IT Governance & Compliance Reviews

It is a structured assessment of how your organisation governs and controls its technology environment — policies, access controls, data protection practices, vendor risk, business continuity, and incident response — measured against recognised frameworks (ISO 27001, COBIT) and applicable Indian law (the DPDP Act, CERT-In directions, Companies Act Internal Financial Controls requirements, and sector-specific RBI/SEBI circulars where relevant). A cybersecurity audit or penetration test is a technical assessment of specific vulnerabilities in your systems and network. Our review is broader and governance-focused — it asks whether the right oversight, policies, and controls exist and are actually followed, not only whether a specific system has an exploitable flaw.

Because the consequences that matter most for most Indian businesses are statutory and financial-reporting consequences, not purely technical ones — a qualified Internal Financial Controls opinion, a missed CERT-In reporting deadline, a DPDP Act non-compliance, or an investor due-diligence red flag. We review technology risk through the same statutory-consequence lens we apply to every other compliance area, because that lens is what determines whether a finding is a genuine priority or a lower-order technical observation. We work alongside specialist technical security partners for deep technical testing, incorporating their findings into the broader governance picture.

There is no single statute that mandates 'an IT Governance & Compliance Review' by that name for most companies. However, several underlying obligations effectively require the substance of what this review covers: Section 134(5) of the Companies Act 2013 requires directors to state that internal financial controls are adequate and operating effectively, which for most companies today includes IT general controls over financial systems; CERT-In's 2022 directions impose mandatory incident reporting obligations on a broad range of entities operating IT systems in India; the DPDP Act 2023 imposes data-fiduciary obligations on entities processing personal data of individuals in India, with rules and enforcement mechanisms continuing to be operationalised; and regulated entities (NBFCs, payment aggregators, and others) face specific RBI or SEBI IT governance and cybersecurity circular requirements. The review itself is not mandated by name, but the underlying compliance it verifies substantially is.

Yes — this is one of the most common and direct triggers for this engagement. We review the specific IT general controls your auditor tested (access provisioning and revocation, change management approval, backup and recovery, segregation of duties in system permissions) and design a remediation plan that directly addresses the auditor's observations, so the following year's audit does not repeat the same finding.

COBIT (Control Objectives for Information and Related Technologies) is a widely referenced IT governance and management framework, maintained by ISACA, that structures how an organisation should govern technology decisions, manage risk, and measure performance against business objectives. It is commonly used by internal and external auditors as a reference point when assessing IT governance maturity. While large enterprises often adopt COBIT formally and comprehensively, mid-sized businesses benefit from applying its core governance principles — clear ownership, documented processes, measurable controls — proportionately, without needing the full enterprise-scale implementation.

ISO/IEC 27001 is the internationally recognised standard for an Information Security Management System (ISMS) — a systematic approach to managing sensitive company and customer information so that it remains secure. Certification against ISO 27001 requires an audit by an accredited certification body, which PNPC is not; PNPC's role is to conduct a readiness gap assessment, help remediate identified gaps, and prepare your documentation and controls so that when you do engage a certification body, the Stage 1 and Stage 2 audits proceed smoothly rather than surfacing gaps for the first time.

The DPDP Act 2023 is India's principal data protection statute, establishing obligations for entities (termed 'Data Fiduciaries') that determine the purpose and means of processing personal data of individuals ('Data Principals') in India. Core obligations include obtaining valid consent (or relying on specified legitimate uses), limiting processing to the stated purpose, implementing reasonable security safeguards to prevent personal data breaches, and notifying the Data Protection Board and affected individuals in the event of a breach, in the manner and timeline the rules prescribe. The Act's detailed rules and the Data Protection Board's operational framework have continued to be finalised and phased in since the Act's passage, so specific compliance timelines and enforcement mechanics should be verified as current at the time of your review rather than assumed static.

CERT-In (the Indian Computer Emergency Response Team) issued directions in 2022 under Section 70B of the Information Technology Act 2000 that require a broad category of entities to report specified types of cybersecurity incidents to CERT-In within six hours of noticing the incident or being brought to notice of the incident, and to maintain certain logs for a prescribed retention period. The categories of reportable incidents include data breaches, ransomware attacks, unauthorised access to critical systems, and several other specified event types. This is a genuinely time-bound obligation — most organisations without a documented incident response plan have no practical way to identify, escalate, and report within that window.

Yes, where relevant to your specific regulatory status. RBI and SEBI have issued sector-specific circulars addressing IT governance, cybersecurity frameworks, outsourcing of IT services, and business continuity for regulated entities — the specific requirements vary meaningfully by the type of regulated entity and the applicable circular in force. We scope the review to include the specific circular(s) applicable to your registration category as part of the initial framework-selection stage, rather than treating regulated entities the same as unregulated businesses.

Section 134(5)(e) of the Companies Act 2013 requires directors of most companies to state in the Board's report that the company has adequate internal financial controls in place and that such controls were operating effectively during the year. Where financial reporting relies on IT systems (which is the case for virtually every company today), IT general controls — access management, change management, backup and recovery — form part of what the statutory auditor tests and what the Board is certifying. Our review directly supports this certification by identifying and helping remediate IT general control weaknesses before they surface as an audit finding or, worse, an inaccurate Board certification.

A full review — scoping, governance structure review, policy and access control assessment, data protection and vendor risk review, business continuity and incident response review, and a risk-rated findings report — typically takes 6–8 weeks for a mid-sized single-entity business. A narrower, scope-limited review focused on a single area (for example, DPDP Act readiness only, or IT general controls linked to the IFC assessment only) can typically be completed in 3–4 weeks. Multi-entity, multi-jurisdiction, or regulated-sector engagements generally take longer.

A structured, risk-rated findings report where every finding is explicitly mapped to the specific standard or regulation it relates to (an ISO 27001 control clause, a DPDP Act obligation, a CERT-In direction, a Companies Act IFC control objective), together with a prioritised, realistic remediation roadmap. We also run a management response workshop with your leadership team or Board/Audit Committee to agree remediation ownership and timelines — the documented management response itself becomes part of your governance evidence trail for future audits or due diligence.

Both, depending on the engagement scope agreed. For policy drafting, access control workflow redesign, and governance documentation, PNPC typically leads the work directly. For hands-on technical implementation (configuring specific security tooling, network-level changes, application code changes), we coordinate with your internal IT team or a technical implementation partner and validate the result against the agreed control design — similar to how we approach implementation oversight in our broader Digital Transformation Advisory engagements.

Fees depend on scope — a full review across all areas (governance, access control, data protection, vendor risk, business continuity, incident response) for a mid-sized single-entity business is typically a fixed fee agreed upfront based on organisational size and system complexity. A narrower, scope-limited review costs proportionately less. Remediation support, where in scope, is generally structured as an additional phase, either fixed-fee or milestone-based. We provide a written scope and fee proposal before any engagement begins — there is no standard published price because system complexity and regulatory exposure vary significantly by business.

It can be, particularly if you are approaching a funding round (investors increasingly ask data-room questions about data protection and access control practices), if you process any meaningful volume of customer personal data, or if you are preparing for your first statutory audit. For a genuinely early-stage business with minimal data sensitivity and no near-term funding or audit trigger, a lighter-touch review — focused on the highest-risk areas only — may be more proportionate than the full engagement, and we will scope it that way rather than oversell.

Access control weaknesses — specifically, financial and customer-data systems where access is not provisioned through a documented approval process, where former employees' access is not promptly revoked, and where privileged/administrative access is not separately logged or restricted. This single control area is consistently the most common finding across both statutory audit IFC testing and our broader governance reviews, and it is often the fastest and least costly gap to remediate relative to the risk it represents.

Yes, as part of the third-party and vendor risk review. We assess your configuration and usage of cloud infrastructure (not the cloud provider's own infrastructure security, which is the provider's responsibility under the shared-responsibility model most cloud providers operate) — access management to your cloud accounts, data residency and storage location, backup configuration, and whether security certifications held by the provider are relevant to your specific compliance needs (for example, data residency requirements that may apply to certain regulated sectors).

No. If we identify a genuinely urgent gap during the review — for example, an active unpatched vulnerability in production, a completely absent access revocation process, or evidence of an unreported incident that may meet CERT-In's reporting threshold — we flag it immediately to management, not at the final report stage. Time-sensitive findings, particularly anything with a statutory reporting clock attached, are escalated as soon as identified.

Yes, though the immediate incident response itself (containment, technical investigation, and any required CERT-In notification) is typically a more urgent, time-boxed engagement than the standard governance review. We can support the immediate response — assessing reporting obligations and coordinating with technical incident responders — and then, once the immediate incident is contained, conduct a focused post-incident governance review to identify and remediate the underlying control gaps that allowed the incident to occur.

Yes — with offices in Chennai, Bangalore, Hyderabad, and Dubai, we assess both the Indian entity's obligations (DPDP Act, CERT-In, Companies Act IFC linkage, RBI/SEBI circulars where applicable) and, where the UAE entity is in scope, relevant UAE data protection requirements (including obligations under UAE federal data protection law and any applicable free zone-specific data protection regulations, such as those in DIFC or ADGM, which differ from UAE mainland requirements). Cross-border data transfer between the two entities is specifically assessed, since it carries distinct compliance considerations on both sides.

It should be repeated periodically — we recommend at least an annual review, and additionally whenever a significant trigger occurs: a new core system is adopted, a new jurisdiction of operation is added, a significant regulatory update is issued (a new DPDP Act rule, an updated CERT-In direction, a new RBI/SEBI circular), or a security incident occurs. IT governance frameworks and the underlying regulatory landscape continue to evolve, and a governance posture assessed once and never revisited becomes stale.

The engagement is led by a practising Chartered Accountant with experience across statutory audit, Internal Financial Controls testing, and technology governance, supported where needed by team members with hands-on IT and information security assessment experience. Where PNPC is also your statutory auditor, we coordinate (subject to the independence requirements applicable to statutory audit engagements) so that IT general control findings inform, rather than duplicate, the audit's own IFC testing.

Yes, indirectly. Cyber insurance underwriters increasingly ask detailed questions about access controls, incident response readiness, backup practices, and data protection measures as part of underwriting and premium determination. A documented governance review with evidence of remediated gaps can materially strengthen a cyber insurance application and may support more favourable underwriting terms, though PNPC does not itself arrange or broker insurance policies.

Digital Transformation Advisory is forward-looking — it helps you plan, sequence, and implement new systems and process automation, with governance and control design built in from the start. IT Governance & Compliance Reviews are assessment-focused — they evaluate your existing environment (new or old) against governance frameworks and statutory obligations and produce a remediation roadmap. In practice the two are complementary: a governance review often surfaces the need for a broader systems transformation, and a transformation project should incorporate governance and control design as a core workstream, which our transformation advisory already does.

Primarily digital and logical controls — access management, data protection, network and application-level governance — since that is where the majority of statutory and regulatory risk for most Indian businesses concentrates today, particularly with widespread cloud adoption. Where a business maintains meaningful on-premise infrastructure (a server room, physical data centre, or similar), we include a proportionate physical security review of that specific environment as part of the broader scoping discussion.

Our responsibility is to deliver an accurate, professionally rigorous assessment and a realistic remediation roadmap, and to be clear and direct with your Board or leadership about the risk of unaddressed findings — including flagging genuinely urgent items outside the normal reporting cadence, as noted above. We do not have an ongoing monitoring or enforcement role beyond the engagement scope agreed; if remediation is not acted on, that is a management and Board decision and risk-acceptance matter, which we document clearly so it is an informed decision rather than an overlooked one.

Yes, particularly where the organisation processes beneficiary personal data (which can include sensitive categories depending on the nature of the NGO's work) or handles donor payment information. NGOs are not exempt from DPDP Act obligations simply by virtue of their non-profit status where they process personal data as a data fiduciary, and donor and grant-funder due diligence increasingly asks about data protection practices. We scope these reviews proportionately to the NGO's actual scale and data sensitivity.

We treat the frameworks and regulatory references used in each review as a living reference set, updated at the time of each engagement — ISO 27001 and COBIT are periodically revised, DPDP Act rules and Data Protection Board guidance continue to be operationalised, CERT-In directions are refreshed, and RBI/SEBI circulars are updated regularly for regulated sectors. Every engagement begins by confirming the current, applicable version of each relevant standard or regulation, rather than relying on a static internal checklist that may reference an outdated version.

IT security is the set of technical and procedural measures that protect systems and data from unauthorised access, loss, or disruption — firewalls, encryption, patching, access controls. IT governance is the broader oversight layer that decides how security (and technology generally) is planned, resourced, measured, and accounted for at the Board and management level, and ensures the organisation can demonstrate that oversight to a regulator or auditor. You need both, and they are not substitutes for each other — strong technical security with no governance oversight leaves the Board unable to demonstrate accountability; strong governance language with weak underlying technical security is equally exposed. Our review sits primarily in the governance layer, informed by technical security findings where available.

Yes — this is a common trigger for larger, later-stage clients. A company preparing for a public listing faces materially higher governance expectations, including more rigorous IFC certification scrutiny, SEBI Listing Obligations and Disclosure Requirements (LODR) considerations relevant to technology risk disclosure, and heightened investor and analyst attention to cybersecurity and data governance practices. We scope IPO-readiness IT governance reviews specifically around the elevated standard a listed company (and its Audit Committee) is expected to meet, distinct from the standard private-company review.

Yes, as part of the broader access control and incident-readiness assessment — email remains one of the most common initial attack vectors for the kinds of incidents that trigger CERT-In reporting obligations and data breaches. We assess whether basic email authentication controls (SPF, DKIM, DMARC configuration), multi-factor authentication on email accounts, and staff awareness/training practices are in place, though a full technical phishing-simulation exercise is a more specialised technical engagement we can recommend a partner for if warranted.

We assess whether a BYOD policy exists, whether it addresses access to company email, financial systems, and customer data from personal devices, and whether basic controls (device passcodes, remote-wipe capability for company data, restrictions on storing sensitive data locally) are in place or even feasible given your current tooling. BYOD is common in Indian mid-sized businesses and startups, and it is frequently an unaddressed gap precisely because it does not involve company-owned hardware and so does not appear on a typical asset inventory.

This is a common post-funding scenario, and we typically prioritise it for rapid turnaround — a focused review addressing the specific conditions or representations in the investment/shareholders' agreement (rather than the full end-to-end review) can often be scoped and delivered within 3–4 weeks, depending on the specific commitments made in the funding documents and the current state of your systems.