The Analyst Who Was Too Useful
A business analyst on a regulatory reporting project is the only team member who understands both the data model and the reporting regulation. Over nine months she has written the requirements, designed the report layouts, written the SQL for the validation rules, performed user acceptance testing, and trained the end users. She is now asked to sign off that the solution meets the regulatory requirements. The project has had two internal audit findings in the past year on unrelated projects, and the audit committee has asked for assurance that reporting controls are adequate. The analyst's manager says her sign-off is sufficient because 'nobody else knows it well enough to check.'
1. Analyse the underlying competency and governance issues in this situation.
Read the worked answer
The concentration problem
The analyst has become a single point of failure across the entire delivery chain: requirements, design, build, test, and training. That is a competency and staffing risk before it is anything else. If she leaves, the project cannot be maintained or defended. The nine-month pattern suggests no deliberate decision was made to concentrate knowledge; it accumulated because she was competent and available, which is how this usually happens.
The independence problem
The sign-off request is the serious issue. She wrote the requirements, designed the layouts, wrote the validation logic, and tested it. Asking her to attest that the solution meets regulatory requirements means the person who produced the work is the only person confirming it is correct. Any error she made is, by construction, invisible to her own review, because she would make the same assumption again. This is not a comment on her integrity; it is a structural property of self-review.
Why the manager's reasoning is wrong
The argument that her sign-off suffices because nobody else understands it well enough to check is precisely backwards. That condition is the reason independent review is required, not a reason to waive it. An audit committee asking for assurance on reporting controls will not accept attestation by the sole author, and if they discover the arrangement after the fact, the finding will be worse than a delay now.
Competency dimension
She has demonstrated strong technical and analytical competence. What the situation lacks is the organizational awareness to recognize that her usefulness has become a control weakness, and the communication skill to raise it. The analyst should be the one naming this, and the fact that she has not suggests the team's culture treats busy competence as unambiguously good.
The regulatory dimension
Regulatory reporting controls typically require segregation between preparation and review. Even where no formal rule applies, the audit committee's request establishes the expectation. The analyst's sign-off would create a documented control gap.
2. What should the business analyst recommend, and how should she raise it without appearing to refuse her job?
Read the worked answer
The recommendation
She should accept accountability for the work she did and decline to be the sole assurance. The distinction matters and should be stated plainly: she will attest to what she produced, and she recommends that independent verification be added before the solution is declared compliant.
Specifically, she should recommend three measures. First, an independent review of the validation rules against the regulation by someone who did not write them, ideally from a risk or compliance function outside the project. Second, a documented requirements-to-regulation traceability matrix, so verification can be performed against a source rather than against her memory. Third, a knowledge transfer plan that reduces the single point of failure: pair a second analyst on the data model and the regulation, and have the end-user training materials reviewed by someone else.
How to raise it
She should not frame this as a refusal or as a personal limitation. The effective framing is risk to the project and to the audit committee's assurance. She can say: the audit committee has asked for assurance on controls, and self-attestation by the sole author will not withstand their scrutiny; here is what we need to give them something defensible.
She should bring the recommendation in writing, with the specific gap named and the specific remedy costed in effort. A vague concern about independence is easy to dismiss; a proposal with a scope and an estimate is a decision the manager can act on.
If the manager insists
If the manager still wants her sign-off alone, she should document the limitation in the sign-off itself, stating what she prepared and that independent review was not performed. That is not insubordination; it is accurate attestation. She should also raise the matter with the audit committee liaison, since the committee has already asked the question and is entitled to an accurate answer. Escalating to the body that requested assurance is appropriate here because the manager's instruction would mislead that body.