Approach
Read-only, five days, fixed fee.
The audit is deliberately boring to buy. A short scoping call, read access to the things that keep records, five working days, and a written document at the end. No production changes, no discovery phase, no open-ended engagement.
Principles
Five things I actually believe.
These shape how I scope, what I say no to, and how I hand work back to your team.
Read-only, always
I take read access to schedulers, execution history and the output side. No write access, no configuration changes, nothing touched in production during an audit. If something needs fixing, that is a separate conversation you are free to have with someone else.
The fee does not move
Fixed before I start, and the same whether I find six problems or none. Nobody should be paid more for finding more, because that is how you end up with a report full of findings.
Evidence, not opinion
Every finding points at a record: what should have run, what the system says happened, what came out. If I cannot evidence it, it goes in the report as a question rather than a finding.
A clean report is a real result
If everything is running and producing what it should, that is what the document says. Worth having in writing on its own, particularly heading into an audit, a refinancing or a sale.
You keep what I set up
The last section of the report is what to instrument so this stays visible without me. I would rather you did not need a second audit. Repeat work should come from you growing, not from me withholding something.
How I work
Five steps from scoping call to written findings.
Same shape every time. Note where it stops: nothing gets looked at until you have decided what I am allowed to see.
Scoping call
Fifteen minutes. Which processes run without a person watching, and which of them carry a deadline, a filing obligation or a number somebody downstream trusts. That conversation decides whether an audit is worth doing at all, and I will say if it isn't.
Read accessyour call
I agree exactly what I need to see and how it will be granted. Usually scheduler and execution history, logs, and enough of the output side to confirm things landed. Scoped, time-boxed, and revoked at the end. Where access takes weeks to arrange, I scope around what is available rather than stalling.
Access granted · read-only
Inventory
Before anything can be checked it has to be found, and this is usually the part that surprises people. Scheduled jobs, event-driven handlers, integrations and things somebody set up years ago and left running. The list is almost always longer than the one the business had in its head.
The two checks
Each process is checked for execution and for output: did it run when it claimed it would, and did it produce something real. This is the part I am actually selling, so the report shows you the findings and the evidence behind them rather than a description of the technique.
Findings and walkthrough
A written document, ranked by exposure rather than by technical severity, so the filing that has not been submitted sits above the log rotation that stopped. Then an hour on a call going through it, because the ranking is a judgement and you may disagree with it.
Typical engagement
Five working days, start to written findings.
Access is the variable. Everything after it is predictable, which is why the fee can be fixed.
Day 1
Inventory
Enumerate everything that runs unattended. Agree what is in scope and what is out.
Day 2–3
Execution and output
Both checks across the in-scope processes. Anything ambiguous gets flagged rather than guessed.
Day 4
Exposure
Work out what each gap actually costs. This is where your knowledge of the business matters more than mine.
Day 5
Written findings
The document, then a walkthrough call.
After the report
Most people take the findings and fix them internally, which is the intended outcome. If you would rather not, remediation and a longer fractional arrangement are both available, but they are a separate decision made after you have the document, not a condition of getting it.
Ready to scope?
Start with one process. I'll tell you honestly whether it's worth checking.
No slides. No discovery fee. If your monitoring already covers it, I'll say so.
Five days, fixed fee. You get a written findings document.