Hacker News Reader

Comment by pcl | Hacker News Reader

> employees of the FTX Group submitted payment requests through an on-line ‘chat’ platform where a disparate group of supervisors approved disbursements by responding with personalized emojis

This seems like a totally legit approach to me -- ChatOps for expenses, essentially. The usability of "an on-line 'chat' platform" (presumably Teams / Slack / Discord / equivalent) is much better for the employees than most finance tools, and most chat apps these days should have pretty great auditability capabilities.

(Of course, the rest of this FTX fiasco is a total disaster.)

View on HN

Wow, no.

I suppose it would be fine if you had a Slack integration that was a front-end to a proper piece of accounting software.

But a completely ad-hoc system where accounting and auditors have to grep a giant chat log for an emoji is going to get you sent to some special level of finance hell. Nobody will have any transparency into why a request was approved, who approved it, and why. How do you possibly hand off the history of reimbursements to someone who is hired later, and how do you possibly create a structured report for auditors?

And I’ll even object to your supposition that finance software is hard to use. We use Brex for a corporate card, and it’s a totally smooth process, with a great app and website.

Not disagreeing here, just adding notes.

An example of a Slack integration front-end to proper software: Ramp[0] has a decent Slack integration for in-Slack reimbursement approvals. It's easier than navigating their web app.

Also, Brex is pretty polished today but even they started out as a junk show. Stripe started out as total chaos. Many of the neobanks... Most fintech startups out there started as three engineers in a trench coat 1) hustling for traction then 2) scrambling to get a scalable (and auditable, and reconciling...) system in place before user growth crushed them.

[0] https://ramp.com/

Oh, sure, to be fair, I only just started with Brex.

And I am comparing their website to consumer-facing Chase—was just superficially impressed how much nicer Brex’s UI looks, and also feels more performant.

It is not legit when you are a business of this magnitude in finance.

Chatops for TechOps? Totally, no one cares if you’re down, there’s little regulatory impact. Accounting and finance? Not even once. (Caveat around TechOps is IAM privs as it relates to SOX, GLBA, etc)

(a component of my work is providing guidance to fintechs on governance and controls with respect to various nation state regulatory frameworks)

Ho Ho Ho.

Nope! That is never going to pass muster with the auditors. You have actual legal responsibilities in corporate accounting, you can’t just make it up as you go along doing whatever seems easiest without ending up in prison.

Yeah, I'm sure EY will be totally nonplussed and have no further questions. Oh, you used ephemeral messaging for requests and approvals with no audit trail? Totally compliant, ok, now, let's look at dual approvals...

It worked for Wirecard.

Wirecard seems to be a kindergarden party compared to FTX so.

Thinking of it, FTX and Wirecard are hard to compare.

Agreed. It's certainly possible to build way more robust controls using chatops than email or some internal "enterprise" app. FTX may not have implemented it this way, but one could envision the chatops automatically requiring approvals from the correct people based on dollar amount and expense type. And requiring those people to 2FA with their approval.

So, basically building auditable accounting systems in house instead of buying existing solutions? Yeah, but no.

There are a lot of fucked up things about FTX, but "omigod they didn't use SAP" isn't one of them.

Assuming I was talking about SAP when saying accounting systems, for what is basically banking, shows a certain lack in understanding either of those systems.

My finance colleagues (Fortune 100 company) who spend all day updating the general ledger in SAP will be interested to learn SAP doesn’t make accounting systems.

AFAIK they were using Signal with auto-delete turned on. If true, this is a great way to avoid auditability.

That's not really how auditing works though. If there is a legal requirement to keep records of communications between senior managers (and there is for financial institutions), then "we purposely used an app that deletes such communications to hide our actions from the auditors" is in itself a crime.

Well, they are learning from the “best”: politicians [1].

[1]: https://www.theguardian.com/politics/2019/dec/17/tories-swit...

That's just modern double entry bookkeeping - 1 write, then 2 erase. If any transaction isn't erased, it leaves an audit trail for investigation.

This is actually standard within financial institutions and big corps. It's not implemented as "signal with auto-delete turned on", but rather as retention policies on emails or whatever.

Except the retention on emails, for instance, is usually 7 years. Not exactly the same as auto delete after read... It's an apples to oranges comparison.

And the relevant transactions and approvals get recorded in other media for even longer periods in auditable forms.

A slack exchange saying, "Hey, would you approve this expense?" "Sure" isn't a problem. It's the lack of formal follow ups in an auditable medium that is.

Worked for a major US bank. 2 years max on email. You don't want discoverability back 7 years.

Noooope. Slack isn’t providing the kind of financial controls or guarantees necessary. There’s no reporting. Presumably any admin can manipulate or delete messages, etc.

Exactly, they would need a immutable, distributed ledger to accounts for their client immutable centralized and vaporized ledgers.

Sounds like a dream for employees, I don't care what's under the hood. I have unclaimed business expenses because the reimbursement portal is so shit.

Unclaimed expense beats sitting in prison.

Never underestimate the force of procrastination.

> and most chat apps these days should have pretty great auditability capabilities.

Most chat apps default configuration isn't going to do this well at all out of the box.

With some significant back end work, you can for sure do this. On the other hand you are probably right about it being a pretty good for end user.

If you don't do the back end stuff properly, you're going to be in a mess and will not pass any sort of real audit.

ChatOps for expenses through Apple's iMessage Finance plumbing tool can tighten up on the formal regulatory oversight and grow new profit centers for Warren Buffet, TSMC, G20 business ambitions.

Reply on news.ycombinator.com