SS&C Advent APX Maker-Checker: Four-Eyes Control

Many investment firms run SS&C Advent APX as the system of record for their portfolios. That is why a wrong change in APX matters: one edit to a benchmark, a reporting currency or a client contact can travel into everything downstream.

This article covers why APX users ask for four-eyes (maker-checker) control, what auditors usually want to see, and how a governance layer that sits next to APX can provide it without replacing APX.

What is maker-checker control?

Maker-checker, also called four-eyes control, is a simple rule: the person who proposes a change cannot be the person who approves it.

• The maker proposes a change, such as a new benchmark for a portfolio.
• The change waits as a pending request. The system of record is not touched yet.
• A checker, a second authorised user, reviews it and approves or refuses it.
• Only an approved change is written to the system of record.

The point is that every change to important data has been seen by two people, and that you can prove it later.

Why firms running APX want it

APX is built to manage portfolio data, and teams use it directly every day. Firms that want a formal approval step on data changes tend to give the same reasons:

• One person can change important data alone. Without a second approver, a typing mistake or an unauthorised edit goes straight into the system of record.
• Evidence is hard to produce. When an auditor asks who changed a field, who approved it and what it said before, the answer should come from a record, not from memory or email threads.
• Access is tied to seats. Giving more people a controlled way to propose or review changes usually means more APX named users.
• Teams want a modern interface. Operations staff often prefer a browser interface, and many want it in their own language as well as English.

What auditors look for in APX governance

Requirements differ between firms and jurisdictions, so confirm the details with your compliance team and your auditors. In general, reviews of change control come back to three questions.

Is there segregation of duties?

Can the person who makes a change also approve it? A control that relies on people choosing not to approve their own work is weaker than one where the system refuses it. Auditors usually look for the second.

Is there approval evidence?

For each change, can you show who proposed it, who approved it, and when? A record of the approval is what turns a policy into evidence.

Is there a change history?

Can you show the value before the change and the value after it? A history that only says "field updated" does not tell a reviewer what actually changed.

How a governance layer adds this without replacing APX

One way to add these controls is a governance layer that runs next to APX and works through it, rather than a replacement for it. Crestline Account works this way. It is built by Quantaint, an experienced, independent SS&C Advent implementer and systems integrator.

Crestline Account is a governance and operations platform built on top of SS&C Advent APX. APX stays your system of record. Crestline adds controls around how changes reach it:

• Maker/checker with enforced segregation. Every data change waits as a pending request until a second authorised user approves it. Nobody can approve their own change. APX is unchanged until the request is approved.
• A full audit trail on every write. Each action is recorded with a timestamp, the user, and the values before and after.
• Role and function permissions. You decide who can see, propose and approve, function by function.
• No new APX seats. Your team signs in to Crestline, not to APX, on a flat annual licence, without additional APX named users.
• Directory sign-in. People sign in with their existing LDAP or Active Directory accounts, and each directory group is mapped to the functions it may see, propose or approve.
• English and Arabic. The whole browser interface is available in either language, with right-to-left layout for Arabic, and can carry your own brand.

At launch, Crestline covers 10 core APX modules that operations teams use day to day.

How it connects and where it runs

Crestline runs inside your network, next to APX:

• It is deployed as a Windows service on your own servers.
• It reads and writes through the OAuth-secured APX API, so your APX installation stays as it is.
• It works with APX v22.0.0 and above.
• No internet exposure is required, and audit records can be forwarded to Splunk.

Going live takes four steps: install inside your network, connect to APX, map roles from Active Directory, then switch on maker/checker.

Looking for help with SS&C Advent?

People often search for an "Advent partner" when they need hands-on help with an SS&C product. Quantaint is an experienced, independent SS&C Advent implementer and systems integrator: we help firms that run SS&C Advent products implement them, connect them to the rest of their systems and get more out of them.

Our SS&C Product Services cover consulting and integration for Geneva, APX, Moxy and Axys. That includes Geneva implementation, fund accounting solutions, risk management systems, advanced reporting, SQL/RDL custom reports, performance sync, workflow design and migration support.

If you are looking for Advent Geneva consulting or APX integration work, we work in four stages:

1. Discover. We learn your goals, your current systems and where the friction is.
2. Design. You sign off a plan, an architecture and a timeline before we build.
3. Build and integrate. We deliver in short cycles, with demos, tests and documentation.
4. Run and improve. We provide monitoring, support and improvements once it is live.