Process
The rhythm of an audit engagement
A transparent sequence for compliance and product leads who need to know when calendars will fill and when findings will land.
Built for audits for fintech, not generic consulting phases
Every Network Security Hub engagement follows the same skeleton — scoping, evidence, walkthroughs, testing, report — with intensity scaled to whether you commissioned a full Fintech Controls Audit or a shorter readiness pass.
You always know the sample populations before testing begins. Interim observations arrive while there is still time to locate missing artefacts.
Week-by-week shape
Timings below reflect a typical Fintech Controls Audit. Shorter engagements compress stages; they do not skip independence checks.
Week 0 — Scoping conversation
Licence category, product list, prior findings, and report audience. We issue a written scope, fee, and proposed start date. A deposit confirms the window.
Week 1 — Evidence request
You receive a structured request list. Your compliance lead assigns owners. We clarify formats early so exports are usable.
Weeks 2–3 — Walkthroughs
Scheduled sessions with control operators. We document design understanding and note where policy and practice diverge.
Weeks 3–5 — Sampling and challenge
Agreed samples are tested. Interim observations are shared. Your team may supply clarifying evidence before the draft locks.
Weeks 5–7 — Report and closing
Findings register, severity ratings, remediation map, and a closing briefing for management or the board risk committee.
What we ask of your side
A single coordinator
One compliance or risk lead who can unblock evidence requests without a committee for every file.
Access to operators
Walkthroughs need the people who approve refunds, release changes, or clear breaks — not only policy authors.
Honest incomplete files
Missing artefacts stated early beat last-day surprises. We adjust severity language when constraints are transparent.
Decision rights on remediation
We recommend sequences; your leadership assigns owners and budgets. We do not implement fixes inside the same engagement.
Ready to place an engagement on the calendar?
Browse audit options or write to us with your target month and licence context.