What makes a review a control
Accounting already wrote the specification. Apply it and every shipped surface fails.
The domain has something no other field in this curriculum has: a written, litigated specification for what a valid human review requires.
Verifying that a review was signed off provides little or no evidence by itself about the control's effectiveness.
A management review control has a precision requirement. The reviewer must have competence, source access, authority to stop the work, visible exceptions, and documentary evidence of what was inspected and concluded. Pre-defined investigation criteria tied to materiality determine the control's precision, and every item meeting those criteria must be shown to have been investigated and resolved.
Apply that standard to every agent approval surface shipped in 2026 and they all fail it. They record that approval happened. None can demonstrate that review occurred at sufficient precision.
That inverts the design brief. The job is not "make approval pleasant." It is make the cheap approval structurally impossible — and it answers the 93% directly, because an approval grantable in 300ms without the exception surfacing is, by construction, not a control.
Your screen shows the reviewer the agent's summary of the supporting invoice. What have you just created?
The rest of this lesson unlocks when you commit above.