Treasury application audit · Malaysia
CloudFabric Path Advisory examines the treasury management applications behind cash positioning, payment factories, and bank connectivity. We sit with the live system, not a slide deck, and write findings operations can actually close.
What we actually examine
The work reconstructs how a payment, a deal, or a standing-data change travels through the application you run today — dedicated TMS, ERP treasury module, or bank-hosted cash platform.
Primary engagement
An independent walkthrough and test of the controls inside your treasury management application — configuration, maker-checker paths, standing data, and the points where cash instructions can be altered.
Typically 3–5 weeks · Treasurers, internal audit, and finance systems owners
Related engagements
Testing of payment factories, host-to-host channels, file encryption, beneficiary changes, and the last mile between the TMS and the bank.
Typically 2–4 weeks 03Independent testing of cash positions, bank-statement loads, deal valuations, and the reconciliations that feed the general ledger.
Typically 2–3 weeks 04A structured review of roles, conflicting entitlements, shared IDs, and the privileged accounts that can bypass maker-checker in the TMS.
Typically 2–3 weeks 05A time-boxed review of configuration, migration, controls, and cutover rehearsal before a new TMS, module, or bank channel goes live.
Typically 3–6 weeks, aligned to your cutover 06A comparison of board-approved treasury policy, bank mandates, and the limits, products, and entities actually enabled in the application.
Typically 2–3 weeksFrom people who sat through the walkthrough
“They found a repair-queue path that let one operator complete a rejected file without a second pair of eyes. We had signed off dual control the year before.”Group treasurer, listed industrial, Klang Valley
“The opinion before cutover was shorter than the programme pack and more useful. We delayed one bank channel and went live on the rest.”CFO, regional trading house, Kuala Lumpur
How an engagement starts
We do not sell a packaged product. If the application, the sample period, and the access are clear, we can usually send a letter of engagement within a few working days.
Notes from the practice
It is not a software licence review and it is not a full financial-statement audit. Here is the ground we cover when we are asked to look at the application that moves cash.
Cash positioning modules are treated as reporting. They are also the input to funding decisions. Three gaps show up in almost every Malaysian corporate we review.
Maker-checker in the TMS is necessary and not sufficient. The file that leaves the building is the actual payment instruction.