Methodology

How API Schema Hub structures a financial audit of a payment gateway application — from scoping letter to findings workshop.

Engagement shape

Every financial audit of a payment gateway application follows the same spine: clarify the financial question, agree the sample, test money movement, then write findings finance can own. The depth changes; the order does not.

1. Briefing

We ask what decision the audit supports — go-live, processor change, board pack, or recurring control review. You share gateway type, monthly volume band, currencies, and who currently reconciles settlement.

2. Scoping letter

The letter names systems in scope, sample periods, access method (secure room, encrypted export, or on-site), deliverable format, timeline, and fee. Work starts when the letter is accepted and the deposit (if any) is received.

3. Fieldwork

Auditors map authorization → capture → settlement → ledger for the sample. We compare settlement files to bank receipts and books, trace fees and reserves, and interview the people who sign off. We do not rewrite your code; we examine the financial trail the application produces.

4. Findings workshop

Draft issues are discussed with your finance contact before the report freezes. Mild disagreements on rating are normal; factual corrections are welcomed. New scope is parked for a separate quote rather than silently expanded.

5. Final report

You receive a narrative report, ranked findings with estimated exposure where we can support a figure, fee or settlement mapping tables, and a short remediation owner list. Working-paper summaries are available to internal audit on request.

Sampling approach

We prefer recent complete settlement cycles over random cherry-picking. Stratification by payment method, currency, and refund/chargeback presence keeps the sample honest when volumes are skewed.

On-site vs remote

Document-led reviews suit fee assessments and many reconciliation checks. Full audits often benefit from one or two days on the settlement desk in Bangkok so we can see how exceptions are actually cleared under time pressure.

Ready to schedule

Browse audit types or request a briefing with your preferred start month.