Controllers are paid to validate and attest the numbers . They (not IT) have the knowledge and the entitlement to confidential information to affirm that the numbers make sense. When (not “if”) mistakes happen, then controllers must answer.
90% (in some places 100%) of the developers are expected to have limited knowledge (so that they can focus on well-defined requirements) but build automated systems very quickly, often with lots of obvioius “garbage out” i.e. unreliable, inaccurate output.
In most (not just “many”) cases, Developers simply don’t know enough to recognize “garbge out”. Through experience supporting a local (not a GENERIC) system, some senior IT guys may gain that judgement, insight and knowledge.
There are mistakes controllers are unable to detect — if developers release something obscure without informing controllers. Out of 500 changes, which ones do we need to “inform”? Initially be very cautious. Over time our judgement grows.
 what numbers? Let’s not get into the specifics as we could get carried away.