Security auditsfor finance
Banks, insurers and fintechs in Nigeria answer to the CBN, the Nigeria Data Protection Commission and their own boards on how controls are tested. Orisynx keeps the audits, findings and corrective actions behind those answers in one place.
- Clause ISO 27001 A.5.18High
Leavers kept core banking access for over 30 days
- Clause ISO 27001 A.8.13Medium
No backup restore test at the recovery site this year
- Clause ISO 27001 A.5.20Medium
Card processor contract lacks a right-to-audit clause
The audit landscape
The CBN cybersecurity framework
The Central Bank of Nigeria's Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks was issued in 2024, with compliance required from 1 July 2024. It applies to commercial, merchant and non-interest banks and to payment service banks.
An annual self-assessment
The framework calls for an annual cybersecurity self-assessment, with the findings submitted to the CBN by 28 February each year, and further assessments when major changes occur.
Third parties and ISO 27001
Service level agreements should give the institution a right to audit its third parties or to receive their audit reports. The framework lists ISO 27001 among examples of standards a provider may need to meet, depending on the services it offers.
Data protection audit returns
Under the GAID 2025, commercial banks, insurers and fintechs are in the Ultra-High Level tier of data controllers, which file Compliance Audit Returns with the Nigeria Data Protection Commission by 31 March each year. The assessment covers third-party data processors.
- ISO 27001 internal audits of the ISMS
- Reviews of access rights, backups and logging controls
- Third-party and outsourced service provider audits
- Branch operations and process audits
- Readiness reviews for the annual cybersecurity self-assessment
- Data protection reviews ahead of compliance audit returns
- Follow-up audits on examiner and external audit findings
ISO 27001 audits in one programme
Audits can be started against ISO/IEC 27001:2022, using a template you build around your own controls and the clause structure of the standard. Each answer is recorded as in order or as an exception.
Planned audits belong to a department or site, so head office functions and branches each carry their own schedule, and progress is shown per department.
| Audit | Standard | Date | Status |
|---|---|---|---|
| Purchasing | ISO 9001 | 12 Mar | Confirmed |
| Warehouse, Leeds | ISO 45001 | 3 Apr | Scheduled |
| Kestrel Metals | Supplier | 21 May | Tentative |
| Access control | ISO 27001 | 9 Jun | Scheduled |
7 of 18 audits confirmed
Third-party audits with evidence
Supplier is an audit type, so reviews of outsourced providers sit in the same plan as internal audits. Files, links and notes can be attached as evidence to the audit, the finding and the corrective action.
When a provider's owner disagrees with an action, they dispute it with a reason, and the disagreement is settled on the record with comments kept against the action.
- XLSXsupplier-evaluations-2026.xlsxFile · J. Okafor · 22 Apr
- LINKPurchasing procedure, rev. 7Link · document library
- NOTEReview added to calendar, every 6 monthsNote · J. Okafor · 24 Apr
Task “Re-evaluate suppliers” completed
A record of who changed what
The activity log records who changed what, and when, including changes to planned audits. Roles carry permissions, an administrator can edit them, and the server checks permissions on every request.
Each organization's workspace is backed by its own database. Audit history exports to CSV, and analytics show open and overdue actions.
- CLOSEA. Mensah closed REM-0087Effectiveness: Effective · 14:02
- ROLEK. Lewis changed R. Patel’s role to AuditorUsers · 11:47
- FILEJ. Okafor attached supplier-evaluations-2026.xlsxFND-0142 · 09:15
Financial services: questions
Does Orisynx make us compliant with the CBN framework?
No software does that on its own. Orisynx keeps the audits, findings, corrective actions and evidence that show how your controls were tested and what was done about the gaps.
Does Orisynx include the Annex A controls?
No. There is no pre-loaded clause library. You build the template from your own control set, and it can follow the structure of ISO/IEC 27001:2022.
How is access to audit records controlled?
Roles carry permissions, which an administrator can edit, and the server checks permissions on every request. People are invited by email and set their own password, and the activity log records who changed what.
Can we give an examiner our audit history?
Audit history exports to CSV. Audit summary, finding trend and remediation status reports can also be created, as drafts.
Keep reading
Guides
Sources: mondaq.com, mondaq.com, mondaq.com, templars-law.com.
See it with your own audits
Bring an audit you have already run. We will walk it through Orisynx with you, from the plan to the last closed corrective action.