I build tested Python systems for internal audit, compliance, and accounting teams — access reviews, segregation-of-duties testing, transaction anomaly detection, and document verification. Every run leaves a queryable trail of what it checked and why it flagged.
Analytics without audit context finds the wrong things. Automation without engineering discipline breaks quietly. AI without a gate is a liability. The combination is the offer.
Control testing that runs on a schedule instead of on a quarter.
The number, and the reason the number is what it is.
Processes that stop needing a person to remember them.
Applied where it earns its place, gated where it doesn't.
Fourteen synthetic journal entries, four control tests. Press run and watch it work the population row by row — the same shape of output a real engagement produces, minus the client data.
| Entry | Date | Vendor | Amount | Posted | Approved | Result |
|---|---|---|---|---|---|---|
| JE-1041 | 06-01Mon | Meridian Supply Co | 12,480.00 | r.alvarez | k.nguyen | — |
| JE-1042 | 06-06Sat | Delta Freight Ltd | 8,215.40 | j.okafor | k.nguyen | — |
| JE-1043 | 06-08Mon | Cardinal Print | 1,340.75 | r.alvarez | m.shah | — |
| JE-1044 | 06-09Tue | Ridgeline Legal | 22,750.00 | s.patel | k.nguyen | — |
| JE-1045 | 06-10Wed | Orchard Facilities | 4,950.00 | j.okafor | m.shah | — |
| JE-1046 | 06-10Wed | Orchard Facilities | 4,980.00 | j.okafor | m.shah | — |
| JE-1047 | 06-11Thu | Basalt Consulting | 9,600.00 | s.patel | s.patel | — |
| JE-1048 | 06-12Fri | Northgate Utilities | 3,187.22 | r.alvarez | k.nguyen | — |
| JE-1049 | 06-15Mon | Pinewood Logistics | 15,420.90 | m.shah | k.nguyen | — |
| JE-1050 | 06-16Tue | Cardinal Print | 1,340.75 | r.alvarez | m.shah | — |
| JE-1051 | 06-18Thu | Harbor Point Media | 7,300.00 | j.okafor | k.nguyen | — |
| JE-1052 | 06-21Sun | Delta Freight Ltd | 6,140.00 | s.patel | m.shah | — |
| JE-1053 | 06-22Mon | Meridian Supply Co | 2,018.60 | r.alvarez | k.nguyen | — |
| JE-1054 | 06-24Wed | Ironwood Services | 4,875.00 | m.shah | k.nguyen | — |
Synthetic data. Every exception above was planted deliberately — the point is the mechanism, not the findings. A real engagement runs the same four tests against millions of rows and writes each outcome to a table you can query afterwards.
My strongest production work sits behind client NDAs and will not appear on a public site. So these are reconstructions: same techniques, same architecture, fabricated or public data. Status is marked honestly — some are running, some are not built yet.
Quarterly access reviews arrive as inconsistent exports from a dozen systems. The format fights the reviewer, so the reviewer rubber-stamps — and the control becomes theatre.
Normalise heterogeneous exports into one schema, reconcile against the HR roster, and emit a reviewer-ready exception report: terminated users with live accounts, orphaned credentials, privilege creep, and dormant admin access. The reviewer sees only what actually needs a decision.
ERP role assignments accumulate quietly until one person can create a vendor, approve it, and pay it. Nobody granted that combination — it assembled itself over four years of job changes.
A conflict matrix evaluated over synthetic ERP role and permission data, resolving transitive access through nested roles and inherited groups. Conflicts are ranked by whether a mitigating control already covers them, so the output is a work queue rather than a wall of noise.
Fraud hides in populations far too large to sample by hand, and manual sampling finds what it happens to land on rather than what is actually wrong.
Leading-digit conformity testing, duplicate detection, approval-threshold split detection, and round-number bias — run against a public procurement dataset so the whole thing is reproducible by anyone who wants to check the maths.
Signed evidence arrives as scans. Verifying that the right person signed the right document is manual, slow, and the first thing dropped when a deadline compresses.
OCR extraction with signature-region detection, writing structured results and confidence scores to SQL. Anything below threshold routes to a human rather than being silently accepted — the AI is a filter, not the decision-maker.
An autonomous system that moves money needs to be structurally unable to malfunction, not merely unlikely to. This is here as engineering evidence, not as a trading pitch.
Strategy code is architecturally forbidden from importing the broker or the ledger; a risk gate is the sole path to execution. Settled-cash accounting, idempotent order IDs that survive restarts, latching breakers, a stale-data guard, and every rule outcome for every proposed order written to an audit table. Backtests run the identical live stack.
I spent three years at a data analytics and IT audit consultancy building automation for organisations where getting it wrong is expensive — end-to-end accounting automation for a billion-dollar insurer, a data-driven fraud investigation for a Fortune 1000 chain, and segregation-of-duties and access-review programmes across multiple clients. I scoped the engagements, drafted the statements of work, managed the client relationships, and wrote the code.
Today I work in ERP systems and reporting full time, and build audit automation for a large insurance broker alongside it.
What I care about is the part most automation skips: proving what it did. Anyone can write a script that produces a number. A control that cannot produce its own evidence isn't a control — it's a number you have to take on faith, which is exactly what an auditor is not allowed to do.
Based in Chattanooga, TN — where five of the six largest employers carry a permanent controls burden. Working locally and remotely.
Contact