One platform for both sides of the audit.
Evidence request · CISD 5(1)
Board-approved information security policy
For audit firms
Run CISD engagements across your client base with one method, one library and a review trail behind every finding.
Submitted Part II – GovernanceAma O. · Auditor Returned: add evidence for 5(1)Kofi M. · Reviewer Approved · area lockedKofi M. · Reviewer
Worked example.
01
Scope in minutes
Entity type, BoG tier override and 18 scoping questions set the checklist for each client.
02
Divide the work
Assign audit areas to auditors and record each auditee and fieldwork date.
03
Ask the client once
Build the whole request list from the scope in one step. The institution's people upload in their own portal and see nothing else.
04
Review before it ships
Areas are submitted, approved or returned with notes; approved areas lock.
05
Issue with confidence
Numbered PDF reports with a fingerprint, plus the workbook and findings register.
06
Follow findings to closure
Send gaps for a management response, then verify each fix or record an accepted risk. The dashboard shows where every finding stands.
07
Start next year from this one
Roll an engagement forward: same client, scope and team, with open findings and still-valid evidence carried over.
For regulated institutions
Know where you stand against your tier before the auditors arrive, and keep it that way between audits.
- Competency Framework60.0%
- Privacy & Data Protection67.9%
- Preliminary Matters68.3%
- Electronic Banking Platforms68.5%
- Cyber Response71.4%
- Governance80.1%
- Below 50%
- 50 to 69%
- 70 to 84%
- 85% and up
Worked example.
01
Self-assess against your tier
Only the requirements that apply to you, with the alternative controls Annex A allows.
02
Track remediation
Owners, target dates and status for every gap, with overdue items on the dashboard.
03
Answer findings in one place
Give management's response, owner and target date in the portal, then send evidence once it's fixed.
04
Keep evidence current
Store evidence against requirements with expiry dates, so renewals don't slip.
05
Report to the Board
The dashboard and report summarise compliance by area, law and framework.