IIA-aligned internal audit for IT, security and compliance.
We run or augment your internal audit function for IT, cyber, data privacy and regulatory compliance — aligned to IIA standards and integrated with your three-lines model.
Seasoned consulting leader with 35+ years of experience in IT audit, compliance and digital transformation. Held leadership roles at KPMG (Technical Director, IT Audit & Assurance — 9+ years) and Wipro Consulting before joining MAST.
Context, scope, delivery and impact — written for buyers, boards, auditors and search engines alike.
Internal audit functions in regulated organisations face widening scope — IT, cyber, cloud, AI, third-party, data privacy — at a pace that internal teams trained primarily in financial audit struggle to keep up with.
Coverage includes IT general controls (ITGC), application controls, cybersecurity, cloud (AWS/Azure/GCP), data privacy (GDPR, UAE PDPL, KSA PDPL, DPDPA), third-party risk, regulatory compliance (CBUAE, SAMA, NCA, RBI, SEBI), business continuity and disaster recovery, AI governance, change management, identity and access, and project audits.
Audits are scoped from a risk-based annual plan tied to your enterprise risk register, executed quarterly with documented working papers, reported to the audit committee using your existing format, and tracked through issue closure in your GRC tool (TeamMate+, AuditBoard, ServiceNow IA, Workiva).
Audit plan delivered on time, findings rated and reported consistently, management actions tracked to closure, and audit committee meetings supported with clear narrative and evidence.
A visual breakdown of how the engagement runs, what evidence we leave behind, and the business outcomes you can defend at the board.
Enterprise-risk-aligned annual audit plan.
Quarterly audits across IT, cyber, privacy and compliance.
Audit committee reporting and KPI dashboards.
Management action tracking and validation.
What an IIA-aligned IT and cyber internal audit function delivers — what the audit committee and external assurance providers will rely on.
Approved by the audit committee, defining independence, scope and reporting line.
Annual plan tied to the enterprise risk register with rolling 3-year coverage.
Scoping memo, risk-and-control matrix, test scripts and evidence per audit.
Findings, themes and management action status communicated quarterly.
Issues tracked to closure with re-testing of material remediation.
Data-driven testing of access, change and transactions between cycles.
Internal and external assessments aligned to IIA Standard 1300.
Combined-assurance map avoiding duplication and gaps.
Independent, IIA-aligned assurance over IT, cyber, privacy and compliance risk.
External auditors lean on internal-audit work, reducing fieldwork and cost.
Access to IT, cyber and AI audit specialists on demand.
Co-sourced augmentation or fully outsourced function — scaled to risk.
Findings and remediation tracked to regulator-visible closure.
One audit map across business, second-line and third-line activity.
Both. We provide specialist IT and cyber audit capacity alongside your internal team, or run the full function for organisations without one.
Yes — our lead auditors hold CIA, CISA, CISM, CRISC, ISO 27001 LA / LI and CISSP credentials, with sector specialisation in financial services, healthcare, energy and government.
Yes — co-sourcing is our most common engagement model. We provide specialist capacity (IT, cyber, AI, cloud) under your CAE's audit plan.
We build the annual audit plan from the enterprise risk register and re-baseline quarterly so emerging risks (AI, third-party, regulator change) receive proportionate coverage.
Co-sourced: from USD 60k/year for specialist top-up. Fully outsourced: from USD 180k/year depending on plan size and entity count.
Yes — our work is delivered to IIA standards and is accepted by CBUAE, SAMA, RBI and DFSA as the regulated entity's internal audit function.
Yes — individual audits (cyber, cloud, AI governance, third-party) are available on a fixed-fee basis without a full outsourced retainer.
Most clients combine this engagement with one or more of the services below — a natural next step once foundations are in place.
End-to-end audit across IT operations, security, risk and compliance.
Independent technical and process audit of your security controls.
One integrated control framework instead of duplicated audits.
Outsource the day-to-day running of your compliance programme.
Direct links into the relevant clauses, controls and regulator obligations covered by this engagement.
Info & Cyber Security
Assurance & Attestation
Central Bank of the UAE · United Arab Emirates
Saudi Central Bank (SAMA) · Saudi Arabia
Methodology, deliverables, week-by-week timeline, pricing models, industry context, tooling and extended FAQs — each on its own page for fast reference and deep linking.
Tell us a little about your business — a senior consultant will reach out within one business day.
