Application testing
Check application outputs, without source-code access.
SQACE checks the business correctness of bought and in-house applications directly on the produced data, and leaves an audit trail for MaRisk AT 4.3.4, FRTB and SA-CCR.
30 minutes, on your own use case.
The problem
Black-box software with no business evidence.
Not every business-critical piece of software is developed in-house. Trading systems, billing software, valuation engines and risk calculators produce data that flows directly into books, reports and payouts. For bought software and many in-house applications, access to the implementation is missing.
Releases are delivered, with release notes and vendor tests. Whether the new release computes correctly within a specific data and process context remains open. Manual samples find only coarse errors; data-quality tools check structures, not valuation logic. At audits, the same question keeps coming up: how do you know the application computes correctly?
The SQACE solution
Verification at the output, independent of the code.
SQACE checks what the application actually produces. Input data and result data are compared against a business rulebook that business experts formulate and maintain, often along product descriptions, contracts and billing rules.
SQACE works on database outputs as well as on mass XML, JSON or flat-file interfaces. With every new release, SQACE computes the rulebook on the current input data and compares it with the application output. Hits are grouped; individual cases are reachable via drill-down.
Scenarios
Where teams check application outputs with SQACE.
Regression-test trading and front-office systems
Valuations before and after a release are compared. SQACE additionally checks whether the valuations match the in-house valuation rules.
Check billing software
For example for medical fees, tax billing or commission engines: input factors are computed against a business rulebook. Conspicuous billings appear with a reason and the triggering record.
Validate valuation engines and mass-XML outputs
SQACE reads mass XML with several million nodes directly and compares defined paths against expected values.
In concrete terms
- Verify application releases without source-code access.
- Regression testing between versions with a business reference, not just a behavioral comparison.
- Database outputs and mass XML in the same platform.
At a glance
| Aspect | SQACE at the data level | Vendor tests |
|---|---|---|
| Data source | Production data in your own house | Vendor's own test data |
| Logic reference | In-house business rulebook | Vendor definition |
| Audit view | Record-level, classified | Little differentiated |
| Source code | Not required | Required |
Compliance
Compliance evidence as a by-product.
For trading and valuation systems, MaRisk AT 4.3.4, FRTB and SA-CCR requirements apply, as well as BaFin examinations under the KWG. In the context of medical-review audits and in private health insurance under BaFin supervision, SQACE audit trails provide the day-to-day evidence that the application outputs were checked against the in-house rulebook.
How SQACE works on extracted data is described in Security & architecture.
FAQ
Frequently asked questions
Does the vendor have to be informed about the use of SQACE?
Usually not. SQACE works on the outputs that are already in your house anyway. Contractual aspects depend on the respective license.
What happens with vendor updates that bring large logic changes?
Your in-house rulebook is independent of the vendor release. SQACE shows where the new release deviates from the rulebook. The hits often lead to a sharper clarification with the vendor.
Which data formats are supported?
Relational databases via JDBC (such as Oracle, MS SQL Server, PostgreSQL) and file formats such as CSV, JSON, XML and fixed-width, including mass XML. Further sources can be connected via the platform API.
How are large XML documents handled?
SQACE reads mass XML down to the node level, compares defined nodes against expected values and delivers a classification of the hits.
Can the rulebook be versioned?
Yes. Rulebooks are versioned, and every run refers to a specific version.
How is performance with large populations?
Populations in the millions are verified in production environments. The platform scales horizontally.