Illustrative materiality threshold
$10,000
IllustrativeScenario
Enterprise services and SOX-style segregation of duties
Late-stage or public company where every refund over a control threshold needs two named approvers, an evidence chain, and an audit-ready export at quarter end.
Reference numbers
What the math looks like in this pattern.
Illustrative approver SLA
1 business day
IllustrativeBefore Axiru
The pain we hear about over and over in this pattern.
- Refunds above the materiality threshold are approved over email or in Slack, which is not an audit artifact the auditors will accept.
- Segregation of duties is documented as a policy but enforced by trust, because there is no system that prevents the same person from initiating and approving.
- Quarter end requires a multi-day scramble to assemble refund evidence by hand for the auditor sample.
- SOX 404 narratives describe a control that the system does not actually enforce.
Configuration
How Axiru is set up for this pattern.
These are the policies a finance or ops team would typically enable on day one. Thresholds shown are illustrative; you tune them to your own materiality. Some configurations describe the target design: capabilities such as velocity rules, telemetry lookups, and scheduled exports ship with the v2 policy editor and are labeled in build where relevant.
Two-person approval over materiality threshold
refundsRefunds above an illustrative $10,000 threshold route to Axiru's standalone dual approval gate: two distinct approvers with different roles, and the initiator cannot be either approver. Wiring the gate directly into the refund approval path is in build.
Evidence pack on every above-threshold decision
refundsEach high-value decision generates a downloadable evidence pack including the policy, the two approvers, the inputs, the timestamps, and the cryptographic hash chain reference.
Quarterly export to GRC system
refundsAbove-threshold decisions export in CSV or JSON for the company's GRC platform (Workiva, AuditBoard, ServiceNow GRC). Scheduled delivery is on the roadmap; today the export is on demand.
Signals to watch
What you should be measuring once this is running.
- Approval bypass rate. Should be zero. If non-zero, the policy or the role assignments need to change, not the data.
- Median time from initiation to second approval. A long tail signals approver bandwidth, not policy correctness.
- Auditor sample request response time. Going from days to minutes is the canonical measurable win.
What good looks like
The steady state if the configuration is doing its job.
- Audit sampling is a download instead of a fire drill.
- Segregation of duties is enforced by the system, not by trust.
- The SOX 404 narrative describes a control the system actually enforces.
Framing
The shift to aim for is not 'we added a control'. It is 'the control is real for the first time'. That is the difference an auditor looks for.
Next step
Run the enterprise services and sox-style segregation of duties simulation on your own data.
Upload 90 days of refund history. Axiru replays these policies in shadow mode. Nothing actually blocks any money until you flip the switch.
Start in shadow mode first. Move to live enforcement later.