When a photo app has a bug, a picture looks odd. When software that handles money has a bug, someone is out of pocket and trust is damaged. That single fact shapes how financial software is designed. This article explains the main ideas in plain language, picture first, with an Expert view in each section. It is general education only, not financial or legal advice, and it does not describe any specific organisation's systems.
The ledger: the oldest idea in the book
A ledger is a record of money movements. For hundreds of years, businesses have kept ledgers: a list of entries saying what came in, what went out and when.
Double-entry: every entry has two sides
In double-entry bookkeeping, every transaction is recorded in at least two places. If 100 moves from account A to account B, account A goes down by 100 and account B goes up by 100. The two sides must always balance.
Money does not appear or disappear. It only moves.
Expert viewDebits, credits and the accounting equation
In formal accounting each entry has debits and credits that must total the same amount, and accounts are grouped (assets, liabilities, equity, income, expenses) so that the accounting equation, assets equal liabilities plus equity, always holds. A trial balance sums all debits and credits to confirm they match. Software that stores single-sided balances can drift silently; software that stores balanced entries can detect an error the moment the totals disagree.
- 1Payment of 100A request to move 100 from account A to account B
- 2Start a transactionSo that all steps happen or none do
- 3Write both entriesA minus 100 and B plus 100, with a unique reference
- 4Totals match?Debits and credits must be equal, or the posting is refused
- 5CommitBoth entries are saved together and never edited
Takeaway. A payment is posted as balanced entries in one transaction, or not at all.
Never erase, only add
A bank statement does not rub out last week's mistake. If an entry was wrong, a new correcting entry is added that reverses it, and the history stays intact.
Editing the old entry
- The history is lost
- Nobody can tell what was changed
Adding a reversing entry
- The history stays complete
- An auditor can follow every step
Expert viewAppend-only and audit trails
In software terms a ledger is append-only: records are inserted but never updated or deleted. Corrections are new records that reference the original. This makes an audit trail possible: a trustworthy history of what happened, when and who did it. Practical designs add immutable timestamps, user identifiers and reason fields, and prevent changes at the database or permission level rather than relying on developers' discipline.
Accuracy: why computers are careful with money
Computers can make tiny rounding mistakes when they store decimal numbers in certain ways, and a tiny mistake repeated millions of times becomes real money.
Risky
- 19.99 stored as a fractional number, so totals may drift
Safer
- 1999 stored as whole units of the smallest currency unit, so the total is exact
Risky: price = 19.99, quantity = 3 -> total from decimals, may drift
Safer: price = 1999 (in smallest unit), quantity = 3 -> total = 5997 exactlyExpert viewRounding rules
Careful systems store amounts as integers of the smallest unit, or in exact decimal types, and write down the rounding rule (for example round half to even, or always round down for fees) and apply it identically everywhere. Percentage splits need an explicit rule for the leftover unit so that parts always sum to the whole. Currency conversion adds the question of which rate and which time, and the rate used should be stored with the transaction.
Idempotency: pressing "pay" twice
Imagine you tap "pay", nothing seems to happen, and you tap again. Did you pay twice? Good financial software is designed so that sending the same request twice has the same effect as sending it once. This property is called idempotency.
- Customer to Merchant The customer taps pay.
- Merchant to Processor The request carries a unique reference, so a repeat is recognised.
- Processor to Bank The customer's bank is asked whether the payment can go ahead.
- Bank to Processor (reply) The bank approves or declines.
- Processor to Merchant (reply) The merchant learns the outcome and shows a receipt.
- Processor to Merchant Actual money movement, called settlement, comes later in a separate step.
Takeaway. Approval and settlement are different steps, and the reference makes retries safe.
Expert viewDesigning for repeats and failures
Networks time out, clients retry, and message queues deliver "at least once", so duplicates are normal. The standard defence is an idempotency key stored with the result, checked inside the same transaction that applies the change. Related ideas: retry with backoff, treat unknown outcomes as "pending" and reconcile later, and keep operations small and atomic. A database transaction groups the steps (debit, credit, record) so that either all happen or none do.
Reconciliation: checking against the other side
A company's records and the bank's records should agree. Reconciliation compares them entry by entry and investigates differences.
- Collect both setsYour ledger and the external statement
- Match entriesAutomatically, thousands at a time
- Flag differencesThe few that do not match
- Explain each oneA timing gap, or a real error
- Created to Authorised The payment is checked and approved to go ahead.
- Created to Failed The payment is refused and no money moves.
- Authorised to Captured The merchant confirms the amount to be collected.
- Authorised to Failed An approval that is never captured lapses.
- Captured to Settled Settlement completes the transfer between the parties.
- Settled to Refunded A new reversing entry is added, and the history stays intact.
Takeaway. A payment passes through states, and every state is a record that can be reconciled.
Expert viewMatching rules
Matching typically uses amount, date window and reference, with tolerance for timing differences. Unmatched items are classified (timing, fee, duplicate, missing, wrong amount) and aged: an item unresolved for days is escalated. Mature teams track the reconciliation break rate and its causes, because a rising rate is an early warning of a systemic bug.
Security and the compliance mindset
Money attracts attackers, so financial software is built defensively, and it is regulated.
- Strong login checksAnd limits on who can see or change what
- EncryptionWhen data is stored and when it travels
- LoggingEvery sensitive action leaves a record
- Separation of dutiesNo one person creates and approves a payment
- ComplianceRecords kept, customers identified, activity reported
Expert viewBuilding for the auditor
Engineers in this field learn to ask early, "who might audit this, and what will they ask?" Design for explainability: every figure traceable to entries, every change attributable, retention periods respected, sensitive items (card numbers, personal documents) minimised or tokenised, and access reviewed regularly. It is a mindset more than a checklist: be exact, be traceable, assume you will be asked to prove it.
- Treat the ledger as the source of truthDerive everything else
- Append, never editFix mistakes with reversing entries
- Make operations safe to repeatIdempotency keys
- Test the edgesFailures, duplicates, rounding, month ends
- Reconcile automaticallyAnd study the differences
Frequently asked questions
Is this financial advice?
No. It is general education about how financial software is designed.
Why not just use ordinary decimal numbers?
Because small rounding differences add up. Exact whole-number amounts and clear rounding rules avoid that.
What is the biggest risk in money software?
Silent errors, such as a double charge or a missing entry, that nobody notices until a customer does. Design aims to make errors loud, not silent.