Field notes · 11 March 2026

Reversals that never reach the committee

Staff unlock and force-post paths are not a scandal. Unreviewed ones are.

People in a meeting around a conference table

Mobile banking applications need a way to clear a stuck instruction. The control is not the absence of that button. It is whether the log names a person, a reason, and a later reader.

We sample reversals, force-posts, and session unlocks, then ask who last opened the exception report. If the answer is “operations, sometimes,” the audit committee is hearing a story the application cannot support.

A short monthly exception pack—counts, names, and uncleared items—is usually enough. The examination we sell is the first reconstruction, not a permanent monitoring product.