How to IT audit VAS ( Value added services ) in telecom companies?

Dears

The internal audit team is planning for an audit on the Value added services (VAS) for telecom companies, I wonder if someone has a previous experience with such an audit to share with me his experience

 The areas the internal audit team are checking for, is there a check list I must review before the audit in terms of (documentation, policies, processes, plans, frameworks, areas they need to audit....) I must review to make sure I am covering all the points they need to check.

 Maybe someone has experience in one of the two sides (Internal Audit or InfoSec section) can help.

 Thanks,