Reconciliation mismatches trigger alerts with compliance escalation

Logging a reconciliation mismatch to a database table that nobody actively monitors is operationally equivalent to not detecting it at all. SOX §404 requires not only that controls exist but that they operate effectively — a mismatch that sits in a table for weeks without action demonstrates control failure. NIST 800-53 AU-6 (Audit Record Review, Analysis, and Reporting) requires that organizations review and analyze audit records for indications of inappropriate or unusual activity and report findings to designated officials. FINRA Rule 4511 requires that records be available to compliance personnel promptly. Sending alerts only to an engineering Slack channel fails this requirement because engineers are not a compliance role. A discrepancy reaching a compliance officer within minutes of detection is the standard against which examiners measure your controls.

Wire alert delivery directly to a compliance-role recipient in src/jobs/reconciliation.ts or src/services/alerts.ts. Alerts must name the account, the discrepancy amount, and a direct link to the issue record:

if (discrepancy > 0.01) {
  const issue = await db('reconciliation_issues').insert({
    account_id: acct.id,
    system_balance: acct.balance,
    ledger_balance: ledgerTotal,
    discrepancy,
    discovered_at: new Date()
  }).returning('id');

  await mailer.send({
    to: process.env.COMPLIANCE_EMAIL, // must be a compliance role address
    subject: `Reconciliation mismatch — account ${acct.id}`,
    body: `Discrepancy: $${discrepancy.toFixed(4)}\nIssue: /admin/reconciliation/${issue[0].id}`
  });
}

Verify COMPLIANCE_EMAIL is set in your environment and resolves to a monitored compliance or operations mailbox, not a shared engineering alias.