We reconstruct the transfer the customer actually sent, not the one on the UAT build
SchemaCloud Hub Advisory samples live instructions in mobile banking applications used by banks and e-money issuers in Malaysia—then writes a trail pack internal audit can attach to a sitting.
Request a transfer-path reconstruction
Primary engagement: Transfer Path Reconstruction
A dated pack of sampled customer transfers, each followed from payee enrolment to debit, credit, and any reversal, with notes on where dual control is enforced and where it is only displayed.
You leave with trail notes your retail-operations and internal-audit leads can attach to a committee or Bank Negara briefing, plus a short list of configuration or access changes someone can put on a change window. Typical turnaround is fourteen to twenty business days after read-only access is confirmed.
From MYR 28,000 · informational
Related control work
Choose the engagement that matches the question in front of the next audit-committee sitting.
-
Maker-Checker Walkthrough
Who can initiate, amend, and release a high-value instruction in the same login—and whether the application actually stops that combination.
-
Payee and Beneficiary Integrity Review
New payees, dormant records, and account-number changes that the transfer approval never sees.
-
Limit and Exception Testing
Whether daily, per-transaction, and channel limits actually stop an instruction, or only print a message the user can tap past.
-
Privileged Function Examination
Who can reverse, force-post, or unlock a customer session, how the action is logged, and whether anyone reads that log.
What channel and audit leads said after a trail pack
Evidence from people who used our notes to close access gaps and payee weaknesses before the next sitting.
“The reconstruction showed our DuitNow bands on the policy wall and a different path after a device rebind. We closed two acting-role gaps before the next sitting.”
Nadia K. — Internal audit lead, domestic commercial bank
“Maker-checker testing named staff accounts that could initiate and release. Access administration finally had a list, not a workshop debate.”
Arif H. — Retail operations controller, Islamic bank
“Payee notes caught account-number changes our transfer approvers never saw. The second-instruction risk was sitting in beneficiary data.”
Mei Ling T. — Channel governance, e-money issuer
Bring a live DuitNow instruction, not a demo company
Tell us which mobile banking application your customers use and which sitting you are preparing for. We will propose a reconstruction, walkthrough, or examination that fits.