1. Document Control

• Document Title: Internal Audit Policy

• Document Identifier: POL-ALL-013

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Audit Executive>

• Approved By: <Audit and Risk Committee>

2. Purpose

The purpose of this Internal Audit Policy is to define the framework, responsibilities, and methodology used by to plan and execute independent, objective assessments of the organization’s internal controls, risk management practices, and compliance posture.

Internal audits play a vital role in verifying that operational and security controls are functioning effectively, that compliance with regulatory requirements is maintained, and that organizational goals are supported through sound governance. This policy supports ISO/IEC 27001:2022 Control A.5.36 and SOC 2 Trust Criteria CC4.1 and CC4.2, which require systematic review and assessment of control effectiveness and risk management mechanisms.

3. Scope

This policy applies to all departments, functions, and business units within , including those managed by third parties or under outsourcing agreements. It encompasses:

• Financial, operational, IT, and compliance audits

• Risk-based audits driven by business priorities or regulatory requirements

• System, process, and control assessments

• Follow-up reviews on prior audit findings and remediation

The policy governs both scheduled (annual/quarterly) and ad hoc audits triggered by incidents or control failures.

4. Policy Statement

shall maintain an Internal Audit function that is:

1. Independent and Objective: Auditors shall report to the Audit and Risk Committee and operate independently from the areas they review.

2. Risk-Based: Audit planning will prioritize high-risk areas based on enterprise risk assessments and regulatory obligations.

3. Systematic and Documented: All audits must follow documented methodology including planning, execution, reporting, and follow-up.

4. Evidence-Based: Audit findings must be substantiated with documented observations and supported by verifiable evidence.

5. Continuous Improvement-Oriented: Audits must highlight control gaps and drive measurable remediation actions.

Internal audit results shall be reported to executive management and used to inform risk treatment, compliance monitoring, and policy updates.

5. Safeguards

enforces the following internal audit safeguards: