Module 14Term 4 · Production operations

Compliance, Governance and Audit

Sign in to save your progress across devices. Until then it is kept in this browser.

This module explains frameworks for engineers. It is not legal advice; confirm obligations with qualified counsel for your jurisdiction and sector.

Why this matters

"Enterprise grade" ultimately means you can prove it. Enterprise procurement sends a security questionnaire; a regulator asks for records; an investor's diligence asks about data handling. Everything you built in M01 to M13 becomes evidence here.

Learning outcomes

  1. Build audit trails that answer who did what, when, from where, and on whose behalf.
  2. Apply data-protection principles (Singapore PDPA as the reference; GDPR comparison).
  3. Understand the structure of SOC 2 and ISO/IEC 27001 and how to collect evidence continuously.
  4. Know sector rules that apply to fintech in Singapore (MAS Technology Risk Management Guidelines, outsourcing expectations).
  5. Govern AI systems using the IMDA Model AI Governance Framework for Agentic AI, and know where the EU AI Act may apply.
  6. Answer a vendor security questionnaire with evidence.

Lessons

14.1 Audit trails

  • Append-only log of security- and business-relevant events: logins, permission changes, data exports, admin actions, money movements, agent tool calls and approvals.
  • Fields: actor (human or agent identity), on-behalf-of, action, target, before/after, timestamp (server), IP/device, request ID, outcome.
  • Tamper-evident (write-once storage, hash chaining, or a separate account), with retention rules.
  • Separate from debug logs; access to the audit log is itself audited.

14.2 Data protection: PDPA (Singapore) as the reference

Key obligations engineers implement:

  • Consent and purpose: collect only for stated purposes; record consent.
  • Access and correction: users can request their data and correct it. Build an export and edit path.
  • Protection: reasonable security arrangements (everything in M05).
  • Retention limitation: delete or anonymise when no longer needed. Build retention jobs.
  • Transfer limitation: comparable protection when data leaves Singapore (check where your cloud regions and AI providers process data).
  • Data breach notification: assess suspected breaches promptly; notify the PDPC within 3 calendar days of determining a breach is notifiable, and affected individuals where required.
  • NRIC and national ID numbers: restricted collection; mask in UI and logs.
  • Accountability: appoint a Data Protection Officer, document policies. GDPR adds stricter lawful-basis rules, a 72-hour regulator notification, data subject rights including erasure and portability, and DPIAs for high-risk processing.

Engineering patterns: data inventory/map, classification (public, internal, confidential, restricted), field-level encryption for restricted data, PII redaction in logs and in prompts sent to LLM providers, deletion that propagates to backups on a schedule, DPAs with every sub-processor (including AI vendors, with training/retention terms checked).

14.3 Security frameworks: SOC 2 and ISO/IEC 27001

  • SOC 2 (AICPA): an auditor's report on controls against the Trust Services Criteria (Security, plus optionally Availability, Processing Integrity, Confidentiality, Privacy). Type I = design at a point in time; Type II = operating effectiveness over a period (often 3 to 12 months).
  • ISO/IEC 27001:2022: a certifiable information security management system with Annex A controls (93 in the 2022 version).
  • What auditors look for maps directly to this course: access reviews, MFA, change management via PR and CI, vulnerability management, logging and monitoring, incident response, backups and restore tests, vendor management, security training, policies.
  • Use compliance automation (Vanta, Drata, Secureframe, or open-source equivalents) to collect evidence continuously from GitHub, cloud and identity providers.

14.4 Fintech in Singapore: MAS expectations

For MAS-regulated entities and their technology providers, the MAS Technology Risk Management (TRM) Guidelines set expectations on technology risk governance, secure software development, IT resilience, access control, cryptography, cyber surveillance and incident management, plus outsourcing and cloud risk. Notification timelines for relevant incidents are short; know them before you need them. If you build for a licensed institution, expect their vendor assessment to test against TRM.

14.5 AI governance

  • IMDA Model AI Governance Framework for Agentic AI (launched Jan 2026, updated May 2026): bound risks upfront; make humans meaningfully accountable with approval checkpoints; technical controls across the lifecycle; end-user transparency and training. Your M06 evidence maps here.
  • AI Verify and IMDA's LLM testing starter kit for testing practices.
  • EU AI Act: risk-tiered obligations, applying to providers and deployers serving the EU market; credit-scoring and some employment uses are high-risk. Check current timelines, as phased application dates have been subject to change.
  • ISO/IEC 42001 (AI management system) and NIST AI RMF are the enterprise reference frameworks for AI governance.
  • Maintain a model/AI register: each AI feature, its purpose, model and vendor, data used, risk class, controls, owner, eval results.

14.6 The trust package

What a serious B2B seller hands a buyer: security overview page, architecture and data-flow diagram, sub-processor list, DPA, pen-test summary, SOC 2 report or ISO certificate (or a roadmap to it), incident response and BCP summary, AI usage and governance statement, completed standard questionnaire (SIG Lite or CAIQ).

Lab 14: Pass the questionnaire

  1. Build a data map for your app: every personal data field, purpose, location, retention, who can access, which sub-processors receive it.
  2. Implement an audit log for admin actions and agent tool calls.
  3. Implement user data export and deletion.
  4. Complete a 100-question vendor security questionnaire for your app, with an evidence link for each "yes."
  5. Write a one-page AI governance statement mapped to IMDA MGF.

Definition of Done

AI prompt pack

  • "Scan the schema and code; produce a data map of every personal data field, where it flows, and which third parties receive it."
  • "Draft answers to this security questionnaire using only evidence present in the repo and configs; mark anything unsupported as a gap."