The worst close-out meeting is the one that hands treasury a list of twenty configuration changes and a go-live for all of them on the same weekend. Payment factories do not enjoy big-bang control fixes. We rank findings by whether they can move cash today, and we group the fixes that share a change window.
Beneficiary dual control, file-channel entitlements, and privileged IDs usually come first. Report-mapping and policy-document drift can wait for the next board cycle if they cannot move cash. We will say so in the register, even when it makes the ‘high’ column shorter than a reader might expect.
Where a fix needs the vendor or the bank, we write the request in the language those parties already use — a configuration change, a mandate update, a certificate rotation — so treasury is not stuck translating an audit paragraph into a service ticket.
Follow-up testing is optional and often worth it for the items that were supposed to stop a single person completing a payment. It is a short re-test, not a second full audit. If you want it, we schedule it after the change has had a week of live traffic, not the morning after the weekend release.