Five scoping questions before you commission an audit

Commissioning a financial audit of a treasury management application works best when both sides share the same picture of scope. These five questions are the ones we ask — and the ones you should be ready to answer — before fees are fixed.

1. Which question should the report answer?

“Are payment controls operating?” is a different engagement from “Can we go live next month?” Naming the question early prevents a report that is thorough but aimed at the wrong audience.

2. How many entities share the application?

Shared platforms often hide entity-level permission mistakes. If three subsidiaries use one instance, say so; sampling and access review both expand.

3. Which modules actually book and move money?

Payments, deals, liquidity, and bank connectivity each carry different evidence needs. Unused modules can stay out of scope if they truly have no live activity.

4. What access can you give us?

Supervised on-screen access, read-only roles, or extract packages all work — but they change the calendar. Decide early so fieldwork is not idle waiting for credentials.

5. What already worries your team?

Known workarounds save time. If night staff sometimes release payments on a shared login during bank outages, tell us before we discover it in the logs.

Bring answers to these five points to a scoping call, and the engagement letter will read like a plan rather than a hope.