Buyers sometimes blur QA audits with regulatory audits or security assessments. Clarity protects everyone: we examine operational quality and release readiness; licensed firms cover statutory and specialised security scopes.
A good statement of work names the product lines, the flows in scope, and the artefacts you will receive. Anything else belongs in a different engagement.
When regulators or investors ask for evidence, your QA pack should show what was tested and what remains residual — not a marketing claim that everything is fine.
If your question is primarily legal or accounting, we will say so early and point you toward the right kind of specialist.