Audit Methodology

A method built around cash movement

We do not treat a treasury management application as a generic business system. Every step of our methodology follows money: who can create an instruction, who can release it, how positions are calculated, and what evidence remains after settlement.

Stage 1 — Scoping questions

Before we propose fees, we ask which application and modules you run, how many entities post through it, and what event triggered the review (external audit finding, bank query, go-live, or internal concern). The answers shape sample sizes and whether deal modules belong in scope.

Stage 2 — Planning memo

You receive a short planning memo listing control objectives, evidence requests, interview participants, and the sample periods we intend to test. You may adjust timing around payment runs or month-end. The memo becomes the baseline for the engagement letter.

Stage 3 — Fieldwork

Fieldwork mixes configuration review with transaction sampling. We walk payment and deal paths with the people who use them daily, then test whether the controls described still operate for the samples selected. Privileged access and override logs receive particular attention because they often explain exceptions elsewhere.

Stage 4 — Challenge and close

Draft findings are discussed with management before the report is frozen. We expect pushback where context matters — for example, a temporary override during a banking outage — and we adjust ratings when evidence supports it. Unresolved disagreements are noted transparently.

Stage 5 — Report and tracker

The final package includes an executive summary for the audit committee, detailed findings with financial exposure commentary, and a remediation tracker with suggested owners and timing. We do not implement the fixes; we remain available for a later health check once remediation is claimed complete.

What we need from you

Timely access (or agreed extracts), a single client coordinator, and honesty about known workarounds. Hidden “break-glass” procedures discovered late slow fieldwork more than early disclosure.

Browse engagements or request a scoping call when you are ready to map this method to your application.