A working-papers system of record for
chartered accountants

No, and it is built so that it cannot quietly start to. It computes what the figures come to under the rate set for the assessment year, under the regime and the treatment somebody selected. Choosing the treatment, choosing the regime, and taking responsibility for the position are the member’s, and the deliverable is a watermarked draft until a partner signs it. Where a question is a matter of judgement rather than arithmetic, the software takes it as an input and says so.

Every table the engine produces is cross-footed before anything downstream runs. If the arithmetic does not hold, the job ends in a state that is not a failure — it is the software working — and it names the account and the amount it is out by. It also runs the three checks a member runs by hand: an account carrying exactly the difference, an account carrying half of it, and the divisible-by-nine test that catches a transposed pair of digits. If none of those fires it says so plainly rather than guessing. There is no bypass flag anywhere in the software, and the build fails if somebody adds one.

The computation is refused. It is never performed with the previous year’s slabs, because that produces a figure of exactly the right shape and the wrong amount — which is the version of this failure nobody catches until an assessment. Rate sets are effective-dated rows loaded from reviewed, checksummed sources, one per assessment year, and every computation records the checksum of the set that produced it. You can also read what will be applied before a computation runs.

Prose about figures it never originates: the scope, the background, the methodology narrative, observations and commentary. Every number in the rendered document has to come from a computation line, and a figure appearing in a drafted paragraph with no line behind it blocks the render rather than being corrected later. The line between the two is enforced by a validator, not by a prompt asking the model to behave.

Because a cleared item with no explanation is indistinguishable from one somebody deleted because it was inconvenient, and it is the first thing a peer reviewer checks. Making it a required field rather than a convention means the record cannot degrade into a list of items that were closed for reasons nobody wrote down. The same reasoning puts the approval rule in the schema too: the person who proposed an adjustment cannot be the person who approves it, and that is a database constraint rather than a check in a controller.

Money is an exact decimal in the database, in the engine and in the browser, and the arithmetic layer raises on a float rather than coercing one — by the time a float arrives the precision is already gone, so the fix belongs upstream. The difference is not theoretical: the same 5,000-row bank reconciliation ties to exactly zero in exact decimals and leaves a residual of about minus three-ten-millionths in floating point. A residual that small is worse than a large one, because it looks like a rounding artefact rather than a defect.

The firm sits on every row and is applied in the layer that builds the query, so scoping has one place it can be forgotten rather than one per endpoint, and a build in which a data function can be called without a scope fails. A read, list, search or download across firms answers as though the record does not exist — a 404 rather than a refusal, because a refusal confirms the record is there, and a real engagement id is a fact about another firm’s client list.

Yes. The console is one client of the API rather than a wrapper around a private one, and completion callbacks are signed over the exact bytes sent, so a receiving system can verify a reconciliation arrived intact and reject a tampered one. Exports come as documents, as spreadsheets with the working and the cross-references intact, and as structured data — an accounting system can read the figures without a person retyping them.