Governance
Documenting approval chains before dual control drifts
Dual control looks strong in a policy PDF and fragile in a release notes archive. Treasury workflow audits for fintech should treat approval chains as living systems: roles, thresholds, overrides, and the code paths that sometimes ignore all three.
Evidence that ages well
Capture screenshots or exports that show who approved, under which role, at which threshold, and whether the second actor was independent. If emergency overrides exist, log who authorized them and how long they remained active.
Also document negative paths: what happens when the checker is offline, when a batch job runs, when a vendor portal uses a shared login. Those are the places dual control usually drifts.
A short documentation habit
After each treasury-related release, write a five-line note: rails touched, approval logic changed (yes/no), compensating detective control if preventive control weakened, owner, and link to ticket. That habit turns the next audit into retrieval, not archaeology.
Aiapptools workshops on approval chains walk teams through a feature-flag bypass scenario and require a compensating control memo before the session ends. The point is speed with integrity — not paperwork for its own sake.