Illustrative materiality threshold
$10,000
IllustrativeScenario
Enterprise services and SOX-style segregation of duties
Late-stage or public company where every refund over a control threshold needs two named approvers, an evidence chain, and an audit-ready export at quarter end.
Reference numbers
What the math looks like in this pattern.
Illustrative approver SLA
1 business day
IllustrativeBefore Axiru
The pain we hear about over and over in this pattern.
- Refunds above the materiality threshold are approved over email or in Slack, which is not an audit artifact the auditors will accept.
- Segregation of duties is documented as a policy but enforced by trust, because there is no system that prevents the same person from initiating and approving.
- Quarter end requires a multi-day scramble to assemble refund evidence by hand for the auditor sample.
- SOX 404 narratives describe a control that the system does not actually enforce.
Configuration
How Axiru is set up for this pattern.
These are the policies a finance or ops team would typically enable on day one. Thresholds shown are illustrative; you tune them to your own materiality.
Two-person approval over materiality threshold
refundsRefunds above an illustrative $10,000 threshold require two distinct approvers with different roles. The initiator cannot be either approver.
Evidence pack on every above-threshold decision
refundsEach high-value decision generates a downloadable evidence pack including the policy, the two approvers, the inputs, the timestamps, and the cryptographic hash chain reference.
Quarterly export to GRC system
refundsScheduled export of all above-threshold decisions to the company's GRC platform (Workiva, AuditBoard, ServiceNow GRC) in CSV or JSON.
Signals to watch
What you should be measuring once this is running.
- Approval bypass rate. Should be zero. If non-zero, the policy or the role assignments need to change, not the data.
- Median time from initiation to second approval. A long tail signals approver bandwidth, not policy correctness.
- Auditor sample request response time. Going from days to minutes is the canonical measurable win.
What good looks like
The steady state if the configuration is doing its job.
- Audit sampling is a download instead of a fire drill.
- Segregation of duties is enforced by the system, not by trust.
- The SOX 404 narrative describes a control the system actually enforces.
Framing
The shift was not 'we added a control'. The shift was 'the control was real for the first time'. Auditors noticed.
Next step
Run the enterprise services and sox-style segregation of duties simulation on your own data.
Upload 90 days of refund history. Axiru replays these policies in shadow mode. Nothing actually blocks any money until you flip the switch.
Start in shadow mode first. Move to live enforcement later.