What this audit is not
This is not penetration testing, compliance certification, an exhaustive source-code review or a promise that the company will pass a future audit. It is not investor or acquisition due diligence. Deeper diligence, remediation or rescue work is scoped separately.