Use Case 3: Fragmented Workflows – “The Great Evidence Chase at Snoopy Inc”
Snoopy Inc is an API-first, cloud-native global payment platform. It routes hundreds of millions of transactions per day across card networks, local real-time payment rails, and its own account-based ledger. It issues virtual and physical cards at scale and settles in real time across dozens of currencies and jurisdictions. The platform runs on multi-region Kubernetes clusters, uses event-driven microservices, and exposes everything via well-documented APIs.
On paper, the control environment looks mature. There are access reviews, change management processes, logging standards, segregation of duties, and PCI-aligned card data protections. Then the annual SOC 2 + ISO 27001 combined audit arrives.
Act 1 – The Auditor’s First Request
From the Auditor (email, Day 1 of fieldwork):
Subject: Evidence Request – Privileged Access Reviews (Card Issuing & Real-Time Settlement)Please provide evidence that privileged access to the card-issuing service and the real-time settlement engine was reviewed every quarter for the past 12 months.
Required elements for each review period:
Date of review
Reviewer name and role
Population reviewed (including service accounts)
Exceptions identified
Remediation evidence and closure dates
Please deliver a complete package by end of day Thursday. Incomplete or reconstructed evidence will be noted as a finding.
What happens next is pure fragmentation:
The Identity team owns Okta and the automated access review reports… but only for the corporate IdP.
The Platform Engineering team owns the custom IAM service that governs service-to-service and break-glass access inside the Kubernetes clusters and the payment routing engines. Their “reviews” live in a different tool and a different Slack channel.
The Card Issuing product team has its own admin portal logs stored in a regional S3 bucket that is not automatically correlated.
The Compliance team maintains a spreadsheet that tries to stitch everything together once a year. The last update was eight months ago. Several rows simply say “see ticket” with a Jira number that was closed without attaching the actual review output.
Act 2 – The Scramble
From the Operations / Platform Engineering Lead (Slack + email thread, Day 2):
“We don’t have a single source for this. Okta covers the human admins, but the high-privilege service accounts that actually move money live in our custom IAM. Those reviews are supposed to be automated, but the job broke after the last region failover and no one noticed.Compliance is asking us to reconstruct 11 months of reviews. We’re pulling CloudTrail, Kubernetes audit logs, and old Jira tickets. This is going to take days and the evidence will still look pieced together.Also — who owns the Card Issuing admin portal reviews? That’s not us.”
Three senior engineers and one compliance analyst are pulled off roadmap work. They spend four days:
Exporting Okta reports (missing the service accounts).
Digging through CloudTrail and Kubernetes audit logs for the custom IAM events.
Manually correlating ticket IDs across three Jira projects.
Discovering that two high-privilege service accounts used by the real-time payment router had not been reviewed in 11 months because the automated job had silently failed after a region failover.
Finding screenshots from an old access review that had no timestamps and no reviewer signature.
By the time they assemble a package, the evidence is incomplete, partially reconstructed, and lacks clean attribution. The auditor flags it as insufficient.
Act 3 – Cascading Failures
From the Auditor (follow-up note, Day 5):
The privileged access evidence package remains incomplete. Several quarters lack clear reviewer attribution and service-account coverage. The reconstructed CloudTrail extracts do not constitute contemporaneous review evidence. This will be raised as a control operating effectiveness finding.Please also prepare the same level of evidence for change management on the transaction routing service and continuous monitoring of the CDE logging pipeline.
The same fragmentation appears everywhere:
Change management for the high-volume transaction routing service: approvals live in GitHub, deployment evidence in ArgoCD, post-deployment verification in a separate observability tool, and the formal change ticket in ServiceNow. No single workflow ties the full chain together with timestamps that survive an auditor’s cross-check.
Card data environment (CDE) access and logging: logs are centralized in one SIEM for most regions but still land in a legacy system for two smaller markets. Evidence of continuous monitoring is therefore incomplete.
Real-time account payment reconciliation controls: the automated daily job produces a report, but ownership of exception handling is split between Treasury Ops and the Ledger Engineering team. Several months show “no exceptions” simply because no one closed the loop on the tickets.
From the Operations Team (internal debrief, end of fieldwork):
“We spent more time hunting evidence than the auditors spent testing it. Every control has three owners and five tools. When the automated job fails, no one owns the alert. When the auditor asks for a clean chain, we invent one under pressure. This is not sustainable — and next year the scope will be even bigger.”
The audit findings are not “you lack access controls” or “you lack logging.” They are “you cannot demonstrate consistent, attributable, complete operation of the controls across the audit period.” The root cause is a fragmented workflow: multiple tools, unclear ownership boundaries, manual stitching, and no continuous evidence pipeline mapped to the control statements.
The Colorful Punchline
At 2 a.m. on the final day of fieldwork, a compliance manager is still chasing a screenshot of a privilege review from the APAC region while an engineer in Europe is reverse-engineering CloudTrail events to prove a service account was disabled. The platform processes millions of dollars per minute, yet the evidence of basic control operation is being assembled like a crime-scene reconstruction.
That is the cost of fragmented workflows in a modern global payments platform.
