Methodology
Every engagement is written against the application you actually run. The steps below are the spine. The sample, the modules, and the depth change with the letter of engagement.
We are asked to look at dedicated treasury management systems, ERP treasury modules, and bank-hosted cash platforms. The sequence is the same because the risk is the same: a path that can move cash without the dual control the board thinks it has.
We need the application name and version, the modules in live use, the banks on host-to-host, and whether you want a full controls review or a narrower look at payments, access, or a coming cutover. You leave with a one-page outline and a fee range. Nothing is booked until a letter of engagement is signed.
Read-only access, a named operations contact, and a sample period are agreed before fieldwork. We ask for a user extract, a role matrix, and — where the application keeps one — a standing-data change log. Internal audit is welcome in the kickoff.
An operator takes a payment, a deal, or a statement load through the screens they use on a normal day. Training clients full of dummy vendors are not a substitute. Sensitive names can be masked; the path has to be real.
We sample transactions from the agreed period, read configuration, and reperform a slice of positions or valuations where that is in scope. Privileged IDs, repair queues, and fallback bank portals get the same attention as the happy path.
Each finding is ranked by whether it can move cash today. The register is written so treasury operations and internal audit can both use it. We walk it through in person at Metropoint or on a call, then leave a short covering note for the treasurer or CFO.
If you close the items that were supposed to stop a single person completing a payment, we can re-test those items after they have had a week of live traffic. That is a short engagement, not a second full review.
A findings register, a control map of the in-scope modules, and a conversation. Pre-go-live work also includes a short opinion for the steering committee: ready, ready with named conditions, or not ready.