Case Study

Internal Business Applications

Designed and built four internal applications (commission tracking, project management, CRM, and a vendor marketplace) with access and workflow safeguards built in.

Focus: Application controls
Context: Four internal business applications
Tools: Supabase, Vercel, GitHub, SQL
Role: Operations Intelligence Manager

Overview

I designed and developed four internal business applications for a technology advisory firm: commission tracking, project management, CRM, and a vendor marketplace platform. They are built with Supabase and Vercel, and I use GitHub for version control.

Risk & objective

Manual spreadsheet workflows are hard to control. There are no limits on who can see or change data, no change history, and no consistent way to check calculations or payment status. The objective was to move these workflows into applications that have the controls built in.

Approach

Understand the workflow. Gather requirements from the people who do the work, and identify where manual steps cause errors or lack visibility.
Design the application. Define the data, the roles, and the approvals that the workflow needs.
Build on Supabase and Vercel. Develop the application with a database behind it and deploy it to the web.
Build in controls. Add role-based access, approval workflows, activity logs, two-factor authentication, and data restrictions.
Manage change. Keep the code in GitHub so that changes are tracked and can be reviewed.
Review and improve. Review access and activity across the applications and adjust as the workflows change.

Controls

Control	Risk it addresses	Evidence
Role-based access and data restrictions	Users seeing or changing data beyond their role	Roles and restrictions defined in each application
Approval workflows	Changes made without review	Approval history
Activity logs	Changes that cannot be traced	Log of user actions
Two-factor authentication	Account compromise	Two-factor sign-in enabled
Version control (GitHub)	Untracked or unreviewed changes to the code	Commit history

Application overview

Illustrative — simplified architecture

Users

By role

Applications

Commission tracking
Project management
CRM
Vendor marketplace

Platform

Supabase (data)
Vercel (hosting)

Alongside

GitHub (version control)

Controls across the layers

Role-based access
Approvals
Activity logs
Two-factor authentication
Data restrictions

Application	What it does
Commission tracking	Tracks commissions, variances, and payment status across contracts, clients, and vendors, replacing manual spreadsheet workflows
Project management	Manages internal project work
CRM	Manages client and vendor relationships
Vendor marketplace	Platform for working with vendors

A simplified view of how users, applications, and the platform fit together, with the controls that apply across them.

Result

Four internal business applications with access and workflow controls built in, including a commission tracking system that replaces manual spreadsheet workflows.

Through an audit lens

IS auditors assess how applications are designed, how they restrict access, how data is processed, and how changes are made. Having built these systems, I understand the choices behind each of those areas and where weaknesses usually appear. That helps me ask better questions and recognize good answers.

Skills demonstrated

Details are anonymized to protect confidential business data. Figures are limited to those on my resume.

← Back to all projects