Our role: The final statutory audit report for this requirement must be issued by a CERT-In empanelled auditor. Rakvora prepares you for it — pre-audit assessment, VAPT, remediation support and evidence — so the statutory audit closes quickly and cleanly.
RBI requires payment system operators to store the entire data relating to payment systems only in India and to submit a system audit report confirming compliance.
We map your payment data flows, storage locations, backups and third-party processors to confirm data stays in India, and help you fix any gaps before the statutory audit.
Objectives
- Map payment data flows end to end
- Verify storage, backup and DR locations
- Review third-party and cloud processors
- Prepare evidence for the system audit report
Methodology
01
Scoping
- Confirm the applicable regulation, circulars and in-scope systems
- Agree timelines against your regulatory deadline
02
Pre-audit assessment
- Control-by-control review against the regulatory checklist
- Vulnerability assessment and penetration testing of in-scope systems
03
Remediation
- Prioritised fix plan with owners and dates
- Hands-on support closing gaps and updating policies
04
Audit readiness
- Evidence pack organised to the auditor's checklist
- Support during the statutory audit and closure of observations
Deliverables
Pre-audit gap assessment report
VAPT report with retest
Remediation tracker
Evidence pack for the statutory auditor