Notes
Short notes from control testing audits for financial apps — written for product, operations, and compliance partners.
Sample size is not theatre
How we choose control test samples so exceptions mean something to ops — not just a percentage on a slide.
When maker-checker only exists in the handbook
Payment path control testing often fails at the point where dual control is claimed but the system allows a single actor to complete the flow.
Release gates need owners, not slogans
Change control testing falls apart when pipeline checks exist but nobody owns exceptions from emergency releases.