We can read a policy pack in a meeting room. We cannot test an application without a read-only login, a named operations contact, and a sample period you are willing to discuss. Those three items decide whether the engagement finishes in the quoted window or stretches while everyone waits for IT.
Before we arrive, nominate a sample month (or a sample week for high-volume payment factories). Export the user list, the role matrix, and the standing-data change log if the application keeps one. Ask IT to confirm that our read-only role cannot release a payment — we will test that on day one anyway.
Walkthroughs work best when the operator uses the live system, not a training client full of dummy vendors. Sensitive beneficiaries can be masked; the path still has to be real. If a vendor support ID is required for configuration screens, book that person for a defined slot rather than leaving a standing privileged session open.
Internal audit often sits in on the close-out. That is useful when the findings register is written in a language both functions already use. Send us the last internal-audit report on treasury if you have one; we will not repeat tests that still hold, and we will say when they do not.