Compliance reporting: column lineage, deterministic batches, audit replay

Context

Board and regulatory submissions required multiple reconciled numbers drawn from ERP, the data lake, and manual adjustment tables. Auditors previously challenged “matching totals with no explainable lineage”.

Constraints

Column lineage was incomplete; some batch jobs used non-deterministic ordering; manual adjustments lacked dual control and version freeze.

What we did

We registered column lineage and transformation rules, introduced deterministic sort keys and checksum outputs for batches, and routed manual adjustments through controlled workflows tied to change records. Each report run persisted parameter snapshots to support bit-identical replay.

Outcomes

Auditors could reproduce numeric paths within hours; differences between board and regulatory views became documented and explainable; non-deterministic errors disappeared.

← Back to case studies

Practical notes

When you translate this narrative into your backlog, keep acceptance tests adjacent to risk items: what would falsify the assumption that the control works end-to-end?

If procurement needs evidence packs, ask for redacted samples of artefacts we produce under similar engagements (pipeline gates, change records, runbook excerpts)—subject to confidentiality.

Questions aligned to this case study

How should we validate recommendations in production?

Start with non-production parity tests, canary slices, and explicit rollback owners. Measure business-critical transactions—not only infrastructure CPU.

What is the most common gap after technical delivery?

Operational ownership: dashboards without on-call routing, runbooks without named substitutes, and secrets without rotation drills. Close those gaps in the same programme, not as a separate “Phase 2”.

How do we integrate audit expectations?

Map controls to tickets and releases: who approved, what changed, what evidence exists. Narrative-only compliance rarely survives scrutiny.

When should we involve legal or privacy teams?

Before irreversible data migrations and before selecting subprocessors that will access personal information. Retrofitting lawful basis is painful.

What teams tell us after delivery

Composite themes from Australian enterprise and cross-border programmes—we do not attribute quotes to named clients on this marketing site.

Engineering finally had one reconcilable story with finance on cloud spend because tagging, budgets, and variance notes were wired into the same monthly export.

Head of Platform, regulated industry

Rollback stopped being a debate. Release records, canary gates, and feature-flag owners were written down before go-live, which shortened incident review.

Principal engineer, national operator

Insights library

Governance and engineering notes.

Contact

Introductions and follow-up questions.

Send a structured note

Opens your email client with a pre-filled message. For pricing bands use Request a quote.