One Evidence Model for a Fintech Lender
Four frameworks mapped to one control set, with audit evidence requests down by two thirds.
Client name withheld by agreement- Client
- Digital lending platform
- Region
- Dallas, Texas
- Year
- 2025 · Ongoing
- Duration
- 24 weeks
- Scope
- SOC 1, SOC 2, PCI DSS and ISO/IEC 27001
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A digital lending platform answered to SOC 1, SOC 2, PCI DSS and ISO/IEC 27001, each with its own auditor, spreadsheet and evidence requests. The same engineers were asked for the same screenshots four times a year.
Compliance was eating product time, and growth into new markets would only add more frameworks.
What we did
The approach, step by step.
- 01
One control set
We rationalized hundreds of overlapping requirements into a single set of controls owned by named people.
- 02
Evidence collected once
Automated evidence from cloud, identity and ticketing systems, tagged to every framework it satisfies.
- 03
Audit calendar aligned
Observation periods and fieldwork aligned so auditors share evidence instead of repeating requests.
- 04
Continuous assurance
Control health dashboards that show drift as it happens, not at audit time.
Outcomes
What changed, in numbers.
- 4
- frameworks on one control set
- 67%
- fewer audit evidence requests
- 1
- evidence library for every auditor
- Weeks
- of engineering time returned each quarter
Audits stopped being a season. They became a dashboard.
Related engagements
More work in Offensive Security & Resilience.
-
United States · 8 weeks
Offensive Security & Resilience · 2025Pre-Peak Penetration Testing for a National RetailerTwo critical payment-page exposures found and fixed six weeks before holiday trading.
-
Gulf Coast, U.S. · 20 weeks
Offensive Security & Resilience · 2024OT-Safe Ransomware Resilience for an Energy UtilityRecovery time for core systems proven at under 18 hours, without touching live operations.
-
United States · 10 weeks
Offensive Security & Resilience · 2024Business Continuity and Crisis Exercise for an InsurerA board-level crisis exercise that exposed and closed four single points of failure.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.