I’m working on financials-related software that has increasing involvement with our internal compliance/audit team.

I totally agree with your premise, although in practice I’ve found that the phrase “review the findings and ensure the software was working properly” snuggles in a lot of complexity. It implies that working properly is well-defined and formally verifiable, when it usually isn’t.

I’ve had very frank meetings where I’ve explained that, ultimately, log statements can be totally fictional, and we can technically pay out amounts that diverge from the amounts in a report. The amount of trust you have in the developer and your dependencies are the weakest links in the chain, and, if you’re honest in explaining to that level of detail, most compliance minded people come away uneasy. But this is how every company operates?

There’s definitely a need for verifiable money transfer infrastructure, but I think most companies that roll their own payment infrastructure would rather pretend that the problem is a boogeyman.