At a Glance
Persona: Auditor · Module: costing · Scenarios: ~23
Categories: Happy Path · Permission · Validation · Edge Case
E2E coverage: maps to900-period-end.spec.tsin../carmen-inventory-frontend-e2e/(chain-of-custody / shadow-drift / configuration-history audits are typically planned manual coverage)
This page captures the test scenarios that the Auditor persona drives in the costing module. The Auditor is strictly read-only across tb_inventory_transaction_cost_layer, tb_period_snapshot, tb_business_unit.calculation_method, tb_product.standard_cost, and the configuration history feed per COST_AUTH_008. They run four query patterns: (1) cost-flow chain-of-custody trace — forward + backward walk of a lot's cost-flow through every inbound, revaluation, consumption, transfer, and period rollforward event; (2) period-end snapshot verification — defensive reconciliation that the snapshot's closing_cost_per_unit / closing_total_cost matches an independent reconstruction from the cost-layer ledger, and that the FIFO lot_seq_no / WA running average roll forward intact across the period boundary; (3) FIFO-vs-WA shadow drift audit — under FIFO, the average_cost_per_unit shadow column is maintained on every cost-layer write per COST_CALC_004; the Auditor independently recomputes the running WA and verifies the shadow is consistent (drift indicates a maintenance bug or out-of-order writes); (4) configuration history audit — every change to tb_business_unit.calculation_method, enum_physical_count_costing_method config value, and tb_product.standard_cost is reviewed for pre-condition compliance (drain check on method change, prospective-only effect on standard_cost) and consistency (no mid-period method change). Neither sub-persona ever appears in the transactional flow — the Auditor never edits a cost-layer row, never approves a credit-note, never advances a period, never configures a method. Their deliverable is the audit report or the chain-of-custody trace. Scenarios are grouped into happy paths (clean trace, clean snapshot verification, clean shadow audit, clean configuration history), permission (Auditor read-only allow, write attempts deny), validation / anomaly surfacing (trace surfaces orphan, snapshot mismatch surfaces, shadow drift above tolerance, configuration anomaly surfaces), and edge cases (lot revaluation in mid-trace, locked-period restatement audit, query timeout on huge dataset, mass-trace export).
| # | Scenario | Pre-condition | Steps | Expected |
|---|---|---|---|---|
| AUD-HP-01 | Chain-of-custody trace — clean forward + backward walk | Auditor audit@blueledgers.com logged in; lot LOT-RECALL-42 introduced by a committed GRN at 2026-04-10, partially issued via two SR transactions, partially written off via one stock-out, with one credit-note-amount revaluation applied. |
1. Open the chain-of-custody trace tool. 2. Enter lot_no = LOT-RECALL-42. 3. Run trace. 4. Review backward trace (GRN that introduced — vendor, receipt date, inbound cost_per_unit, lot expiry). 5. Review forward trace (2 SR issues, 1 stock-out, 1 credit-note-quantity if any, plus the credit-note-amount revaluation showing diff_amount and revalued cost_per_unit). 6. Verify each consumption's cost_per_unit matches the engine's cost-pick under the then-configured calculation_method. 7. Export the chain-of-custody report. |
Backward trace returns the source GRN with all metadata. Forward trace returns 2 SR issues with consumption costs (FIFO from the lot or revalued lot), 1 stock-out, 1 credit-note-amount revaluation row. Method-consistency annotation: all rows resolved correctly under the FIFO method in force throughout the trace window. PDF / CSV export. No transaction state change. Maps to parent Scenario 11. |
| AUD-HP-02 | Period-end snapshot verification — clean reconciliation | Closed period 2026-04; tb_period_snapshot rows written per (period_id, location_id, product_id, lot_no, lot_index); Auditor runs the independent reconstruction query. |
1. Open the period-end verification tool scoped to 2026-04. 2. Read snapshot rows. 3. Independently reconstruct from tb_inventory_transaction_cost_layer: per key, Σ in_qty × cost_per_unit matches receipt_total_cost, Σ out_qty × cost_per_unit matches issue_total_cost, etc. per COST_CALC_006. 4. Verify rollforward continuity: closing → next period's opening per COST_CALC_007. 5. Export verification report. |
All per-key reconciliations clean (snapshot = reconstruction); rollforward continuity confirmed (next period's opening_qty / opening_cost_per_unit matches closing of 2026-04; FIFO lot_seq_no preserved on open_period rows). Report exports. No anomalies. Maps to parent Scenario 12. |
| AUD-HP-03 | FIFO-WA shadow drift audit — within tolerance | FIFO business unit BU-A; period 2026-04 of normal activity; Auditor runs the shadow-drift audit. |
1. Open shadow-drift tool scoped to BU-A and 2026-04. 2. Read each cost-layer row's average_cost_per_unit (the WA shadow maintained even under FIFO per COST_CALC_004). 3. Independently recompute the running WA from the first inbound. 4. Compare per row. 5. Export drift report. |
All rows within rounding tolerance (e.g. ≤ ฿0.10 per row). Drift report shows zero above-tolerance rows. Verification clean. Maps to parent Scenario 13. |
| AUD-HP-04 | Configuration history audit — clean (no anomalies) | All calculation_method changes in the last 12 months were pre-conditioned by a drain check (zero on-hand at save); all standard_cost updates were prospective; no mid-period method change; configuration-history feed available. |
1. Open the configuration history feed. 2. List every calculation_method change. 3. Per change: verify zero on-hand at save timestamp; verify the change applied prospectively. 4. List every standard_cost batch update; verify the cadence is consistent. 5. Verify no calculation_method change crossed a period boundary mid-period. 6. Export consistency report. |
All checks clean; consistency report exports. No anomalies flagged. |
| AUD-HP-05 | Sensitive-field export with secondary approval | Auditor needs to export a cost-flow report including unit costs and vendor terms (joined via the source GRN's vendor_id); tenant policy requires Controller or DPO co-approval. |
1. Build the filter. 2. Tick Include unit costs and Include vendor terms. 3. Click Request export. 4. System routes to Controller for approval. 5. Controller approves with justification. 6. System generates watermarked CSV. | Export request raised with sensitive flag; Controller approval prompt; watermarked CSV generated (requester / approver / timestamp); audit-of-audit log entry. Mirrors inventory module pattern. |
| # | Scenario | Expected behaviour (allow/deny + reason) |
|---|---|---|
| AUD-PERM-01 | Auditor reads tb_inventory_transaction_cost_layer, tb_period_snapshot, tb_business_unit.calculation_method, tb_product.standard_cost, config history |
Allow read-only per COST_AUTH_008. Full read across costing entities including soft-deleted (compensated) rows. Render-only screens; no Save / Edit / Post affordances. |
| AUD-PERM-02 | Auditor attempts to edit any costing entity | Deny — role scope. Direct API write (PATCH /cost-layer/{id}, PATCH /business-unit/{id}/calculation-method, PATCH /product/{id}/standard-cost) from Auditor token returns 403 Forbidden with "Auditor role is read-only on the costing module." Logged on audit-of-audit trail. |
| AUD-PERM-03 | Auditor attempts to approve a credit-note-amount revaluation | Deny — Finance only per COST_AUTH_005. The credit-note approval queue is not visible. Auditor's role is to surface a missed credit-note in the audit trail; the approval is Finance's. |
| AUD-PERM-04 | Auditor attempts to lock / re-open a period | Deny — Finance Manager only per COST_AUTH_006. The period-lock dashboard is not visible. |
| AUD-PERM-05 | Auditor attempts to change tb_business_unit.calculation_method |
Deny — Sysadmin only per COST_AUTH_001. |
| AUD-PERM-06 | Sensitive-field export — secondary approval required | Allow with secondary approval. Per AUD-HP-05, costing exports including unit costs, vendor terms (joined via source-document), or PII via joined tables require Controller or DPO co-approval. Plain aggregate exports (movement counts, anonymised lot lists, public-only fields) bypass. |
| # | Scenario | Trigger | Expected error / behaviour |
|---|---|---|---|
| AUD-VAL-01 | Trace surfaces orphan layer (source GRN soft-deleted) | A tb_inventory_transaction_cost_layer.lot_no = LOT-GAP-9 row exists, but the inventory transaction's source GRN was soft-deleted by a historical migration error; lot exists but provenance is broken. |
Surface the gap in the trace report. Forward trace from LOT-GAP-9 returns the downstream consumption successfully; backward trace flags "Source document for inventory transaction <Y> is soft-deleted or missing; provenance gap. Recommend forensics." Chain-of-custody export includes the gap flag; no auto-repair. Mirrors inventory module AUD-EDGE-03. |
| AUD-VAL-02 | Snapshot verification surfaces mismatch | Period 2026-04 tb_period_snapshot.closing_total_cost = ฿10,000.00; Auditor's independent reconstruction returns ฿10,156.00 (variance ฿156.00). |
Surface the variance in the verification report. Drill identifies the cause: a missed credit_note_amount row in 2026-04's closing was post-dated to 2026-05 (rollforward gap). Report flags the row; routes to Finance Manager to re-open 2026-04 per parent Scenario 15 path. No write by Auditor. |
| AUD-VAL-03 | Shadow drift above tolerance | FIFO business unit; cost-layer row at T shows average_cost_per_unit = ฿12.50; independent WA recompute at T yields ฿14.80 (drift ฿2.30, above ฿0.10 tolerance). |
Surface in the drift report. Drill: an out-of-order cost-layer write (backdated inbound after subsequent outbound) caused the shadow to be computed against the wrong prior state. Report routes to Sysadmin (shadow-maintenance bug investigation) and Finance (valuation implication). No write by Auditor. |
| AUD-VAL-04 | Configuration history surfaces method-change anomaly | Configuration history shows calculation_method change on BU-A at T while BU-A had non-zero on-hand (should have failed COST_VAL_009 if pre-condition check ran). |
Surface in the consistency report. Drill: the change slipped through due to a missing pre-condition check at the time (e.g. integration race, deprecated API path). Report flags the change as anomalous; routes to Sysadmin + Finance for forensic. No write by Auditor. |
| AUD-VAL-05 | Method-change mid-period detected | Configuration history shows calculation_method change on BU-A at 2026-04-15 14:00 (mid-period 2026-04). |
Surface in the consistency report. Cost-layer rows in 2026-04 are now split: those at [2026-04-01..2026-04-15 13:59] used the old method; those at [2026-04-15 14:00..2026-04-30] used the new method. The period's COGS / snapshot is method-inconsistent. Report flags; routes to Finance Manager + Sysadmin for restatement evaluation. |
| AUD-VAL-06 | Auditor write attempt rejected | Auditor API call PATCH /cost-layer/{id} {"cost_per_unit": 99} (attempting to "fix" a row). |
Deny with audit-of-audit log per AUD-PERM-02. Server returns 403; audit-of-audit trail records { event: 'unauthorised_write_attempt', actor: auditor, target: 'cost_layer', timestamp: T }. The attempt is itself a forensic-grade event. |
| # | Scenario | Condition | Expected |
|---|---|---|---|
| AUD-EDGE-01 | Lot revaluation in mid-trace — cost continuity preserved | Lot LOT-Y introduced at cost_per_unit = ฿15; partially consumed (10 of 20 units at ฿15 — COGS for those 10 = ฿150); credit-note-amount revaluation diff_amount = −฿50 brings LOT-Y cost to (20×15 − 50)/20 = ฿12.50; remaining 10 units consumed at ฿12.50. |
Trace report shows the cost-step. Forward trace renders the 10-unit consumption at ฿15 (pre-revaluation), the diff_amount = −฿50 revaluation row at T, then the 10-unit consumption at ฿12.50 (post-revaluation). Cost-step consistent with COST_CALC_005 (already-consumed portions not retroactively adjusted; remaining picks up the revalued cost). No anomaly. |
| AUD-EDGE-02 | Locked-period restatement audit | 2026-03 is locked; a restatement adjustment posted in 2026-05 references 2026-03 via the note field; Auditor reviews the cross-period trace. |
Trace surfaces the cross-period reference. Forward trace from a 2026-03 lot extends into 2026-05 via the restatement cost-layer row; the row's note / info JSON carries the cross-period reference. Restatement disclosure is a Finance reporting concern; the costing module preserves the cross-period link in the trace. |
| AUD-EDGE-03 | Query timeout on huge dataset | Auditor's chain-of-custody trace filter spans 12 months across all locations + lots; query exceeds tenant compute budget. | Graceful timeout with partial result. Server cancels at configured timeout (e.g. 60s for trace queries); returns partial result with truncated = true flag; recommends offline export. Mirrors inventory AUD-EDGE-04. |
| AUD-EDGE-04 | Mass-trace export for recall investigation | Auditor needs traces for 100+ lots (multi-lot recall); single click would overload the UI. | Batch export with rate-limit and progress bar. Auditor enters lot list; system queues the batch trace; renders progress; produces consolidated PDF / CSV export. Sensitive-field flag triggers Controller approval per AUD-HP-05. |
| AUD-EDGE-05 | Shadow drift exactly at tolerance | Drift ฿0.10 exactly equals tolerance ฿0.10. |
Boundary inclusive — clean. ≤ tolerance is clean; > tolerance flagged. Mirrors inventory boundary patterns. |
| AUD-EDGE-06 | Snapshot reconciles after EOP price revaluation | An eop_in / eop_out cost-layer row at period boundary captures an EOP price revaluation (rare — used by tenants who do a periodic mark-to-market on inventory). Auditor's snapshot verification accounts for the revaluation in adjustment_total_cost. |
Reconciliation includes EOP revaluation bucket per COST_CALC_010. Σ diff_amount in the adjustment_total_cost rollup. Snapshot verification passes; report annotates the EOP revaluation event. |
COST_AUTH_008 (Auditor read-only scope — AUD-PERM-01), COST_AUTH_010 (no direct cost-edit — AUD-PERM-02 / AUD-VAL-06), COST_CALC_001–COST_CALC_010 (the algorithmic invariants the Auditor verifies — AUD-HP-01 / AUD-HP-02 / AUD-HP-03), COST_VAL_008 (period rollforward gate — AUD-HP-02), COST_VAL_009 (method-change drain — AUD-VAL-04), COST_POST_007 / COST_POST_008 (period close / open — AUD-HP-02 / AUD-EDGE-06).tb_inventory_transaction_cost_layer (Auditor's primary read target), tb_period_snapshot (snapshot verification target), tb_business_unit.calculation_method (configuration history target), tb_product.standard_cost (reference cost history), all enums.900-period-end.spec.ts indirectly exercises snapshot writes that the Auditor verifies in AUD-HP-02. Chain-of-custody, shadow drift, and configuration history audits are typically planned manual coverage.enum_physical_count_costing_method resolution Auditor verifies for consistency.