Description

A focused course, tailored for you

The Senior Audit Manager PCI DSS v4.0.1 Scoping Playbook

Twelve modules that turn the acquirer/issuer/merchant CDE scoping exercise into a defensible workpaper set the QSA signs without rework.

Your QSA keeps redlining the CDE scoping memo because the v3.2.1 boundary diagrams, the v4.0.1 targeted risk analyses, and the customised-approach control narratives do not reconcile, and every redline costs two weeks of engineering time.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Senior Audit Managers running PCI work inside a global payment processor sit at the intersection of three different cardholder data environments. The acquirer-processing platform handles merchant transaction flows. The issuer-processing platform handles card-not-present authorisations, tokenisation services, and fraud screening. The merchant-services platform handles POS device management, gateway routing, and chargeback workflows. Each one has its own segmentation story, its own custodianship of cryptographic keys, its own service-provider dependencies. PCI DSS v4.0.1 raised the bar on three things at once: customised approach controls require a Targeted Risk Analysis with documented rationale, the sampling rules for service providers changed, and the in-scope determination for cryptographic key custodians tightened. The scoping memo that sat clean under v3.2.1 now reads as incomplete to the QSA, and the redline cycle eats the runway you needed for SOX testing and the internal audit plan refresh. The job is not to rewrite the whole memo. The job is to assemble four artefacts the QSA accepts on first pass: a CDE boundary register, a targeted risk analysis template, a customised approach control matrix, and a segmentation test plan. The course builds those artefacts, walks through the evidence each one needs, and gives you templates engineering can execute without escalation.

What you walk away with

A CDE boundary register that reconciles acquirer, issuer-processing, and merchant-services data flows in a single workpaper.
A targeted risk analysis template that survives the QSA's first review without rework.
A customised approach control matrix that maps each chosen control back to the defined approach equivalent.
A segmentation test plan that the network team can execute end-to-end without the audit manager in the room.
A defensible service-provider sampling rationale aligned to the v4.0.1 sampling rules.

The 12 modules

Module 1. The Three-Platform CDE Story for a Payment Processor

How acquirer, issuer-processing, and merchant-services CDEs differ in data flow, key custodianship, and service-provider dependencies. Walks through how to write the narrative that the QSA reads first, what level of detail the v4.0.1 ROC template expects, and where the v3.2.1 memo typically falls short. Includes a worked example narrative for a multi-region processor and the supporting data-flow diagrams that the boundary register references.

Module 2. Boundary Register Workpaper From First Principles

Build the CDE boundary register that lists every system component in scope, the rationale for inclusion, the connected-to-but-not-in-scope systems, and the segmentation control that keeps them separated. Walks through the column structure that survives QSA review, how to handle shared services like SIEM and IAM, and how to source the underlying inventory from CMDB exports without taking three weeks of engineering time.

Module 3. Targeted Risk Analysis Templates That Survive First Review

The v4.0.1 customised approach requires a documented TRA per chosen control. Walks through the four-section TRA template that QSAs accept on first pass, the rationale language that holds up under scrutiny, and the supporting evidence the QSA expects to see referenced. Includes filled examples for the most common customised approach choices in payment processing, including key rotation cadence, MFA implementation, and log retention.

Module 4. Customised Approach Control Matrix

Map every chosen customised approach control back to its defined approach equivalent in a matrix the audit committee can read. Walks through the matrix structure, the test procedures that go alongside, and the workpaper cross-references that connect the matrix to the TRA and the boundary register. Includes the matrix for the twelve most common customised approach choices a payment processor makes.

Module 5. Segmentation Test Plan the Network Team Can Run Alone

PCI DSS v4.0.1 requires segmentation testing every six months for service providers. Walks through the test plan structure, the in-scope flow definitions, the expected results format, and the evidence the network team needs to capture for each test. Includes a test plan template that engineering can execute without the audit manager attending each test, and the QSA-facing report structure that confirms the segmentation control objective is met.

Module 6. Service-Provider Sampling Under v4.0.1

The sampling rules changed. Walks through how to justify the service-provider sample to the QSA, how to handle shared-service-provider arrangements like cloud infrastructure and managed SIEM, and how to document the rationale for inclusion or exclusion of each. Includes the sampling justification memo template and the supporting workpapers that link to the service-provider inventory.

Module 7. Cryptographic Key Custodianship in v4.0.1 Scope

Tokenisation, HSM operations, and key custodian roles are scoped tighter under v4.0.1. Walks through which key custodian roles fall in scope for the issuer-processing and merchant-services platforms, how to evidence dual control and split knowledge, and how to write the cryptographic architecture description the QSA needs. Includes a key custodian inventory template and the supporting role-attestation forms.

Module 8. Multi-Region Scoping for Acquirer Operations

Acquirer platforms typically span multiple processing regions with different settlement currencies and regulator-driven controls. Walks through how to scope the multi-region CDE without writing five separate scoping memos, how to handle region-specific controls like SCA in Europe and EMVCo CO-EMV in other markets, and how to reconcile the region-specific evidence into a single ROC. Includes the multi-region scoping appendix template.

Module 9. Issuer-Processing CDE Walkthrough

Issuer-processing handles card-not-present authorisations, 3DS routing, tokenisation services, and fraud screening. Walks through how to scope the authorisation host, the tokenisation vault, the fraud-screening engine, and the connected fraud-data feeds. Includes the data-flow diagram set for a typical issuer-processing platform and the boundary register entries that go with each.

Module 10. Merchant-Services CDE Walkthrough

Merchant-services handles POS device fleet, gateway routing, chargeback workflows, and merchant onboarding. Walks through how to scope the POS device management platform, the payment gateway, the chargeback workflow engine, and the merchant onboarding system. Includes the data-flow diagrams, the boundary register entries, and the service-provider mappings for a typical merchant-services stack.

Module 11. Evidence Cross-Reference Pack for the QSA

The QSA reads workpapers, not narratives. Walks through how to assemble the evidence cross-reference pack that points each ROC requirement to the boundary register entry, the TRA, the customised approach matrix row, and the segmentation test result that supports it. Includes the cross-reference pack template and the index file structure that drops cleanly into the QSA's audit evidence platform.

Module 12. The Internal Audit Plan Refresh That Follows the ROC

Once the ROC is signed, the internal audit plan refresh follows. Walks through how to translate the customised approach decisions into the next year's internal audit plan, how to brief the Audit Committee on the v4.0.1 transition without losing them in jargon, and how to set up the continuous monitoring controls that catch boundary drift before the next scoping memo. Includes the Audit Committee briefing slide pack template and the continuous-monitoring control catalogue.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 1 lands the moment the QSA asks why the v3.2.1 narrative no longer reads correctly.

Modules 2 through 5 are the four artefacts the QSA wants to see on first pass.

Modules 6 through 10 are the platform-specific walkthroughs that turn the artefacts into platform-defensible workpapers.

Modules 11 and 12 close the loop with the QSA evidence pack and the internal audit plan refresh that follows.

What you get with this course

All twelve module documents in the Art of Service learning environment.
Downloadable boundary register, TRA, customised approach matrix, and segmentation test plan templates.
Filled worked examples for acquirer, issuer-processing, and merchant-services CDEs.
The hand-built implementation playbook tailored to the buyer's CDE structure, delivered alongside course access.
Audit Committee briefing slide pack template for the v4.0.1 transition.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours, account in the learning environment is provisioned and the implementation playbook is delivered alongside it.

Modules 1 through 5 are typically worked through in the first week.

Platform walkthrough modules 6 through 10 fit the cadence of the segmentation testing schedule.

Modules 11 and 12 align to the post-ROC Audit Committee briefing cycle.

Before and after

Before

Scoping memo redlined by the QSA, the boundary diagram and the TRA do not reconcile, engineering reruns segmentation tests twice, and the audit plan slips two weeks while the next deadline closes in.

After

Boundary register, TRA, customised approach matrix, and segmentation test plan land on the QSA's desk as a single coherent pack, the first review comes back with clarifications not redlines, and the audit plan holds its original calendar.

What happens if you do not address this

If the scoping memo keeps getting redlined, the ROC delivery date slips. If the ROC slips, the card brand attestation slips. If the attestation slips, the Audit Committee gets briefed on a missed deadline and the internal audit function carries the optics for what is fundamentally a workpaper-construction problem. None of that is a control failure. It is an evidence-construction failure that the four artefacts in this course are built to prevent.

Who it is for

Senior Audit Managers and Audit Directors running PCI compliance inside large payment processors, card networks, and acquirers. People who own the relationship with the QSA, present the audit plan to the Audit Committee, and are accountable for the report-on-compliance landing on the original date in the calendar. Useful also for SOX leads at the same companies because the SOX scoping question on payment-processing controls overlaps with the PCI scoping question.

Who this is NOT for. Not for first-line engineers who run the segmentation tests but do not own the workpapers. Not for QSAs themselves, who already have AICPA and PCI SSC guidance. Not for companies still on PCI DSS v3.2.1 with no v4 transition deadline yet, because the customised approach material does not apply.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly thirty to forty hours of focused work across the twelve modules. Most senior audit managers complete it over four to six weeks alongside an active audit cycle.

Why $199 is the right number

QSA-provided guidance covers what the requirements are, not how to assemble the workpapers your specific platform mix needs. PCI SSC reference documents are normative but not template-driven. Internal training from the Big Four covers the framework, not the four artefacts. This course is the workpaper construction pack.

FAQ

Does this assume PCI DSS v4.0.1 specifically, or does v3.2.1 work?

The course is built for v4.0.1 with the customised approach, the targeted risk analysis requirement, and the revised sampling rules. The v3.2.1 audience would not get full value because the customised approach material does not apply.

Is the implementation playbook generic or tailored?

Tailored to the buyer's CDE structure and platform mix. Hand-built within 24 hours of purchase.

Does the course cover the Audit Committee briefing?

Module 12 covers the Audit Committee briefing and includes the slide pack template.

Will the templates work for a card network or a fintech, not just a payment processor?

The boundary register and TRA templates work for any v4.0.1 entity. The platform walkthroughs in modules 8 through 10 are payment-processor specific and would need adaptation for a card network.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.