Technology assurance,
delivered to inspection standard.

IT Audit

We plan and execute full-scope IT audits using a risk-based methodology aligned to IIA Global Standards and the expectations of SAMA and NCA supervision. Every audit is scoped from your risk universe, executed against defined control criteria, and reported with findings and management actions your audit committee can track to closure.

• Risk-based IT audit universe and multi-year audit plan
• Fieldwork executed against defined control criteria with full workpapers
• Findings rated by risk, with root-cause analysis and agreed management actions
• Audit committee reporting and follow-up tracking

ITGC Assessment

IT general controls underpin the reliability of every financially and operationally significant system. We assess ITGC design and operating effectiveness across access management, change management, IT operations and backup and recovery — whether for external audit reliance, regulatory readiness or internal assurance.

• ITGC scoping tied to significant systems and data flows
• Design and operating-effectiveness testing with documented sampling rationale
• Deficiency evaluation and aggregation analysis
• Remediation roadmap with control owners and target dates

Application Controls

Automated application controls fail silently. We test the configurable and inherent controls inside core banking, ERP and line-of-business systems — input validation, processing logic, calculations, interface reconciliations and segregation of duties — so you know the controls you rely on actually operate.

• Application control identification benchmarked against business process risks
• Testing of configurable controls, calculations and interface reconciliations
• Segregation-of-duties and sensitive-access analysis
• Control gaps mapped to business process impact

Technology Risk

We build and run technology risk assessment programmes: identifying, analysing and evaluating risk across infrastructure, applications, data, resilience and emerging technology — and translating the results into a maintained risk register with KRIs and board-level reporting rather than a one-off report.

• Technology risk taxonomy and assessment methodology
• Risk assessments across infrastructure, applications, data and resilience
• KRI design with thresholds and escalation paths
• Board and committee technology risk reporting packs

IT Governance

We design and implement IT governance structures aligned to COBIT 2019 and SAMA's IT Governance Framework — decision rights, committee structures, policy architecture and performance measurement — so technology decisions are made, and evidenced, at the right level of the organisation.

• IT governance maturity assessment against COBIT 2019 and SAMA ITGF
• Committee charters, decision rights and escalation model
• IT policy and standards architecture
• Governance metrics and board reporting cadence

Cloud Risk

Cloud adoption in the Kingdom is governed by specific rules — the NCA Cloud Cybersecurity Controls, SAMA's outsourcing and cloud requirements, and PDPL data-residency obligations. We assess cloud risk across your estate, from provider due diligence to workload-level control reviews, and build the governance to keep adoption compliant as it scales.

• Cloud risk and readiness assessments aligned with NCA CCC and applicable SAMA requirements
• Cloud service provider due-diligence and exit-strategy frameworks
• Data residency and PDPL impact analysis
• Cloud governance model with guardrails and approval workflows

Third-Party Technology Risk

Regulators hold you accountable for your vendors' technology failures. We build third-party technology risk programmes covering tiering, due diligence, contractual controls, ongoing monitoring and exit planning — aligned to SAMA's outsourcing requirements and NCA third-party controls.

• Vendor tiering methodology by criticality and data sensitivity
• Technology due-diligence assessments and control questionnaires
• Contractual control requirements and right-to-audit clauses
• Ongoing monitoring cadence with concentration-risk analysis

Internal Audit Advisory

Most internal audit functions are short on deep technology skills. We provide co-sourced and outsourced technology audit capacity, build IT audit methodologies and workpaper standards, and prepare functions for external quality assessments — so your audit plan stops deferring technology audits for lack of expertise.

• Co-sourced or outsourced execution of technology audits
• IT audit methodology, workpaper templates and rating models
• Technology audit universe and plan development
• External quality assessment readiness against IIA Standards