In
The live application
Authorisation rules, capture and delayed capture, voids, refunds, partials, and how those events are logged. We sample production runs from the period, not a sandbox the vendor prepared for us.
What we typically examine, and what we will not.
This page is the working map we use when a payments owner writes from Perak or further afield. The engagement letter names the application and the period. This is the shape of the work, not a product catalogue.
In
Settlement leaving the building
Batching, fees, currency conversion, and the outbound file or statement the acquirer, scheme, or bank actually received. Control totals at each hop. Manual overlays that never made it into a ticket.
In
Who could change the money path
Access to fee tables, merchant limits, refund thresholds, and release of settlement. Change tickets around freeze. Dual control that operated on the day, not a toggle that exists in a screenshot.
Out
Work we decline
Vendor certification, penetration testing as a product, implementation, licence resale, and any job that would put us in a position to examine our own design. We are not a statutory auditor of financial statements.