Process
The engagement rhythm
Audits for fintech succeed when calendars, samples, and owners are visible early. This page is the map we send before kick-off so your floor is not surprised.
Four phases we never skip
Scope lock
We write product boundaries, control domains, sample periods, and out-of-scope items into a short engagement letter. Fieldwork does not start until both sides sign that page.
Evidence pull
You receive a document request list with owners and due dates. We accept your secure transfer method; we do not invent parallel channels for identity files or ledger extracts.
Testing & interviews
Sampling, walkthroughs, and owner interviews happen on an agreed calendar. Floor time is booked in half-day blocks so operations can keep clearing exceptions.
Findings delivery
Draft findings go to your compliance lead first for factual correction. The final memo and closing briefing follow — with severity, evidence notes, and suggested owners.
What we ask you to prepare
- Organisation chart naming control owners for in-scope domains
- Policy versions effective during the sample period
- A recent reconciliation or exception pack with cut-off times
- Access to a walkthrough environment or recorded process demos
- Contact details for outsourcing partners if they run in-scope work
What we will not ask for
- Production administrator credentials for auditors
- Customer identity files outside an agreed secure channel
- Fundraising decks or unrelated product roadmaps
- Unlimited follow-up interviews after the closing briefing
Where work happens
Document review is remote. Floor walkthroughs and closing briefings can be on-site in Tainan or Taipei, or by video when travel does not add evidence quality. Travel days are priced separately when overnight stays are required.
For AML file reviews, sampling stays remote once your information security team approves the transfer method.
Ready to lock a scope?
Start with the flagship controls audit or ask which narrower engagement fits your deadline.