E-Commerce Platform Audit Requirements
Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, +256 784 464178.
Overview
Use this skill to define a requirements-level audit protocol for e-commerce platforms. It gives the audit a standard, scope, evidence model, legal table, payment scope, integration review, AI review, and remediation backlog so the output is actionable and defensible.
Use When
- Auditing or scoping an audit of an e-commerce website, app, marketplace presence, payment integration, logistics integration, API, data flow, or AI feature.
- Producing remediation requirements for SMEs in a donor or technical assistance programme.
- Reviewing cross-border readiness involving payment, data protection, consent, consumer trust, and platform security.
Do Not Use When
- The task is only visual UX feedback or marketing copy.
- You cannot access enough system, process, or owner interview evidence to support findings.
- Legal advice is required. This skill identifies compliance issues and escalation needs; it does not replace counsel.
Required Inputs
- Platform URLs/apps, architecture notes, payment/logistics providers, data flows, user journeys, admin roles, and support workflows.
- Countries where customers, operations, data processing, or partners are located.
- Known AI/recommendation/fraud/personalisation tools.
- Existing policies: privacy notice, terms, returns, consent, security, incident handling.
Workflow
- Define audit scope and evidence access.
- Set standards baseline: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, CVSS, PCI-DSS where payment card scope exists, and NIST AI RMF for AI use. For ASVS, record the exact stable release in the audit scope and use version-qualified requirement IDs. As checked on 2026-09-26, v5.0.0 is the latest stable release; recheck the official project before each engagement and do not use bleeding-edge content as a production baseline.
- Map architecture, integrations, data flows, roles, permissions, and third-party dependencies.
- Scope payment security. Identify hosted redirect, embedded checkout, card data exposure, mobile money/gateway flows, reconciliation, settlement, refunds, and chargebacks.
- Map privacy and consumer-protection obligations by jurisdiction using the verified EAC data-protection table and escalate uncertain legal questions.
- Review AI use for data provenance, human oversight, bias, explainability, security, and EU AI Act exposure where relevant.
- Produce a remediation backlog with severity, business impact, owner, effort, dependency, and acceptance criteria.
- Write a founder-readable executive summary and a technical appendix.
Quality Standards
- Every finding maps to a named standard, law/regime, policy, or observed evidence.
- PCI scope matches the real payment architecture.
- Country legal statuses use the verified table and are dated.
- AI review states whether AI exists, what data it uses, and what risk class/escalation applies.
- The remediation backlog is prioritised, owned, and testable.
Anti-Patterns
- Vibes-based security review with no standard.
- Over-scoping PCI for a company that never touches card data.
- Using stale data-protection-law status.
- Proposing a payment rail without country coverage and reconciliation checks.
- Findings with no severity, owner, or acceptance criteria.
Outputs
- Audit scope and evidence request list.
- Security, API, payment, integration, privacy, AI, and data-flow audit checklist.
- Verified EAC data-protection table reference.
- Remediation backlog.
- Founder executive summary and technical appendix requirements.
References
references/audit-scope-and-standards.md: Scope, standards, evidence, and payment/AI review.references/eac-data-protection-table.md: Verified EAC data-protection status table and legal-use rules.references/remediation-backlog-template.md: Backlog fields, severity, business impact, and acceptance criteria.
Evidence Produced
| Category | Artifact | Format | Example |
|---|---|---|---|
| Correctness | E-commerce requirement and evidence matrix | Markdown table | journey, requirement, risk, oracle, evidence owner, and disposition |
Inputs
| Input | Required | Purpose |
|---|---|---|
| Markets, actors, and data flows | yes | Bound the audit |
| Payment, integration, and hosting inventory | yes | Identify controls |
| Evidence access and legal constraints | conditional | Set assurance depth |
Decision rules
| Condition | Action |
|---|---|
| Payment or personal-data scope unclear | Stop and resolve scope |
| Evidence supports a conclusion | Record finding and evidence |
| Evidence absent | Mark not assessed |
Degraded mode
If systems or evidence are unavailable, issue a document-only gap assessment with untested controls separated from findings; do not provide compliance assurance.
