IT general controls
I lead the ITGC review across ERP, finance systems and infrastructure. The questions are concrete and they repeat: who can change what, who approved it, how access ends when someone leaves, how a change reaches production, and whether a restore has actually been tested.
I bring my own list of open items to the review, each with an owner and a date. A dated plan turns an open item into a schedule, and it keeps the conversation about tracking rather than trust.
AI under the same controls
AI systems are held to the controls that apply to any other system. For each request you need to know which identity it ran as, what that identity was entitled to read, and where that is logged. Prompts and outputs are treated as records. Permission checks happen when data is retrieved, not as an instruction in the prompt.
DPDP Act 2023 readiness
As interim Data Protection Officer I run readiness in the order the work actually happens:
- Records of processing. What personal data exists, in which system, for what purpose.
- Processor register and agreements. Every third party that handles personal data, with an agreement that says what they may do with it.
- Deletion designed in. The erasure path is built with the pipeline, not added later.
- The IT policy set. Dated and approved, because a draft protects nobody.
The security programme
Identity and access management, and email authentication (DMARC, SPF and DKIM) across the full domain estate. The same rule applies here as everywhere else: a control counts when there is evidence it works, not when it has been configured.