Challenge
The institution faced an upcoming State Bank of Pakistan review. Its technology risks were tracked in spreadsheets, controls were not mapped to regulatory requirements, and the board received no consistent view of technology risk.
What we did
- Mapped SBP technology and cyber security requirements to existing policies and controls, and identified gaps.
- Built an ISO 31000-aligned risk framework with risk appetite, a central risk register and key risk indicators.
- Designed a control library aligned to COBIT 2019 and the Three Lines Model, with clear ownership.
- Created a board-level KRI dashboard and a prioritised remediation roadmap.
Outcome
Management entered the regulatory review with documented evidence, owned controls and a remediation plan. The board now receives regular, decision-ready risk reporting.
Client names and identifying details are withheld to protect confidentiality.
All case studies