Internal Audit & ITGC / Cybersecurity
IT General Controls reviews, internal audit co-sourcing, and UU PDP data-protection compliance for Indonesian entities and international group requirements.
Direct Answer
ITGC (IT General Controls) audits verify access management, change control, operations, and data backup across ERP/financial systems. For PT PMAs, ITGC supports both group SOX requirements and Indonesian UU PDP data-protection compliance.
Who this is for
- PT PMAs with group-level SOX, ICFR, or Internal Audit reporting requirements
- Companies implementing or migrating ERP systems in Indonesia
- Entities subject to OJK or BAPEPAM internal audit requirements
- Companies processing personal data of Indonesian residents under UU PDP
- Boards needing independent assurance over internal controls and IT risk
- CFOs building internal audit capability for the first time in Indonesia
Problems we solve
- —Group auditors require ITGC review evidence for Indonesian entities that does not exist
- —ERP implementation has proceeded without controls documentation
- —UU PDP compliance posture has not been assessed or documented
- —Privileged access to financial systems is not reviewed or logged
- —Change management for ERP or financial systems lacks audit trail
- —No internal audit function exists and no budget to build one
Our approach
- 1
Scope and risk assessment
We define ITGC scope against your ERP landscape, financial reporting systems, and applicable frameworks (SOX, OJK, or UU PDP). We prioritize by risk and group audit requirements.
- 2
Control domain walkthrough
We conduct walkthroughs across four ITGC domains: logical access (user provisioning, privileged access, segregation of duties), change management, operations (job scheduling, backup/recovery), and third-party/vendor controls.
- 3
Control testing
We perform test of design (TOD) and test of operating effectiveness (TOE) for each in-scope control, using evidence sampling aligned to ISA/PCAOB standards.
- 4
UU PDP gap assessment
We map your personal data processing activities against UU No.27/2022 requirements — consent, purpose limitation, data subject rights, breach notification — and identify material gaps.
- 5
Reporting and remediation
We deliver a formal ITGC audit report with control deficiency ratings, root cause analysis, and a prioritized remediation roadmap. We present to management and, where required, to the audit committee.
Deliverables
Regulatory framework
Frequently asked questions
Related case studies
ITGC Review for Group ERP Migration
Conducted full-scope ITGC review during SAP ERP go-live for Indonesian subsidiary of an Indian conglomerate. Identified 47 control gaps and presented remediation roadmap to group audit committee.
47
Control gaps identified
UU PDP Gap Assessment — Financial Services PT PMA
Mapped all personal data processing activities against UU No.27/2022 and produced a compliance roadmap for OJK-supervised entity.
100%
Regulatory mapping
Ready to talk Indonesia compliance?
Partner-led response within one business day. NDA available on request.