# Scenario: Northstar Financial Technologies (fictional)

> **SIMULATED.** Northstar Financial Technologies, its people, systems, vendors, records, audit engagement, findings and metrics are all invented for a portfolio exercise. Nothing here is client work, a real audit, a certification or an assurance opinion. Any resemblance to a real organisation or person is coincidental. Names use invented surnames and the example domain `northstar.example`.

## The company

Northstar is a Canadian business-payments fintech with about 450 employees. It runs production applications on AWS, serves business customers, and holds customer and payment-related data. It has internal IT, security, engineering, finance, legal and procurement functions, relies on third-party service providers, and has two proposed AI use cases.

| Dimension | Fictional position |
|---|---|
| Headcount | 450 (410 active, 4 on leave, 36 leavers in the roster window) |
| Production hosting | AWS (account `SYS-05`), plus one managed-hosting vendor (`V-01`) |
| Customer data | Business customer and user identifiers, transaction metadata |
| Payment data | Card-not-present processing through the Payments API (`SYS-02`) |
| Time zone | UTC for every timestamp; business days are Monday to Friday, holidays ignored |

## Simplified architecture (text)

```
Customers --> Customer Portal (SYS-01) --> Payments API (SYS-02) --> Core Ledger (SYS-03)
                     |                           |                        |
                     +-------- Corporate SSO (SYS-06) ---------------------+
Engineers --> Source Control and CI/CD (SYS-04) --> AWS Production Account (SYS-05)
Security Monitoring (SIEM, SYS-08) <-- logs from all in-scope systems
Backup and Recovery Service (SYS-14) --> backups of SYS-01, SYS-02, SYS-03, SYS-07
Data Warehouse (SYS-07) <-- ledger and portal data for reporting
```

A rendered SVG version is produced in the media milestone.

## Audit frame (fictional)

| Item | Value |
|---|---|
| Engagement | Risk-based IT general controls (ITGC) audit, Project 1 |
| Sponsor | Chief Risk Officer (role, not a person) |
| Audit period | 2026-01-01 to 2026-06-30 |
| Fieldwork | 2026-07-13 to 2026-08-28 |
| Population extract date | 2026-07-15 |
| As-of date for the dashboard | 2026-09-30 |
| In-scope systems | `SYS-01` to `SYS-05` |
| Out of scope | Other systems, physical security, application business logic |
| Independence statement | Written in the audit planning memo (Project 1); the fictional audit team is independent of the systems audited |

The test thresholds (2 business days for leaver removal, 90 days dormancy, 30 days for access reviews, and so on) live in one file, `data/reference/policy-parameters.json`, and are paraphrased from the fictional policy set listed in the evidence register.

## Payment-card scope assumptions (not a compliance claim)

- Card data is assumed to exist only in a segmented tokenization vault inside the Payments API environment. `SYS-02` and the AWS segment that hosts it are treated as **in scope** for payment-card requirements.
- The Customer Portal and CI/CD are **connected** to that environment. The Core Ledger holds tokens and metadata and is treated as **out of scope**.
- The rest of the company is not assumed to be in scope. PCI DSS mappings in Project 2 apply only to this segment, and no PCI DSS compliance is claimed.

## Data classification scheme

| Class | Meaning (fictional) | Examples |
|---|---|---|
| Restricted | Disclosure would cause severe harm | Card data and tokens, ledger entries, cloud admin credentials |
| Confidential | Disclosure would cause material harm | Customer identifiers, employee records, source code, security logs |
| Internal | Not for public release | Knowledge base articles, internal procedures |
| Public | Approved for release | Marketing content |

## Risk appetite and tolerance statements (fictional)

1. Northstar has **low appetite** for unauthorised access to Restricted data. Any confirmed access by a former employee is escalated to the Chief Risk Officer.
2. Northstar has **low appetite** for payment service outages beyond the recovery time objectives in the business services inventory.
3. Northstar has **moderate appetite** for operational inefficiency in internal systems where no Restricted data is involved.
4. Northstar has **low appetite** for deploying AI to customers without human review and a documented risk assessment.
5. Residual risks scored 15 or above (on a 5 x 5 scale) require executive acceptance; scores of 8 to 14 require the risk owner's acceptance with documented rationale.

## Roles used throughout (roles, not people)

Chief Risk Officer; IT Security Manager; Head of IT Operations; Change Manager; Head of Payments Engineering; Head of Platform Engineering; Controller; Head of Procurement; Head of Customer Support; Privacy Officer; AI Governance Committee; System Owners.

## Where the data comes from

See `data/README.md`. Every record is generated by `scripts/generate_synthetic_data.py` from a fixed seed. Seeded issues are documented in a separate ground-truth file that is withheld from public raw data.