Four systems have to agree, and only one of them is the ledger
By the time a ledger reaches production it is touching core banking, the general ledger, the reconciliation system and an identity provider — each with an owner, a change window and a different idea of when a transaction happened. The engineering that decides the programme is not the contract; it is the adapter layer and the daily close that has to reconcile without a person in it.
Three engagements we are asked for
Core banking and ERP adapters
Event mapping, idempotency keys and replay, built so that a repeated message is harmless rather than a duplicate posting.
Needs: an owned interface contract · a change window · a replay test
The daily close
Reconciliation between the chain and the books, with a tolerance, a break queue and a procedure that says which record is authoritative while a break is open.
Needs: a stated tolerance · a named break owner · an escalation path
Signing boundary into existing controls
Mapping an approval policy onto the bank’s existing segregation of duties, rather than inventing a parallel one.
Needs: the current control matrix · an HSM or MPC decision · an audit sign-off
What we will tell you not to do
Published because it is the fastest way to find out whether we are the right firm for this — and because it is what we say in the room.
Do not go live without running the close in parallel
Parallel running for a full reporting cycle is the only test that finds a rounding rule nobody documented.
Do not let the integration invent a second identity system
If a person’s access is not governed by the institution’s identity provider, the control environment has a hole with a project plan attached.
Do not scope integration as a phase-two item
This is where the majority of the cost sits. A plan that treats it as an afterthought is not a plan, and we will re-scope it before we quote.
Evidence
- Credit data system on a public ledgerpermission pending
- Settlement infrastructure, gold-backed monetary systempermission pending
No client is named without fresh written permission. Entries above are the record as it stands, including the ones we cannot yet name.
Read next
Start a conversation
Tell us which of the three above is closest, and what has to be true for it to work in your control environment.