The following important criteria need to be addressed as part of this audit.

• Data Elements Related to Payments - The auditor should examine all data elements and determine whether they are related to payments or not. Data about customers, transactions, sensitive payments, and payment credentials should all be included. Each component has to be classified according to the applicable jurisdictions and whether or not the information has been returned to India.
• A full flowchart of the transaction and data must be included in the report for all transaction types, including cross-border transactions. The flow of a transaction across the various parts of the programme should be shown in the figure.
• Application Architecture - To demonstrate the components and modules of the application, a thorough diagram of the application architecture must be included in the report.
• Network Diagram - A thorough depiction of the network architecture must include the necessary hardware for both main and backup sites, as well as CBS, if applicable.
• Transaction processing: The auditor should determine if certain components of a transaction are processed in India and elsewhere. The auditor must also determine if the cleansing procedure and policy are clear and adhere to RBI regulations.
• Actions after Payment Processing - The auditor must identify activities such as settlements that occur after payment processing and determine whether they take place within or outside of India.
• Cross-border Dealings Database Storage and Maintenance - The auditor must confirm the existence of cross-border transactions in the application, whether they are supported or taking place.
• Data Backup and Restoration - The auditor must confirm that the stated payment data backup and restoration complies with the rules.
• Data security - To make sure transaction data is protected, security procedures must be examined. This comprises common data security measures including database access monitoring, data leakage prevention, encryption, and masking.
• Access Management - If data is accessed outside of India for purposes such as data analytics, chargebacks, customer service, or dispute resolution, the authorization levels and access levels allowed should follow the established procedures and regulations.