Audit strategy
Defined the IT audit universe and a risk-based multi-year plan for the global CIO function, and coached the team.
Principal Consultant · ENFTC
Emre
Tuncoglu
Technology audit & risk leader · Operational resilience · AI governance
- London, United Kingdom
- emre@enftc.co.uk
- linkedin.com/in/emretuncoglu
Profile
25 years across banking, payments, insurance, fintech and financial-market infrastructure — from building audit plans to designing the controls they test.
Former Interim Head of IT Audit – CIO Global at Aviva and Core IT Audit Director in UBS Group Internal Audit. Combines independent assurance with hands-on security architecture, operational resilience and regulatory remediation, including for payment and settlement systems. ENFTC now applies that foundation to AI governance.
Selected outcomes
Regulatory remediation
Privileged-access management for critical and payment systems. After external validation, the regulator lifted onboarding restrictions.
Secure by design
An infrastructure compliance framework built into the development lifecycle, applied across systems including payments.
Settlement assurance
Led infrastructure audit behind settlement services, reviewed SWIFT security and coordinated ISAE 3402 attestation with PwC.
Experience
Print this page (Ctrl/Cmd + P) to save as PDF
Dec 2014 – Present
Current
ENFTC — Director / Principal Consultant
Independent consultancy in technology risk, security architecture, operational resilience and regulatory compliance for financial-services firms.
Consultant workbench, 2026–present: a hosted, invite-only workbench for ISO/IEC 42001 and EU AI Act engagements, with password and authenticator sign-in — intake and AI-system inventory, requirement-level assessment, evidence, findings, remediation drafts, reports and the Statement of Applicability, plus a workspace for separately scoped internal audits. AI drafts and suggests; applicability decisions, findings and closures remain recorded human reviews. In private testing with invited users and demonstration data; it issues no certifications or automated legal decisions.
Sep 2024 – Dec 2025
Capital.com — Technology Risk & Regulatory Compliance SME
Privileged-access management for critical and payment systems. Led DORA implementation: business-service and dependency mapping with the CIO, policy uplift and automated compliance controls in CI/CD.
Nov 2023 – Feb 2024
Bupa — Technology Risk Consultant
Led validation of a major risk-remediation programme and reviewed the technology risk and controls framework against regulatory requirements.
Feb 2022 – Jul 2023
Deloitte Consulting — SME, Technology Risk & Architecture
Cyber-resilience scenario testing for a challenger bank; security-architecture assessment of an insurer's Azure migration of 2,500+ VMs; cybersecurity controls review for an algorithmic-trading fintech.
Jun 2020 – Sep 2021
UBS — Technology Risk & Security Architecture SME
Coordinated external audits across Group Technology, defined cloud-migration remediation roadmaps against MAS TRM and HKMA requirements, and closed data-protection issues.
Mar 2020 – Jun 2020
Aviva Group — Interim Head of IT Audit – CIO Global
Led global technology audit for the CIO function across infrastructure, architecture, strategy and resilience; defined the audit universe and multi-year plan.
Jan 2019 – Mar 2020
UBS — Infrastructure & Security Architect
Infrastructure compliance framework in the development lifecycle — access control, cryptography and vulnerability management across on-premise and Azure, including payment systems.
Feb 2018 – Dec 2018
UBS Group Internal Audit — Core IT Audit Director
Audits of security and regulatory compliance in system design, including Cyber Security by Design, cybersecurity governance, BCBS 239 data governance and middleware.
Mar 2015 – Dec 2017
Lloyds Banking Group — Infrastructure Security Architecture & Audit SME
Security-architecture audits across Linux, Windows, mainframe and HPE NonStop, finding critical gaps in privileged access, logging and patching.
Aug 2008 – Jan 2013
Euroclear Group — Senior IT Audit Manager
Domain lead for technology infrastructure audit across mainframe, storage and network supporting settlement. SWIFT security review and ISAE 3402 attestation with PwC.
Jul 2005 – Jul 2008
Dexia & Denizbank — Head of IT Risk & Controls
Established and led the IT risk and controls function, with frameworks aligned to banking regulation.
Earlier: KPMG UK, Technology Risk Advisory (2013–14) · Tekstilbank, IT Controls Director (2004–05) · Pamukbank, Senior IT Auditor (2001–04).
Qualifications
- CISA
- CISM
- CRISC
- CISSP
- ISO 27001 LA
- TOGAF 9.1
- PRINCE2
PECB ISO/IEC 42001 Lead Auditor — training enrolled
BSc Electrical & Electronics Engineering — METU, Ankara, 1995–2000