1 min lesson
Controls, SOX & audit
Compare two rows from "Controls, SOX & audit", then say when each one fits.
Step 1 of 2
Cursor is pre-IPO and growing fast and the JD prizes pre-IPO experience for a reason: someone will have to make this stack SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. Press Enter for the full definition.-ready while it's still being built. Controls aren't a phase after the system; they're a property you design in.
The fear an auditor brings to an automated finance stack is simple: if a machine did it, who's accountable and can I re-perform it. Your job is to make the answer obvious. Three controls cover most of that ground.
- Control
- Segregation of duties
- What it means
- The person who builds or initiates a change can't be the one who approves it
- Evidence it produces
- Distinct author and approver on every PR / posting / payment
- Control
- Access controls
- What it means
- Least-privilege roles; write access to ledgers is scarce and reviewed
- Evidence it produces
- Role assignments, periodic access reviews, deprovisioning logs
- Control
- Change-approval evidence
- What it means
- Every production change is reviewed, approved and traceable
- Evidence it produces
- PR diff, approver, CI result, deploy log tied to a ticket
| Control | What it means | Evidence it produces |
|---|---|---|
| Segregation of duties | The person who builds or initiates a change can't be the one who approves it | Distinct author and approver on every PR / posting / payment |
| Access controls | Least-privilege roles; write access to ledgers is scarce and reviewed | Role assignments, periodic access reviews, deprovisioning logs |
| Change-approval evidence | Every production change is reviewed, approved and traceable | PR diff, approver, CI result, deploy log tied to a ticket |
Notice these are the same artifacts your engineering pipeline already produces - controls fall out of good hygiene.