Self-assessment
Withdrawal path and vendor access
Answer yes, no or unknown from evidence you can show: a config, a log, a contract clause, a test. You get a summary by section of where the gaps are. It takes about 90 minutes with the right people in the room.
Nothing leaves this page. No server receives your answers. The page sets no cookies, loads nothing from other sites and stores nothing, so closing the tab clears it. If you choose to email us a summary, you send it yourself and can edit it first.
Not sure which review fits your set-up? Size a review in two minutes.
Choose a checklist
Your summary
How to read it
- A question is on target when your answer matches the healthy one. For most questions that is "yes". For a few, such as "Can one person satisfy more than one approval step?", the healthy answer is "no". The summary shows which.
- "Unknown" counts as not on target until evidence exists. Finding out is itself the work.
- There is no single score on purpose. A number invites a pass mark, and there is none.
- Sections 2 and 3 of the withdrawal-path list, and section 3 of the vendor list, deserve attention first: that is where the content of a request can be changed on its way to the chain.
What this is not
A self-check. It is not an audit, a certification, a regulatory submission or legal advice, and it does not test any system. It tells you what you know and can show.
Want a second pair of eyes?
An independent review answers these questions from evidence in your systems and contracts, and reports what it confirms and what it cannot. See withdrawal-path review: scope and method.