What controls can a public service use?
Named user roles, approval steps, transaction logs, payment references, settlement reports, backups and incident records can show who acted, what changed and how a payment reached the receiving institution.
What does an audit need to state?
A useful audit names the service, period, records tested, standard applied, findings, management response and closure status, allowing readers to separate a finding from the action taken afterward.
Who owns the public accountability duty?
The responsible public authority keeps its legal duties for policy, public money and oversight, with a provider supplying agreed system records and support within the contract governing that service.