Reversals that never reach the committee
Staff unlock and force-post paths are not a scandal. Unreviewed ones are.
Mobile banking applications need a way to clear a stuck instruction. The control is not the absence of that button. It is whether the log names a person, a reason, and a later reader.
We sample reversals, force-posts, and session unlocks, then ask who last opened the exception report. If the answer is “operations, sometimes,” the audit committee is hearing a story the application cannot support.
A short monthly exception pack—counts, names, and uncleared items—is usually enough. The examination we sell is the first reconstruction, not a permanent monitoring product.