Every change that hits production should be done for a valid business reason. That is the control point-of-focus.
On the surface it sounds uncontroversial. Of course every change has a reason — the team is professional, the product owner is engaged, the work is tracked. The delivery team would tell you they have this covered.
If your delivery pipeline produces working software but you still spend weeks assembling audit evidence, the pipeline isn’t finished.
Why does CI/CD stop short of compliance? Read More »
Thirty-five years inside this industry have taught me one thing about compliance: it isn’t a paperwork problem, it’s a design problem. Architect the system to produce its own proof, and the audit “problem” stops being one.
Thirty-five years of building banking software taught me one thing about compliance Read More »
After thirty-five years inside the audit-versus-engineering meeting, the case for why both sides are right — and why the duplicated approvals look like cover-your-ass to the only person actually carrying accountability.
Why your audit team and your DevOps team are both right Read More »
