Answer first
A Settlement Leakage Audit is a fixed-scope analysis of internal transactions, PSP settlements, and bank statements that quantifies unexplained amount differences, timing delays, exposure, and repeatable manual work.
The audit uses real historical data to establish a measurable baseline before production implementation.
Outputs should quantify leakage, delay, exposure, workload, and concentration—not promise automatic recovery.
A useful audit ends with evidence, control gaps, and a defensible implementation plan.
What is a Settlement Leakage Audit?
A Settlement Leakage Audit is a time-boxed payment reconciliation assessment. It compares a defined period of internal transactions, PSP settlement reports, and bank statements to locate unexplained financial differences and operational control gaps.
It is not a statutory audit, assurance opinion, accounting close, penetration test, or promise to recover funds. Its purpose is to produce a transparent, reproducible baseline for deciding whether continuous reconciliation automation has a credible return on investment.
The three inputs
The fastest credible assessment starts with the smallest complete money flow. CSV is often the practical first format because it lets both teams validate the data and business rules before committing to production integrations.
| Input | What it establishes | Typical format |
|---|---|---|
| Internal transactions | What the business expected to settle | CSV or controlled extract |
| PSP settlements | What the provider accepted, deducted, and reported | Settlement report or SFTP file |
| Bank statements | What actually reached the destination account and when | CSV, CAMT, MT940, or controlled extract |
A practical 7–14 day method
The audit should make every transformation and assumption reviewable. A typical sequence is data intake, field mapping, quality assessment, expected-value calculation, transaction-to-PSP matching, PSP-to-bank matching, exception classification, evidence review, and management reporting.
- Agree scope, currencies, providers, accounts, period, and success criteria.
- Profile data quality and record missing or ambiguous fields before matching.
- Configure deterministic Stage A and Stage B matching rules.
- Investigate material exceptions and verify evidence with the customer.
- Quantify findings and produce a production control plan.
What the audit should deliver
The output should be an evidence-backed management view, not a spreadsheet of unexplained rows. Every reported number needs a definition, source population, calculation, and known limitation.
| Output | Question answered |
|---|---|
| Unmatched amount | How much value lacks a defensible relationship? |
| Fee leakage | Where do charged fees differ from agreed or expected rules? |
| FX difference | Where do rate, spread, or currency results differ from expectation? |
| Missing settlement | Which eligible payments have no verified PSP settlement? |
| Settlement delay | Which settlements missed the expected availability window? |
| Settlement exposure | How much overdue value persisted, in which currency, and for how long? |
| Manual workload | Which repeatable steps consume operator time? |
| Potential saving | Which validated control improvements could reduce effort or leakage? |
Show where the problem concentrates
A total exception count rarely changes a decision. Findings become actionable when they are broken down by provider, corridor, currency, settlement cycle, exception type, and responsible handoff.
For example, the audit may show that one provider's PHP corridor repeatedly misses its settlement SLA by six to eight hours while other corridors remain healthy. That pattern creates a clearer production use case than a generic claim of 127 unmatched transactions.
From audit to continuous control
A successful audit does not automatically become production software. The next phase validates security, tenant isolation, data retention, source integrations, mapping versions, controls, permissions, service levels, and operational ownership.
Production then turns the approved method into a repeatable daily workflow: connect, normalize, match, investigate, resolve, and close. The audit evidence remains the baseline against which implementation and subscription value can be measured.
Each stage has a distinct scope and entitlement. Historical mappings, evidence, and decisions remain attributable as the customer's workspace progresses.
Handle financial data deliberately
Do not send production financial data through ordinary website email. Scope and secure transfer methods should be agreed before any data is provided. The audit plan should state where data is processed, who can access it, how long it is retained, and how deletion is evidenced.