Preparing a document room for gateway auditors
What to stage before fieldwork so a financial audit of your payment gateway application spends time on findings, not file hunting.
Audits stall when access arrives late. A tidy document room will not change a weak control, but it will surface issues while there is still calendar left to fix them.
Minimum export set
- Settlement files for the agreed sample periods
- Fee reports covering the same window
- Refund and chargeback reports
- Bank statements or payout confirmations
- Reconciliation workbooks actually used at month-end
- Current fee schedule and relevant processor contract extracts
Access hygiene
Prefer read-only secure shares with expiry dates. Avoid chat apps for production files. If personal data appears in transaction logs, agree redaction rules before upload — auditors need identifiers for matching, not full cardholder data.
People map
List who owns daily settlement, who posts journals, who speaks to the processor, and who signs the close. Thirty minutes of introductions saves days of misdirected questions.
Timing
Start gathering exports when the scoping letter is drafted, not on the fieldwork start date. Holiday-heavy months in Thailand can delay processor re-sends; build that lag into your plan.