Stage I: Audit Preparation

The objective of this phase is to structure and plan all activities associated with the audit and to develop an initial audit plan, which must later be reviewed and approved by the parties involved.

A preliminary audit schedule will be presented below, along with a sample work agenda, which will serve as a reference for organizing and coordinating the planned tasks.

Once this initial audit plan has been defined and validated, a date will be proposed for the kick‑off meeting, during which the start of the process will be formalized and the objectives, expectations, and responsibilities of all participants will be aligned.

Stage II: Kick‑off Meeting

The date on which this meeting is held will be considered the official start of the audit. In addition, three key objectives will be addressed during the session:

• Confirm the final scope of the audit, ensuring that it aligns with what has been defined and expected by all parties.

• Present and explain the phases of the audit process to all participants, ensuring a shared understanding of the approach and planned activities.

• Finalize the audit plan and identify key stakeholders, defining responsibilities and points of contact to ensure the proper execution of the work.

Stage I: Document Review

This stage involves a thorough examination of the regulatory framework applicable to the 3DS environment, including policies, procedures, operational guidelines, reports, and any other relevant documentation.

To ensure the proper execution of this phase, it is essential to have all current regulatory documentation available from the beginning of the audit.

As a result of this stage, any potential non‑conformities related to the PCI 3DS regulatory framework will be identified.

Stage II: Procedural Review

In this stage, the main objective is to validate—through data‑gathering meetings—that the procedures described in the documentation developed to meet the applicable 3DS requirements are being executed correctly and in accordance with what has been established.

The outcome of this stage will be the identification of any potential non‑conformities related to the execution of the 3DS‑related procedures within the scope of the audit.

Stage III: Technical Reviews

The objective of this stage is to validate—through technical reviews—that the configurations described in the documentation developed to meet the applicable 3DS requirements, and which apply to the assessed organizations, are correctly implemented.

As in the procedural review stage, the execution of the technical reviews must be carried out in accordance with the established audit plan.

Stage IV: Follow‑up and Remediation of Non‑Conformities

At the end of each audit stage, a follow‑up sheet will be sent containing all identified non‑conformities. Once the audit has been completed, and depending on the receipt of remediation evidence, updated versions of the follow‑up sheet will be issued.

Stage I: Development of Compliance Documentation

This stage begins once all non‑conformities identified during the audit process have been resolved. Its purpose is to complete all documentation required to formally validate compliance, including:

• Report on Compliance (RoC)

• Attestation of Compliance (AoC)

Both documents constitute the final evidence of compliance and will be prepared in accordance with the requirements established for certification.

Etapa II: QA de Documentos de Cumplimiento

Una vez finalizada la elaboración de los documentos relativos a la validación del cumplimiento. Se realizará una revisión independiente para verificar que dichos documentos cumplen los estándares de calidad establecidos.

All documentation demonstrating compliance with the 3DS requirements within the defined audit scope will be delivered.