks of this institution, not the whole Directive.

  • The entity type sets the Annex A tier, with a field for a BoG-approved override.
  • Eighteen scoping questions switch off what doesn't apply, and say why.
  • The count of applicable requirements updates as you answer.
ebantaafrica.com/app/engagements/example-bank/setup
02

Plan the team

Divide the audit by area so everyone knows what's theirs from day one.

  • Assign each of the audit areas to an auditor, with the auditee and fieldwork dates.
  • Progress per area, so the lead sees what's moving and what isn't.
  • The engagement lead and reviewer are named on the report from the start.
ebantaafrica.com/app/engagements/example-bank/areas
03

Request evidence

Ask the institution once, clearly, and get documents back in one place.

  • The request list builds itself from the scope, grouped by topic with what usually satisfies it.
  • The institution's people answer in their own portal and see nothing else.
  • Uploads are checked, scanned and fingerprinted the moment they arrive.

Evidence request · CISD 5(1)

Board-approved information security policy

Submitted
Security policy v3 (signed).pdf Scanned

Due 30 November · from Head of Information Security

The auditee portal: one request, as the institution sees it.

04

Assess

Requirement by requirement, with the Directive's text and every mapping beside you.

  • Status, risk, owner, target date, observation and recommendation on each requirement.
  • Mappings to Acts 987, 1038 and 843, ISO 27001, NIST CSF, COBIT, CIS and OWASP.
  • Link evidence from the vault, so every rating has its proof attached.
ebantaafrica.com/app/engagements/example-bank/areas/governance
05

Review

A second pair of eyes on every area before anything reaches the report.

  • Submit an area; a reviewer approves it or returns it with a note.
  • Approved areas lock, so the report is built from reviewed work only.
  • Every change is logged with who made it, and what it was before and after.
ebantaafrica.com/app/engagements/example-bank/areas/governance/review
06

See where you stand

A dashboard that answers the board's questions without a spreadsheet.

  • Weighted compliance and its rating band, explained figure by figure.
  • Weakest areas first, open gaps by risk, and every law and framework side by side.
  • A portfolio view across all your engagements and clients.
ebantaafrica.com/app/engagements/example-bank/dashboard
07

Report

The audit report writes its first draft from the results; the auditor's judgement finishes it.

  • Executive summary and opinion drafted from the ratings, editable before issue.
  • Issued as a numbered, fingerprinted PDF, with every version kept.
  • The workbook (XLSX) and findings register (CSV) go with it.
ebantaafrica.com/app/engagements/example-bank/report
08

Follow up and roll forward

The audit doesn't end at the report. Gaps are followed to closure, then next year starts from here.

  • Send findings to management for a response, owner and target date.
  • Verify each fix, or record an accepted risk, and see every finding's stage.
  • Roll forward: same client, scope and team, with open findings and valid evidence carried over.
ebantaafrica.com/app/engagements/example-bank/findings
Built on the Directive

The whole of CISD 2026, already structured.

Every operative paragraph and annexure, tiered by Annex A and mapped to the laws and frameworks your institution answers to. Versioned, so an issued report never shifts under you.

requirements
747
audit areas
28
Annex A tiers
5
laws and frameworks mapped
10
Around every engagement

The details that make an audit defensible.

Evidence vault

Files fingerprinted on upload, with expiry dates so renewals don't slip.

Activity log

Append-only: who changed what, with the before and after.

Find anything

Type a reference like 4(2), a client or a person, from any page.

Alerts that mean something

Areas waiting for review, evidence sent back, fixes to verify.

Sign-in you can defend

Two-factor for everyone, single sign-on for verified domains.

Yours to take

Exports and a full backup of any engagement you can import again.

For audit firms and regulated institutions Every screen works on a laptop, tablet or phone

Run your next CISD audit on it.

Fourteen days free, with a worked example loaded. No card needed.

Start free trialBook a demoSee pricing