04 Automating external requests to counterparties, with the company's own mail server

An audit review cannot rely on the client's documents alone: some data has to be confirmed by a third party such as banks, buyers, suppliers, and settlement counterparties. A single review generates dozens or hundreds of such requests, and each one is a letter with account details, amounts, and a period, written for a specific recipient.

A person prepared and sent every one of them. The same person tracked who had replied and who hadn't, dug up old letters, sent reminders, and manually matched incoming replies to the request each one belonged to. Replies arrived in no particular order: a day later, two weeks later, sometimes from a different address with no reference to the original letter.

Tracking who had answered a request and who hadn't rested on one employee's attentiveness and their Sent folder.

The second problem was the mail itself. Correspondence with counterparties contains personal data, financial figures, and the substance of an audit review. All of it lived in an external mail service, meaning on someone else's servers, with access the company does not control.

The system closes the full cycle of an external request. It generates letters across the review's counterparty list, filling the template with account details, period, and amounts. Previously, an employee typed this out by hand for every recipient. Sending now goes out as a batch, not one letter at a time.

The other side of the cycle is receiving. Incoming replies are parsed and matched to the request they answer, even when a counterparty replies without quoting the original or from a different address than the one written to. Because of this, the state of the whole review is visible at any moment: who it was sent to, who replied, who hasn't answered yet.

Sending, receiving, matching a reply to its request, and reminders now form one closed cycle with no manual step left in it.

Reminders come from the same place: for unanswered requests, the system sends follow up letters on its own, and this no longer depends on whether an employee remembered to dig up a two week old thread.

A separate part of the work was the mail server. We deployed it on the client's own infrastructure and moved all correspondence with counterparties onto it: both outgoing requests and incoming replies now run locally, through the company's own server.

The reason isn't saving on a subscription. An audit firm works with data that isn't its own: a client's turnover, its counterparties, settlement amounts. As long as that correspondence sits in an external service, the company can't answer a simple question from an inspector: who physically has access to the letters. After the move, there is an answer, and it can be verified.

The question of where correspondence with counterparties is kept and who has access to it now has a specific answer, instead of a link to a third party service's terms of use.

A mail server of one's own is also what the automation runs on. The system sends and receives letters not through the limits of someone else's API but through its own infrastructure: the rules, addresses, and sending volumes are set by the client, not by a provider's pricing plan.

An operation that repeated on every review in exactly the same form disappeared from the auditor's work: write the letter, send it, log it, track it, remind. What's left is the actual audit work: analyzing what came back in the replies.

The state of outstanding requests stopped being one person's knowledge. Who replied and who didn't is now visible from the system, not from the Sent folder of an employee who happens to be on leave today.

And correspondence with counterparties moved back inside the company's perimeter, where it belongs given the nature of the data.