I designed the controls that catch fraud. Now I build AI that can't skip them.

The Controller years

For twelve years I closed the books. If you've never done it, here's what that means: every month, the numbers a whole company runs on have to be true by a deadline, and I was the person responsible for making them true. I ran a three-day month-end close — fast for a reason, because a slow close is usually a close that's hiding something. I owned payroll for roughly fifty people, which is a polite way of saying that if I got it wrong, fifty households felt it. And I designed internal controls: the boring, load-bearing rules that decide who can move money, who has to approve it, and how you prove afterward that the right person did.

That last part is the whole job, really. A Controller isn't paid to be fast. A Controller is paid to be defensible. When an auditor sits across from you, or a partner asks why a payment went out, you don't get to say "the system handled it." You have to show who approved it, when, and on what basis. No record, no answer, no defense.

The moment AI broke the finance team

So when AI showed up promising to automate all of it, I watched closely. The demos were genuinely impressive. The AI reads the invoice, codes it to the right account, routes it for approval, marks it done. Clean. Fast. Magic.

Because the demo only ever shows you the happy path. It shows the AI being right. It never shows you the day it's wrong and you're the one explaining it to the client, the board, or the auditor — with no record of what the AI did or who actually signed off. I'd spent twelve years building the controls that prevent exactly that, and here was a wave of tools cheerfully throwing them away in the name of saving time. The risk was never that the AI would make a mistake. People make mistakes; controls exist for that. The risk was that you couldn't reconstruct what happened. An AI that can mark its own homework isn't a system. It's a liability with good marketing.

What I built instead

So I built the part everyone else skips. Three rules, and I don't break them:

• The AI's "I'm done" releases nothing. When the AI says it finished, that's a claim, not a fact. Money doesn't move and nothing ships until an independent check — a separate process the AI can't influence — proves the work. The worker doesn't get to grade its own homework.
• Risky steps stop for a human. Anything over a threshold you set — a new vendor, a bank-detail change, a payment above a limit — halts and waits for a person to approve. The gate is real code that stops, not a slogan on a slide.
• Every step writes to a tamper-evident log. Each action is recorded so that if anyone quietly edits it after the fact, the record breaks visibly. Change one byte and verification screams. That's the difference between an audit trail and a text file — and most tools ship the text file.

That's it. Not the magic — the boring, load-bearing part. I don't sell AI that saves you time; plenty of people sell that, and most of it works great until the first exception. I sell AI you could defend in an audit. I red-team my own code and write NO-GO on it when it doesn't pass, because the honest verdict is the product. If you've got a finance process you'd love to automate but can't quite bring yourself to trust — that's the conversation I have all day.

Don't trust me — verify me.

I'd rather show you than tell you. Two places to go next:

• See it work on the Proof page — three demos you can watch without booking anything: an AI catching a fake bank-change invoice, a scan of what AIs say about your company, and a tamper-evident log that breaks when you change one byte.
• Will your AI pass an audit? — the checklist I'd run against any AI workflow before I'd defend it to a Controller.
• How AI invoice fraud detection works — the exact pattern that catches a fake "update our bank details" invoice before payment.
• What a real audit trail looks like — tamper-evident records vs. a log file anyone can quietly edit.