This requirement exists to ensure preparation, coordination, response, and evidence management for regulatory examinations is consistently governed, documented, and capable of producing reliable assurance. Without it, audit activities may be inconsistent, difficult to evidence, or insufficient to support management, regulatory, and stakeholder decisions.
Document the required preparation, coordination, response, and evidence management for regulatory examinations; assign accountable roles and approval points; define minimum records and evidence; apply the approved audit methodology and risk criteria; and retain evidence of execution and review. Periodically review the process for changes in organizational risk, regulatory expectations, and audit scope.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §13 – Cyber security preparedness indicators |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 5(2)(f) – Approval and periodic review of ICT internal audit plans and audits Article 6(6) – Regular internal audit of ICT risk management framework |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(14) Standard: Compliance audit; § 164.316(a)(2) Actions, activities and assessments documentation |
US
Law
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed ID.IM – Improvement | ID.IM-01 – Improvements are identified from evaluations PR.PS – Platform Security | PR.PS-04 – Log records are generated and made available for continuous monitoring |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-4 – SECURITY CERTIFICATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 5(2) – Accountability; Article 24(1) – Responsibility of the controller |
EU
Regulation
|
vCurrent | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |