Data you should be able to export before we arrive
If a vendor cannot give you a file, that fact belongs in the audit. Here is the minimum set we ask for.
Independent review depends on files you already have a right to. We do not scrape production. We do not ask for a database dump. We ask for exports the application claims to support, plus a few screens we will walk with a supervisor.
For a WMS: location master, a week of receiving and shipment confirmations, cycle-count results, and exception or override logs. For a TMS: planned versus actual departures, carrier allocation, POD records, and detention events if the module exists. For last-mile: attempt histories, failed geocodes, COD settlements, and a sample of buyer-visible status changes with timestamps.
User lists with roles help us see permission drift. We do not need passwords. We do need to know whether a picker can adjust inventory, and whether that ability is documented.
Personal data should be minimised. Mask buyer phone numbers and rider home addresses before you send files if your usual process allows it. We are a Malaysian practice and treat personal data under the Personal Data Protection Act 2010; the privacy page on this site states how.
If export is impossible without a professional-services quote from the vendor, tell us. That constraint is itself a finding. An application that runs a warehouse but cannot produce its own history is a different risk from one that merely has a messy history.