Tools, Frameworks & Audit Resources

A TradFi audit case tracing four compounding control failures in a Position Limit Monitoring (PLM) system: a superseded CFTC 17 CFR Part 150 regulatory standard never updated in code; OTC swap positions excluded from the aggregate the regulation requires; a third-party vendor delta settlement price error accepted without independent validation; and no detection mechanism for any of the above. Structured around the three audit assertions — Completeness, Accuracy, and Timeliness — applied to a production pre-trade risk system. Each failure individually is a finding. In sequence they produce a regulatory exposure that appears controlled at the surface.

Six control areas mapped to the PRC lifecycle — Reserve Integrity, Key & Wallet Security, ITGC, AML/BSA, Redemption Controls, and Governance & Attestation. What to build first, in what order, and what evidence OCC examination standards require. Derived from the GENIUS Act and OCC proposed rule 12 CFR Part 15. For stablecoin issuers and PPSI applicants building controls infrastructure for the first time.

43 priority-coded control requirements derived from the Stablecoin PRC Mapping — one per process step. Every item traces to a specific OCC NPR section or GENIUS Act provision. Critical / High / Medium ratings reflect the Risk Taxonomy severity analysis. Six risk categories: Governance, Operational, Financial/Liquidity, Technology, Compliance/Regulatory, Third-Party. Self-assessment format for stablecoin issuers and PPSI applicants.

Seven audit domains built from the Risk Taxonomy — test procedures derived from the PRC's 43 key controls. Structured for direct auditor execution with control objectives, evidence requirements, and OCC NPR regulatory cites. Covers ITGC Access Management, Change Management & Smart Contract Governance, Reserve Integrity & Reconciliation, Cybersecurity Key Management, AML/BSA, Third-Party & Custodian Risk, and Governance & Attestation.

End-to-end analysis of the March 2026 Resolv USR stablecoin exploit. $25M extracted via single-key unauthorised minting, USR peg collapsed $1.00 → $0.27, protocol insolvent. Five-stage failure chain mapped to ITGC, ITAC, and NIST CSF. Includes inline system flow diagram. TradFi bridge maps each digital asset failure to its institutional audit equivalent.

Analysis of the April 1, 2026 Drift Protocol exploit — largest DeFi hack of 2026. Six-month DPRK-suspected social engineering campaign, durable nonce multisig bypass, $285M drained in under one hour. Five-stage failure chain mapped to ITGC, NIST CSF, and FFIEC IT Handbook. Includes system interaction diagram showing Circle CCTP, Wormhole, and Tornado Cash fund flow. TradFi bridge analysis.