Illustrative example · not a client audit
This example demonstrates the shape of a useful result. The application, observations and findings are fictional; they are not evidence from a customer engagement.
Example: an internal request tool, two user roles, reading and editing requests, export, and available operating documentation. Sampled checks within the agreed time allocation.
Not included: exhaustive penetration testing, load testing, inspection of every dependency, or implementation of fixes. An untested item is not a passed check.
Illustrative evidence: test account B can load account A’s example record by identifier. The interface hides it, but the server does not reject the request.
Next step: enforce server-side checks for read, update and export; verify with two separate test accounts.
Illustrative evidence: a backup job is configured. The agreed review material contains no recorded restore with a data check.
Next step: restore into a disposable environment, inspect records and document the time required.
Illustrative evidence: totals are computed separately in the interface and export, with different rounding behaviour.
Next step: agree one business rule, check representative boundary cases and consolidate the calculation.
First correct and verify the data boundary. Then demonstrate recovery. Consolidate the calculation before adding more export variants. Agree implementation effort separately.
A real report identifies the inspected version, method and limits of the evidence. Severity and recommendations depend on the actual use of the application.
LAUNCH A TOOL / SUPAAPPS
Show us where you are. We’ll help you work out what comes next.
Free 30-minute fit call