Staging is not the portal
The environment you show reviewers is often tidier than the one customers use. Say so early, or the report will be polite and wrong.
We can review staging. We prefer to know when staging is a different product: older copy, fewer accounts, no real PDFs, a reset mail that never arrives.
Production-only defects are common. Feature flags, CDN rules, and ‘we will turn that on after go-live’ leave a gap that a staging walkthrough cannot see. If production is off limits, we write the limitation on page one.
The honest version of scoping is a sentence: ‘Customers use this URL, with these roles, and this is what we cannot show you.’ Everything after that is method.
When production access is possible with test accounts, take it. The audit is of the portal customers have, not the portal the project plan still describes.