Most audits that blow their budget or miss the risk that mattered were scoped wrong before fieldwork began. The team tested a process end to end when the risk sat in one corner of it; it included three locations because they were on the universe list, not because they differed; it excluded the system interface everyone assumed someone else covered; it wrote an objective so broad that any test fitted and no conclusion followed. The scoping memo is where those decisions are made and recorded, which is why a good function treats it as a separate document from the planning memo: scoping decides what question the audit will answer and what it will and will not look at, and planning decides how. This guide covers the discipline and the document, with an annotated template and a complete worked example.
It covers what scoping decides and why it is separate from planning, the inputs, objectives written as answerable questions, boundaries, explicit exclusions, risk-based scope decisions, the budget consequence, the template section by section, the worked example from Lakeshore Bancorp’s underwriting audit, scope changes during fieldwork, the ten scoping mistakes, and how the memo relates to the planning memo and the work program. It extends the engagement-level risk assessment guide, which is the analysis the scoping memo records the outcome of.
In this guide
- What scoping decides, and why it is separate from planning
- The inputs to a scope decision
- Objectives as answerable questions
- Boundaries: process, entity, period, system, location
- Explicit exclusions, with reasons
- Risk-based scope decisions
- The budget consequence
- The annotated template
- A full worked example: Lakeshore Bancorp’s commercial underwriting audit
- Scope changes during fieldwork
- The ten scoping mistakes
- How the scoping memo relates to the planning memo and the work program
- Questions about scoping memos
- Related guides
What scoping decides, and why it is separate from planning
Scoping answers five questions: what the audit is trying to conclude (the objectives), what it will examine to get there (the boundaries), what it will deliberately not examine and why (the exclusions), what risks drove those choices (the rationale), and what the choices cost (the budget). Planning answers the next set: who will do the work, when, with what tests, what evidence and what sample sizes, and how the engagement will be run. The two are often merged into one document, and the merger is where scoping discipline dies, because a planning memo full of logistics buries the one page that mattered: the argument for why this scope and not another. The Global Internal Audit Standards expect engagement objectives and scope to be established and documented based on an engagement risk assessment, and expect the scope to be sufficient to achieve the objectives; they also expect communication of scope to management before the work begins, which is the scoping memo’s second job. A function that writes a two-to-four-page scoping memo, has it approved before planning starts, and shares its substance with the auditee in the opening meeting gets three things: a defensible answer to “why didn’t you look at X” when X fails later, a budget that matches the work, and an auditee who knows what is coming. The audit process step by step guide places scoping in the lifecycle; this guide is the step itself.
The inputs to a scope decision
A scope is built from evidence the function already has or can gather in a week. The annual risk assessment entry for the auditable entity: why it is in the plan this year, what risks the assessment rated high, what the plan promised the audit committee (the risk-based auditing and audit universe guides). Prior work: the last audit’s scope, findings and open issues, the external auditor’s and regulators’ observations, and management’s own testing or monitoring results, so the audit extends knowledge rather than repeating it. Process intelligence: a process map or narrative, the systems involved and their interfaces, the volumes and values flowing through each step, the organizational units and locations, the changes since the last review (new system, reorganization, new product, new regulation). Management’s view: a short conversation with the process owner about what worries them, what has changed and what they would want tested, taken as input rather than instruction. External expectations: regulatory requirements and examiner focus, the standards the process must meet, and the industry’s known failure patterns. Data: a preliminary look at the transaction population (counts, values, concentrations, exception reports) that tells the scoper where the risk actually sits rather than where the process map says it should. The engagement-level risk assessment guide turns these inputs into rated risks; the scoping memo records which of those risks the audit will address and how far.
| Input | What it tells the scoper | Where to get it |
|---|---|---|
| Annual risk assessment entry | Why the audit is in the plan and what the committee was promised | The approved plan and its risk assessment workbook |
| Prior audit, regulator and external auditor findings | Known weaknesses, their closure quality, and what not to repeat | Issue tracker, examination reports, management letters |
| Management’s own testing and monitoring | What is already covered and how well; candidates for reliance | Quality control reports, second-line reviews, SOX testing |
| Process map, systems and volumes | Where transactions, values and controls concentrate | Procedures, system inventory, transaction counts and values by step |
| Changes since the last review | Where controls are most likely to have broken | Change records, reorganizations, new products and policies |
| Management’s view | Concerns and context, as input | A short conversation with the process owner |
| Regulatory and standards expectations | Criteria and examiner focus | Rules, guidance, prior examination scope |
| Preliminary data look | Where the exceptions actually are | Exception reports, a quick profile of the population |
Objectives as answerable questions
An objective is a question the audit will answer with a conclusion, and the test of a good one is that a reader can imagine both the yes and the no. “Assess the adequacy and effectiveness of controls over commercial underwriting” cannot fail; “Determine whether commercial loans originated in the twelve months to 30 June 2026 were underwritten in accordance with the credit policy, with exceptions identified, mitigated and approved at the required authority” can. Good objectives are few (three to five for a typical engagement), specific about the population and period, tied to the risks the assessment rated, and phrased so that each will produce a conclusion the report can state. They are also honest about assurance level: an objective to “determine whether” implies testing to a conclusion, while “evaluate the design of” implies walkthroughs and design assessment only, and the memo should say which. Writing objectives this way forces the scope decisions that follow, because each objective implies a population, a set of criteria and a body of evidence; an objective that implies more work than the budget allows is the first sign the scope is wrong. The operational audit criteria guide covers the criteria side (what the audit will measure against), which the objective should name or imply.
Boundaries: process, entity, period, system, location
| Boundary | The decision | What drives it | Example |
|---|---|---|---|
| Process | Which steps of the process, from where to where | Where the rated risks sit; where controls are concentrated; what prior work covered | Application through funding and covenant setup; post-closing monitoring in scope only for covenant tracking |
| Entity and product | Which business units, products, portfolios or legal entities | Materiality, risk rating, differences in process or system, regulatory attention | Commercial real estate and C&I originations and indirect auto; residential mortgage excluded |
| Period | The population’s date range | Enough operations to test; alignment with the last audit and with policy changes; data availability | Loans originated 1 July 2025 to 30 June 2026 |
| System | Which applications and interfaces, and whether their general controls are in scope | Where the data and controls live; what the IT audit plan already covers | Loan origination and covenant tracking systems in scope for configuration and data integrity; ITGCs covered by the IT general controls audit |
| Location | Which sites, regions or jurisdictions | Variation in practice; risk concentration; cost of coverage | All regions through central data; site visits to the two regions with the highest exception rates |
| Depth | Design only, design and operating effectiveness, or substantive outcome testing | Objective wording; assurance the committee expects; reliance on management’s testing | Operating effectiveness for policy adherence and exceptions; outcome testing for supervisory LTV reporting |
Each boundary is a choice, and the memo states the choice and its reason in a sentence. The common failure is a boundary set by habit (the whole process, all locations, a calendar year) rather than by risk, and the common correction is to ask, for each boundary, what would change in the conclusion if it were narrower, and what risk would be left unexamined if it were. The SOX scoping guide shows the same logic applied to a program rather than an engagement.
Explicit exclusions, with reasons
The exclusions section is the most valuable paragraph in the memo and the one most often missing. It names what the audit will not examine and why, so that the reader (the chief audit executive now, the audit committee later, the examiner or the lawyer after a failure) knows the gap was a decision rather than an oversight. Acceptable reasons are specific: covered by another engagement in the plan (named, with timing); covered by management’s testing or a second-line review the function has assessed and relies on (named); low risk per the assessment (with the rating); not operating in the period (a product not yet launched); out of the function’s mandate (a legal judgment, an actuarial estimate) with the assurance source noted; or deferred to a later phase for budget reasons, which is legitimate if stated. Unacceptable reasons are the ones the memo should refuse to write: management asked us not to; it is too complicated; we did not have the data. An exclusion for a high-risk area that no other assurance covers is a gap the committee should see, and the memo should say so plainly rather than hide it. The assurance mapping guide gives the tool for knowing what other assurance exists, which is what makes an exclusion defensible.
Risk-based scope decisions
The scoping memo’s central argument connects rated risks to scope choices. For each significant risk from the engagement risk assessment, the memo says whether it is in scope, which objective addresses it, and at what depth; for each scope choice, it names the risk that justified it. Three patterns recur. Concentration: the risk sits in a subset (one product, one region, one step), so the scope narrows to the subset and the memo says why the rest is lower risk. Change: something changed since the last review (a system, a policy, a team, a regulation), so the scope includes the changed element even where it would otherwise be low risk, because change is where controls break. Reliance: another party has tested part of the area (the external auditor, a regulator, management’s quality control, a second-line review), so the scope reduces or excludes that part after the memo records the basis for reliance and the testing of it. The memo also records the scope decisions the scoper considered and rejected, briefly, because the alternative scopes are the ones the reader will ask about. The risk assessment matrix guide covers the rating; the audit risk guide the reasoning about what an audit can and cannot be expected to find.
The budget consequence
Scope and budget are the same decision seen from two sides, and the memo should show the arithmetic: each objective’s implied work (populations, samples, locations, interviews, analytics) estimated in hours, summed, compared with the plan’s allocation, and reconciled by changing the scope or the allocation rather than by hoping. A memo that proposes 700 hours of work against a 450-hour allocation has not finished scoping. The reconciliation options are the ones the true total cost guide describes: narrow a boundary, reduce depth on a lower-risk objective, rely on another party’s testing, use analytics on the population instead of a larger sample, or ask the chief audit executive for hours from the reserve with the risk rationale attached. The memo records the final figure and the assumptions behind it, which is what makes a later overrun diagnosable: either the assumptions were wrong (a learning for the next scope) or the scope moved (a change the next section covers).
The annotated template
| Section | Content | Annotation |
|---|---|---|
| 1. Header | Engagement name and number; auditable entity and universe reference; plan year; audit lead and manager; scoping date; approver; version | The universe reference ties the scope to the plan the committee approved |
| 2. Why this audit, now | The annual risk assessment rationale in two or three sentences; what changed; what the committee was told | Taken from the plan, not rewritten; keeps the scope honest to the promise |
| 3. Background and process summary | The process in one paragraph: steps, systems, volumes and values, organization, locations; changes since the last review; prior audit, regulator and management findings and their status | Half a page. Volumes and values belong here because they justify the boundaries |
| 4. Engagement risk assessment summary | The significant risks rated (a short table: risk, rating, source), with a reference to the full assessment | The argument’s premises |
| 5. Objectives | Three to five answerable questions, each tied to the risks it addresses and stating the assurance level | Test each: can it fail? |
| 6. Scope | Boundaries by process, entity and product, period, system, location and depth, each with its reason | One line per boundary; reasons reference section 4 |
| 7. Exclusions | What is not in scope and why, with the other assurance source named where one exists; any uncovered high-risk area flagged | The paragraph the reader will look for after a failure |
| 8. Approach and reliance | The general approach by objective (analytics, sampling, walkthroughs, re-performance); reliance on other parties’ work and the basis for it; specialist needs; data requirements | Enough to size the work; detailed tests belong in the work program |
| 9. Budget and timing | Hours by objective and in total against the plan allocation; the reconciliation; key dates (fieldwork, draft, report); constraints (period-end, auditee availability) | The arithmetic, shown |
| 10. Scope decisions considered | Alternatives considered and rejected, briefly, with reasons | Two or three bullets; pre-empts the obvious questions |
| 11. Communication | Who has been or will be consulted (process owner, executive sponsor); what will be shared at the opening meeting | Scope communicated before fieldwork is a Standards expectation |
| 12. Approval and change log | Approver and date; a table for scope changes during the engagement (what, why, approved by, hours effect) | The change log keeps the memo the single source of truth |
A full worked example: Lakeshore Bancorp’s commercial underwriting audit
The memo below scopes the FY26 underwriting audit at Lakeshore Bancorp, the $9 billion community bank used in the banking examples on this site; the audit itself and its findings are described in the underwriting process audit guide. It is reproduced in the template’s order and at the length a real memo would run.
1. Header
Engagement 26-014, Commercial Underwriting. Auditable entities: Credit Origination, Commercial (universe reference C-03) and Consumer Lending, Indirect Auto (C-07, underwriting component). Plan year FY26. Audit lead: senior auditor, credit; manager: audit manager, credit. Scoping completed 12 May 2026; approved by the chief audit executive 15 May 2026. Version 1.0.
2. Why this audit, now
Commercial underwriting was rated High in the FY26 risk assessment because commercial real estate stands at 318 percent of total capital against a 330 percent internal limit, commercial originations grew 14 percent in FY25, the credit policy was revised in January 2025 (coverage definitions, exception process), and the last underwriting audit (FY23) found exception identification weaknesses that were closed on management attestation. Indirect auto was added because override rates rose above the 10 percent ceiling in two of the last four quarters. The audit committee was told the audit would test policy adherence and exception governance across commercial and indirect auto originations.
3. Background and process summary
Commercial lending originated 1,140 loans totalling $1.9 billion in the twelve months to 30 June 2026 through 38 relationship managers in four regions, underwritten centrally by a 22-person credit department and approved under a tiered authority matrix (individual officers to $3 million on relationship exposure, regional credit officers to $10 million, loan committee above). Indirect auto originated 9,400 loans ($310 million) through 140 dealers, decisioned by a vendor scorecard with manual override authority at two levels. Systems: the loan origination system (commercial and consumer modules), the spreading tool, the covenant tracking system, the appraisal management platform and the core loan system. Changes since the FY23 audit: the January 2025 policy revision, a new appraisal management vendor (March 2025), the scorecard’s recalibration (September 2025). Prior findings: FY23 exception identification (closed, attestation); OCC examination (2025) comment on covenant monitoring documentation (closed by management, no independent validation); credit administration’s own quality control reviews 40 files a quarter with results reported to the chief credit officer.
4. Engagement risk assessment summary
| Risk | Rating | Source |
|---|---|---|
| Policy exceptions not identified, mitigated or approved at the right level, so the book is riskier than the board’s reports show | High | FY23 finding closed on attestation; growth; policy change |
| Approval authority circumvented through structuring or incomplete relationship aggregation | High | Authority on relationship exposure depends on aggregation logic untested since FY23 |
| Supervisory loan-to-value limits exceeded without identification and reporting | High | CRE concentration near limit; regulatory reporting obligation |
| Collateral valuations not independent or not compliant with appraisal thresholds | Medium | New appraisal vendor |
| Covenants not tracked and tested after closing | Medium | OCC comment closed without validation |
| Scorecard overrides exceeding ceilings and adding default risk | High | Override rate trend |
| Origination data feeding the allowance and concentration reports incorrectly | Medium | System changes |
| Fair lending in pricing and exceptions | Medium | Monitored by compliance annually |
5. Objectives
(1) Determine whether commercial loans originated in the period were underwritten in accordance with the credit policy, with policy exceptions identified, mitigated and approved at the required authority, and whether exception reporting to the board is complete (operating effectiveness and outcome). (2) Determine whether approval authority was applied on total relationship exposure and whether loans to related borrowers were aggregated and approved at the required level (operating effectiveness, with analytics on the full population). (3) Determine whether loans exceeding supervisory loan-to-value limits were identified, tracked and reported to the board as the interagency guidelines require (outcome). (4) Determine whether collateral valuations were obtained independently, met the appraisal thresholds and were reviewed (operating effectiveness). (5) Determine whether indirect auto decisioning followed the approved strategy, with overrides within ceilings and performance-monitored and income verification performed where required (operating effectiveness and outcome). Covenant tracking after closing is addressed within objective 1 as the policy requirement that covenants be set and monitored.
6. Scope
Process: application through approval, closing, booking and covenant setup, plus covenant monitoring for the sampled loans (because the OCC comment was closed without validation). Entity and product: commercial real estate and C&I originations in all four regions (central data; site visits to the two regions with the highest recorded exception rates); indirect auto originations across all dealers. Period: originations from 1 July 2025 to 30 June 2026 (covers the policy revision and the scorecard recalibration, and gives the scorecard overrides two vintages of performance). Systems: the loan origination system and covenant tracking system for configuration (authority logic, exception flags, supervisory LTV flag) and data integrity to the core loan system; the appraisal platform for ordering and review workflow; the scorecard for strategy configuration and override logs. Depth: operating effectiveness with independent re-underwriting of the commercial sample; outcome testing for exception reporting, supervisory LTV reporting and override performance; analytics on the full origination populations.
7. Exclusions
Residential mortgage underwriting is excluded: covered by the compliance department’s annual ability-to-repay and HMDA testing (reviewed by this function in FY25 and relied on) and scheduled for a separate audit in FY27. The allowance for credit losses is excluded: covered by the FY26 CECL audit (engagement 26-009), which will use this audit’s data integrity results. IT general controls over the loan systems are excluded: covered by the FY26 ITGC audit (26-021), whose results this audit will rely on for access and change management. Fair lending analysis is excluded as a separate objective: performed annually by compliance using the pricing and exception data; this audit will review compliance’s most recent analysis and report any concern but will not re-perform it. Problem loan management and workout are excluded: not an origination risk, scheduled FY27. No high-risk area in the engagement risk assessment is left without assurance.
8. Approach and reliance
Analytics first on the full commercial and indirect auto origination files (exception rates by officer and product, structuring patterns by borrower group and timing, quarter-end clustering, financial statement age, LTV flags, override rates and vintage performance), then a commercial file sample of 85 (60 statistical across products and officers, 25 targeted from the analytics) re-underwritten from source documents, and an indirect auto sample of 60 weighted to overrides and stated-income approvals. Walkthroughs of the exception, authority and appraisal processes with configuration inspection. Review of credit administration’s quality control program and reliance on its file reviews only where this audit’s re-performance of 10 of its reviewed files confirms their quality. Data: origination files, pipeline (applications and declines), appraisal log, covenant tracking extract, delinquency history by vintage, authority matrix and policy parameters, all requested by 1 June. No specialists required; the data analyst supports the analytics for 80 hours.
9. Budget and timing
Objective 1: 200 hours (sample re-underwriting 140, exception analytics and reporting reconciliation 60). Objective 2: 70 hours (aggregation logic, structuring analytics, committee minutes). Objective 3: 40 hours. Objective 4: 60 hours (including two site visits). Objective 5: 90 hours. Planning, reporting and review: 60 hours. Total 520 hours against a plan allocation of 480; the 40-hour difference is requested from the reserve on the strength of the covenant monitoring addition (the OCC comment closed without validation), approved by the chief audit executive at scoping. Fieldwork 8 June to 24 July 2026; draft report 7 August; final 14 August; the mid-July quarter-end is avoided for credit department interviews.
10. Scope decisions considered
Including residential mortgage in a single credit origination audit was considered and rejected: a different process, system and regulatory frame, compliance testing in place, and a budget consequence of about 150 hours. Limiting indirect auto to a review of the override report was considered and rejected: the performance signal needs the override population and a file sample to be useful. Covering all four regions by site visit was considered and rejected in favor of central data with two targeted visits, saving about 40 hours with no loss of population coverage.
11. Communication
Scoping discussed with the chief credit officer (6 May) and the head of consumer lending (8 May); both raised covenant monitoring and dealer verification as concerns, consistent with the scope. Objectives, scope, exclusions and timing to be shared at the opening meeting on 8 June with the credit department, credit administration and consumer lending.
12. Approval and change log
Approved: chief audit executive, 15 May 2026. Change 1 (2 July 2026): analytics identified a borrower group with three approvals under one officer’s authority; scope extended to committee-minute reconciliation for all approvals above $2 million in the period (12 hours, absorbed within objective 2; approved by the audit manager). Change 2 (15 July 2026): appraisal review independence testing extended to all 22 appraisals reviewed by one reviewer after a communication was found (8 hours, absorbed; approved by the audit manager).
Scope changes during fieldwork
Scope changes are normal; undocumented scope changes are the problem. Fieldwork finds things the scoping did not anticipate (a structuring pattern, a reviewer’s conflict, a system change nobody mentioned), and the right response is a recorded decision: what the change is, why it is justified by risk, what it costs in hours, whether it displaces something else, and who approved it. Small changes (a sample extended, a test added) are approved by the audit manager and logged; changes that alter an objective, add a product or location, or move the budget by more than a set percentage go to the chief audit executive and may be communicated to the auditee. The change log in the memo keeps the scope a single document rather than a memo plus a trail of emails, and it is what the performing standards’ documentation expectations look like in practice. Scope reductions deserve the same discipline: an objective dropped for budget reasons is a gap the report should disclose and the committee should hear about, not a quiet omission.
The ten scoping mistakes
| Mistake | How it shows | Correction |
|---|---|---|
| Objectives that cannot fail | “Assess the adequacy of controls”; the report concludes nothing | Write questions a reader can imagine answering no |
| Scope by habit | Whole process, all locations, calendar year, every time | Each boundary justified by a rated risk |
| No exclusions section | “Why didn’t you look at X” has no answer | Name exclusions and reasons; flag uncovered high risks |
| Exclusion by assumption | “IT covers that” without checking the IT plan | Assurance map; named engagement and timing |
| Reliance without testing | Management’s QC accepted at face value | Re-perform a portion before relying |
| Budget by wish | Hours set to the allocation, not the work | Show the arithmetic; reconcile scope to hours |
| Ignoring change | New system or policy outside the scope because the risk rating predates it | Change is a scope-in trigger |
| Period too short | Not enough operations to test; new controls untestable | Twelve months, or long enough for the sample |
| Scope set with the auditee | Management’s worries become the objectives; management’s comfort zones become exclusions | Management’s view is an input, recorded as such |
| Unrecorded scope creep | Budget overrun with no decision trail | Change log with approvals and hours |
How the scoping memo relates to the planning memo and the work program
Three documents carry an engagement from idea to fieldwork, and keeping them distinct keeps each short. The scoping memo (this guide) decides and records what the audit will conclude and examine, with the risk argument and the budget, and is approved before detailed planning begins. The planning memo takes the approved scope and adds the how: the team and roles, the detailed timeline, the risk and control matrix, the data and access requests, the communication plan, the logistics; it references the scoping memo rather than repeating it. The work program turns each objective into tests with populations, samples, procedures and evidence requirements, under the control design principles and the sample sizes the function uses. Smaller functions sometimes combine the first two into one document with the scoping sections first and clearly separated, which works if the scope argument is approved before the logistics are written; what does not work is a single document in which the scope is implied by the tests. The risk and control matrix template and workpaper example guides show the downstream documents, and the year-one plan guide how a new function sets the whole sequence up.
Questions about scoping memos
What is an audit scoping memo?
A short document, approved before detailed planning, that records what one engagement will conclude (objectives), what it will examine (boundaries by process, entity, period, system, location and depth), what it will deliberately not examine and why (exclusions), the risk argument behind those choices, and the budget they imply, with a change log for decisions made during fieldwork.
How is it different from a planning memo?
Scoping decides what and why; planning decides how, who and when. The scoping memo carries the objectives, boundaries, exclusions, risk rationale and budget; the planning memo adds the team, timeline, risk and control matrix, data requests and logistics, referencing the approved scope rather than repeating it.
How many objectives should an audit have?
Three to five, each an answerable question tied to the rated risks, specific about population and period, and explicit about assurance level (design only, operating effectiveness, or outcome). More than five usually means the scope is too broad for the budget; one broad objective usually means the audit cannot conclude.
What makes an exclusion acceptable?
A specific reason: covered by a named engagement, covered by tested management or second-line work the function relies on, rated low risk, not operating in the period, or outside the mandate with the assurance source noted; deferral for budget is acceptable if stated. “Management asked” and “too complicated” are not, and a high-risk area with no other assurance should be flagged rather than quietly excluded.
How should scope changes be handled?
Recorded in the memo’s change log with the change, the risk justification, the hours effect, any displacement and the approver; small changes approved by the audit manager, changes to objectives, products, locations or significant budget by the chief audit executive, with scope reductions disclosed in the report rather than omitted.
Should the auditee see the scoping memo?
The substance, yes: objectives, scope, exclusions and timing are communicated at the opening meeting, which the Standards expect. The full memo, with the risk argument and budget arithmetic, is an internal document; management’s view is recorded in it as an input, not as a party to the decision.
Related guides
- Engagement-level risk assessment — the analysis the memo records.
- The engagement planning memo template — the next document.
- The audit work program — objectives turned into tests.
- Risk and control matrix template — the planning memo’s core attachment.
- The audit process step by step — where scoping sits.
- Risk-based auditing — the plan the scope serves.
- How to create an audit universe — the entity the scope references.
- Assurance mapping — knowing what other assurance exists.
- Risk assessment matrix — rating the engagement risks.
- Audit risk — what an audit can be expected to find.
- Operational audit criteria — what objectives measure against.
- SOX scoping — the same logic for a program.
- The true total cost of an internal audit — the budget side.
- Audit sample sizes — sizing the work.
- Control design principles — the work program’s vocabulary.
- GIAS Domain V: performing — the documentation expectations.
- Audit workpaper example — the downstream file.
- The year-one internal audit plan — setting the sequence up.
- Auditing the underwriting process — the audit this memo scoped.
Leave a Reply