Every control is real. Every control is self-attested.

What the audit trail actually looks like

Unusually good for a personal account. Signals are generated before execution and preserved: the screen runs Saturday off Friday's close, orders execute Monday, and the funnel and order sheet are written to dated files and committed to version control — the rationale for every position exists in writing, timestamped, before the trade. Point-in-time data is archived every cycle, so a reviewer can re-run any historical screen against the data as it stood and get the same sheet. Runs are deterministic by stated engineering requirement. Look-ahead is blocked in code and asserted in tests. Parameters live in a checksummed config file, so an edit is detectable rather than buried. And everything is in git — append-only in practice, tamper-evident.

Exception and breach handling

Two standing logs: one for rule breaches (currently empty), recording date, action, and account impact; one for urges to breach that weren't acted on. The second has no regulatory analogue but is the better leading indicator. Rule-based exceptions are logged, not silent — an instrument that can't be traded on the platform is skipped under a named rule with a reason code and date, and the next-ranked name takes the slot. That is a documented rule firing, not a discretionary decision, and the documents maintain the distinction explicitly. Data failures fail loudly: a name with unfetchable fundamentals is excluded and counted in the funnel under its own reason code, never silently passed.

A control-mapping document ties each stated rule to the automated test that proves it — and, notably, also lists the rules not yet covered by a test. Self-declared control gaps, in writing.

Change control

Parameters frozen until a fixed future date, with a single documented pre-launch calibration pass, used and closed. Proposed amendments must be written down before anyone checks what the change would have earned — that sequencing is the actual control; it stops rules being rewritten to fit results. Backtests are explicitly barred from serving as justification for any parameter. One terminal provision — retire the system if it trails its benchmark after 36 live months — is marked non-editable.

Weaknesses you'd flag

Segregation of duties does not exist. One person writes the rules, runs the system, executes the orders, logs the fills, and reports the results. At this notional that's proportionate, but it should be stated rather than implied: the integrity of every log rests entirely on self-reporting. Execution is manual and unattested — fills are self-entered, and broker contract notes are not currently reconciled against the printed sheet; that reconciliation would close the biggest gap cheaply. The empty breach log is unverified by construction — evidence of intent and a functioning process, not independent assurance. Best execution is unaddressed (market orders, single venue) — immaterial at this size and not an obligation here, but the entire picture changes if the account ever holds anyone else's money.

One genuine external obligation could attach: an employer's personal-account dealing policy, if one applies. A fully mechanical monthly rebalance interacts badly with pre-clearance windows, because the system's core rule is that it cannot skip an order. Worth confirming rather than assuming.