International standards pack.
Baseline international pack included with every AuditHD licence. It adds COSO internal control (2013) and enterprise risk management (2017), PCI DSS v4.0.1, ISO 22301 business continuity, ISO 37001:2025 anti-bribery, ISO/IEC 42001 AI management, ISO 9001:2026 and the FATF Recommendations to ISO/IEC 27001, ISO 9001:2015, CMMI and NIST CSF 2.0. Copyrighted standards are carried as reference numbers, short titles and AuditHD summaries only.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| ISO/IEC 27001 Information security management systems ISO/IEC · 2022 + Amd 1:2024 | Banks, Islamic banks, Microfinance, Insurers and more | 129 | Being confirmed |
| ISO 9001 Quality management systems ISO · 2015 | Banks, Insurers, Finance companies, Listed companies and more | 34 | Being confirmed |
| CMMI Model — Development and Security views ISACA / CMMI Institute · V3.0 | 27 | Being confirmed | |
| NIST Cybersecurity Framework U.S. National Institute of Standards and Technology · 2.0 (Feb 2024) | 28 | Being confirmed | |
| Internal Control — Integrated Framework Committee of Sponsoring Organizations of the Treadway Commission (COSO) · 2013 (May 2013; replaced the 1992 framework from 15 December 2014) | Banks, Islamic banks, Microfinance, Insurers and more | 22 | Source checked |
| Enterprise Risk Management — Integrating with Strategy and Performance Committee of Sponsoring Organizations of the Treadway Commission (COSO) · 2017 (June 2017); updates the 2004 ERM — Integrated Framework | Banks, Islamic banks, Microfinance, Insurers and more | 25 | Being confirmed |
| Payment Card Industry Data Security Standard: Requirements and Testing Procedures PCI Security Standards Council (PCI SSC) · v4.0.1 (June 2024) | Banks, Islamic banks, Payment providers, Finance companies and more | 84 | Source checked |
| ISO 22301 Security and resilience — Business continuity management systems — Requirements ISO (TC 292) · 2019 (2nd edition) + Amd 1:2024 (climate action changes) | Banks, Islamic banks, Microfinance, Insurers and more | 35 | Being confirmed |
| ISO 37001 Anti-bribery management systems — Requirements with guidance for use ISO (TC 309) · 2025 (2nd edition, published 28 February 2025) | Banks, Islamic banks, Microfinance, Insurers and more | 44 | Being confirmed |
| ISO/IEC 42001 Information technology — Artificial intelligence — Management system ISO/IEC (JTC 1/SC 42) · 2023 (1st edition, December 2023) | Banks, Islamic banks, Microfinance, Insurers and more | 44 | Being confirmed |
| ISO 9001 Quality management systems — Requirements ISO (TC 176/SC 2) · 2026 (6th edition, published 16 September 2026) | Banks, Islamic banks, Microfinance, Insurers and more | 32 | Source checked |
| International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation (the FATF Recommendations) Financial Action Task Force (FATF) · February 2012, as updated June 2026 | Banks, Islamic banks, Microfinance, Insurers and more | 47 | Source checked |
Checklists in the pack.
- Change Request Stage-Gate QC
- Branch Cash Operations Audit
- CMMI V3.0 Maturity Level 3 Gap Appraisal (Development)
- ISO/IEC 27001:2022 Internal Audit — Annex A
- ISO 9001 Internal Quality Audit
- NIST CSF 2.0 Current Profile
- COSO 2013 Entity-Level Controls Review
- PCI DSS v4.0.1 Readiness Assessment
- ISO 22301 BCMS Internal Audit
- ISO 37001:2025 Anti-Bribery Management Review
- ISO/IEC 42001 AI Governance Review
Regulators.
- ISO International Organization for Standardization
- COSO Committee of Sponsoring Organizations of the Treadway Commission
- PCI SSC PCI Security Standards Council
- FATF Financial Action Task Force
- NIST National Institute of Standards and Technology
- ISACA ISACA (CMMI Institute)
Who it is for
Banks, Islamic banks, Microfinance, Insurers, Finance companies, Payment providers, Exchange houses, Capital market firms, Listed companies, State-owned enterprises, Government bodies, Large enterprises, Critical infrastructure.
Regulatory calendar.
8 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| ISO management system certification surveillance audit | ISO | Every year | At least once each calendar year; the first within 12 months of the certification decision |
| ISO management system recertification audit | ISO | Every 3 years | Completed, with the certification decision, before the current certificate expires |
| PCI DSS annual compliance validation (ROC or SAQ with Attestation of Compliance) | PCI SSC | Every year | Every 12 months, by the date set by the acquirer or card brand |
| PCI DSS external vulnerability scan by an approved scanning vendor (ASV) | PCI SSC | Every quarter | Once every three months and after significant change, with rescans until a passing scan |
| PCI DSS internal vulnerability scan | PCI SSC | Every quarter | Once every three months and after significant change |
| PCI DSS internal and external penetration test | PCI SSC | Every year | At least once every 12 months and after significant infrastructure or application change |
Reporting conventions.
- Reports in English and Arabic
International standards are published in English (FATF also in French). They impose no reporting language, calendar or currency; use the client's country pack for those. Cite standards by edition, for example ISO 9001:2026 or PCI DSS v4.0.1.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. This pack is included with every licence.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.