A Surge in Structuring Alerts
A bank's BSA/AML monitoring system generates alerts on cash deposits between $9,000 and $10,000. Over one quarter, alerts rise 40% at three branches in a district with a large cash-intensive retail trade. The BSA officer has two analysts and a backlog of 300 unworked alerts. The bank's policy requires alerts to be reviewed within 30 days. The BSA officer proposes raising the alert threshold to $9,500 to reduce volume, and asks the internal auditor for an opinion. Separately, the auditor notices that the three branches have a combined 22 currency transaction reports filed in the quarter, which seems low relative to the deposit volume.
1. Evaluate the threshold proposal and the CTR observation. What should the auditor advise?
Read the worked answer
The threshold proposal is risky. Raising the alert threshold is a model change, not an operational fix. It must be documented, validated, and approved, and it must be supported by evidence that the change does not reduce detection of structuring. Because structuring often occurs just below $10,000, moving the floor to $9,500 narrows the detection band and could suppress exactly the pattern the system exists to catch. The auditor should advise against the change as a backlog remedy and instead recommend temporary staffing, triage by risk score, and a documented model-validation process if a change is pursued later.
The CTR observation is a red flag. Twenty-two CTRs against high cash volume at three cash-intensive branches is low and suggests either exempt-person misapplication, a filing process gap, or aggregation failures. The auditor should test whether the bank is aggregating multiple transactions by or on behalf of the same person in a day, whether exemptions are properly documented, and whether tellers know the filing trigger. The two issues may share a cause: under-resourcing and weak first-line awareness.
2. How should the auditor treat the 300-alert backlog in the report?
Read the worked answer
The backlog is a control operating deficiency with regulatory consequence. The 30-day policy is the bank's own standard; missing it means alerts may age past the point where suspicious activity can be timely reported. The auditor should quantify: how many alerts exceed 30 days, the age distribution, and whether any involve the same customers or branches. A sample of aged alerts should be reviewed to see whether any should have resulted in a SAR.
The report should avoid prescribing a specific staffing number; instead it should state the condition, the policy standard, the cause (volume growth plus fixed analyst capacity), and the effect (untimely review, potential missed filings). Recommendations: a documented triage and prioritization methodology, temporary resources or automated scoring, monthly backlog reporting to the BSA officer and board, and a look-back on aged alerts. The auditor should also flag that the BSA officer's proposal, if adopted without validation, would worsen the appearance of suppressing alerts. Escalation to the audit committee is appropriate given the regulatory exposure.