Capstone: The compliance review

Before the workflow earns its readout, it faces the review every finance system eventually faces — performed by you, on the record, with the standard tools. Self-audit is the capstone's differentiator: anyone can demo a pipeline; certifying that you can evidence one is what the credential means.

1. 1The backward walkthrough, timed: pick two processed items (one clean, one exception) and trace each from final disposition back through review record, raw AI output, prompt version, and input document. Under ten minutes each, no improvisation, screenshots as you go — this becomes the submission's evidence appendix.
2. 2Control-matrix verification: for every row in your matrix, point at the operating evidence from the soak — the log entries, the seeded catch, the threshold history. Mark each row operating / designed-but-thin / not yet real. Rows in the third category don't disqualify; hiding them does.
3. 3The simulated auditor Q&A: run your AI assistant as an IT-literate financial auditor over your design doc + matrix + logs: 'Ask me the twelve hardest questions about this workflow's controls, one at a time; challenge my answers; do not accept assertions without evidence locations.' Transcript goes in the submission. Expect to get caught at least once — the config-access question and the vendor-model-change question catch nearly everyone — and fix or honestly log what it catches.
4. 4Write the deficiency list: 3-6 items, plainly stated, each with severity, compensating control if any, and remediation owner/date. Real examples from past cohorts: 'raw outputs retained only 30 days — extending to audit-period retention', 'seeded test performed by the reviewer's teammate — moving to controller's office', 'no degradation SOP tested — manual-keying drill scheduled'. A capstone with zero deficiencies found gets extra scrutiny, not extra credit.
5. 5The verdict paragraph: would you sign this workflow's controls as operating effectively for the soak period — with the deficiency list attached? Yes-with-exceptions is the professional answer; write it the way you'd want to read it from someone else.