Payment Ops Audit: 12 Things to Check Before You Scale

Definition

A payment ops audit is a systematic review of your payment infrastructure: processing, webhooks, reconciliation, dunning, fraud, and monitoring: before scaling volume. It identifies silent revenue leakage, compliance gaps, and failure modes that only surface under load.

Why Audit Before Scaling

Payment systems that work at €100K/month break at €1M/month. Webhook queues overflow. Reconciliation gaps compound. Dunning emails hit rate limits. Fraud rules tuned for low volume block legitimate customers.

We have seen companies lose 5–12% of revenue during scale-up due to undetected payment failures. A pre-scale audit costs 2–3 days. Recovering lost revenue after a bad quarter costs months.

The 12-Point Checklist

1. Webhook Delivery Reliability

Check: Stripe Dashboard → Developers → Webhooks → failure rate over 30 days.

Pass criteria: under 0.5% failure rate, under 2 second average response time.

Common failure: Endpoint timeout during heavy processing. Fix with async queue:

app.post('/webhooks/stripe', async (req, res) => {
  const event = verifyWebhook(req);
  await queue.add('stripe-event', event, { jobId: event.id });
  res.status(200).send('queued'); // Respond immediately
});

2. Idempotent Event Processing

Check: Search logs for duplicate event.id processing.

Pass criteria: Zero duplicate side effects (double charges, duplicate entitlements).

async function processEvent(event) {
  const existing = await db.processedEvents.findUnique({ where: { id: event.id } });
  if (existing) return;
  await db.$transaction([
    db.processedEvents.create({ data: { id: event.id, type: event.type } }),
    handleEventLogic(event)
  ]);
}

3. Payment Success Rate by Method

Check: Break down success rate by card brand, SEPA, PayPal over 90 days.

Pass criteria: Cards >92%, SEPA >95% (excluding insufficient funds).

4. Reconciliation Completeness

Check: Compare Stripe balance transactions to internal ledger for last complete month.

Pass criteria: Zero unexplained variance over €1.

-- Find Stripe charges missing from internal ledger
SELECT sc.id, sc.amount, sc.created
FROM stripe_charges sc
LEFT JOIN internal_payments ip ON sc.id = ip.stripe_charge_id
WHERE ip.id IS NULL
  AND sc.created >= '2026-04-01'
  AND sc.status = 'succeeded';

5. Refund and Dispute Handling

Check: Verify every charge.dispute.created and charge.refunded event updated internal state.

Pass criteria: 100% of disputes logged with evidence submission deadline tracked.

Disputes have 7–21 day response windows. Missing webhook = automatic loss.

6. Dunning Effectiveness

Check: Measure recovery rate for failed subscription payments.

Pass criteria: >25% recovery within 14 days of first failure.

7. Entitlement Sync Accuracy

Check: Sample 50 active subscriptions. Compare Stripe status to product access.

Pass criteria: 100% match. Zero users with access after cancellation. Zero blocked users with active subscription.

8. PCI Scope Minimization

Check: Confirm no raw card data touches your servers.

Pass criteria: SAQ-A eligibility (Stripe.js/Elements/Checkout only). No card numbers in logs, database, or error reports.

# Scan logs for card number patterns
grep -rE '\b[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b' /var/log/app/
# Must return zero results

9. Fraud Rule Calibration

Check: Review blocked transactions for false positives. Review successful fraud for false negatives.

Pass criteria: under 2% false positive rate, under 0.1% fraud rate on processed volume.

Use Stripe Radar rules with graduated response (review vs block), not blanket blocks.

10. Currency and Tax Accuracy

Check: Verify tax calculation for top 5 customer countries. Verify FX rates for multi-currency.

Pass criteria: Tax amounts match manual calculation within €0.01. FX within 0.5% of ECB rate.

11. Payout Reconciliation

Check: Match Stripe payouts to bank deposits within 2 business days.

Pass criteria: 100% of payouts matched. Zero orphaned bank deposits.

SELECT p.id, p.amount, p.arrival_date, b.amount as bank_amount
FROM stripe_payouts p
LEFT JOIN bank_transactions b ON p.id = b.reference
WHERE b.id IS NULL AND p.status = 'paid';

12. Monitoring and Alerting

Check: Confirm alerts fire for payment failures, webhook errors, and reconciliation gaps.

Pass criteria: Alerts reach on-call within 5 minutes. No alert fatigue (>5 false alerts/week).

Essential alerts:

• Webhook failure rate >1% (5-minute window)
• Payment success rate drop >5% (hourly)
• Reconciliation variance over €100 (daily)
• Dispute created (immediate)
• Payout failed (immediate)

Audit Scoring

Remediation Priority

Fix in this order: highest revenue impact first:

1. Webhook reliability + idempotency (prevents state corruption)
2. Reconciliation completeness (finds existing leakage)
3. Dunning effectiveness (recovers failed payments)
4. Entitlement sync (prevents access/revenue mismatch)
5. Monitoring (prevents future silent failures)

Automation

Run checks 1, 3, 4, 6, and 11 automatically via cron:

// Daily payment ops health check
async function dailyAudit() {
  const results = {
    webhookFailureRate: await getWebhookFailureRate(24),
    paymentSuccessRate: await getPaymentSuccessRate(24),
    unreconciled: await getUnreconciledCount(),
    dunningRecovery: await getDunningRecoveryRate(14)
  };

  const failures = Object.entries(results).filter(([k, v]) => !passesThreshold(k, v));
  if (failures.length) await alertOncall(failures);
  await db.auditLog.create({ data: { date: new Date(), results } });
}

Scaling Readiness Matrix

Use this matrix to decide whether your payment ops can handle the next growth phase:

Companies processing above €500K/month without passing check 12 (monitoring) discover payment failures an average of 3.2 days after they occur: long enough to lose customers to involuntary churn.

Post-Audit Documentation

After completing the audit, document findings in a payment ops runbook:

1. Architecture diagram showing payment flow from checkout to ERP
2. Webhook event map listing every handled event type and its handler
3. Reconciliation procedure with SQL queries and expected outputs
4. Dunning playbook with email templates and retry schedule
5. Incident response for payment outages, webhook failures, and reconciliation gaps
6. Escalation matrix defining who responds to each alert type

Store the runbook in your team wiki and review quarterly. Payment infrastructure changes frequently: new payment methods, pricing changes, and provider updates all affect ops reliability.

Business Outcomes

Companies that pass all 12 checks before scaling maintain payment success rates above 93%, recover 30%+ of failed subscription revenue through dunning, and close books without payment reconciliation surprises.

Related: Stripe Revenue Leakage · How to Build Modern Payment Infrastructure