When we open a fintech controls audit for a payment institution in Taiwan, the first surprise is rarely a missing policy. It is usually a gap between the written reconciliation schedule and the person who actually clears overnight exceptions on Monday morning.
Supervisors and investors both follow the money. They want to see how a customer payment moves from acceptance through settlement, and who signs off when the numbers do not match. If that chain lives only in someone’s inbox, the walkthrough stalls.
We ask engagement contacts to bring three artefacts to the kick-off: the last month of reconciliation packs, the exception log with aging, and the current segregation-of-duties chart—even if it is still a spreadsheet. Incomplete packs are fine; silent packs are not.
Firms that prepare these items early shorten fieldwork by a week or more. The audit still tests samples, but the conversation starts with facts rather than introductions to undocumented handoffs.