What auditors now expect when your trading system changes

Why the routine changes to your trading systems are the ones worth proving.

In any given year, an E/CTRM system is changed many times over: upgrades, patches, configuration tweaks, the occasional migration. Each is planned, checked and signed off. What tends to go unexamined is whether the regulated numbers the system produces still mean exactly what they meant before the work was done.

When a report, a position or a financial figure shifts because the logic beneath it shifted, no trade has to move, and nothing has to look wrong on the screen. The problem tends to surface later, and usually somewhere expensive. Increasingly, it surfaces in front of a regulator. Regimes across energy and commodity trading now ask firms not only for the right answer, but for evidence that the systems producing it were controlled as they changed.

That is harder to show than it sounds. Clicking through the screens after an upgrade confirms the software still runs. It says little about whether a calculation, an aggregation or a reportable field still behaves the way it did last release, which is the thing an auditor or regulator actually wants demonstrated.

A regulated output is only as reliable as the assurance that the system behind it still behaves as intended after every change.

Our whitepaper, The cost of finding out later, looks at how this gap opens, why the usual testing habits no longer close it, and what it takes to establish, before go-live, that a change left your regulated outputs behaving as they did before. It's deliberate about the boundary, too: what this kind of assurance can show, and what it can't.