The Check runs on what is already public plus read-only access to whatever exists. No questionnaire, no asset list, no homework. The most common way an engagement dies is being asked for things before it has earned them.
From youPermission to look, and read access if you have accounts to share.