A Tuned Structuring Threshold and 1,900 Closed Alerts
Cobalt Bank's monitoring system runs nine scenarios. The structuring scenario generated 62 percent of the 3,900 alerts raised in the prior year. In April, the financial crimes unit raised the structuring threshold from $9,000 to $9,500, shortened the aggregation window from 30 days to 14, and removed one scenario entirely, cutting alert volume by 48 percent. The tuning memo was written by the manager who owns the scenario library and approved by the BSA officer in three days; no back-testing of missed activity was documented. Alert closure is expected within five days, while the average is 19 days. You sample 60 closed alerts: nine have no documented disposition rationale, four relate to customers whose SAR was filed 41 to 57 days after the alert, and two involve accounts closed before the review was completed. Analyst turnover was 40 percent during the year.
1. Design the test that would let you conclude on whether transaction monitoring is operating effectively as a control.
Read the worked answer
Treat monitoring as three linked attributes: scenarios generate alerts, alerts are investigated within service level and documented, and decisions are escalated with timely SAR filing. A failure in any attribute defeats the control, so testing only the first is insufficient.
Obtain the scenario library and full change log, and test whether each tuning change since the last audit was approved by someone independent of the scenario owner, had documented rationale, and was validated before and after implementation. Re-perform the threshold change by running the prior parameters over a sample period and reviewing what would have alerted, and examine accounts with activity just under $9,500 for missed structuring. Test data integrity, including completeness of source feeds and dropped files.
For dispositions, use attribute sampling. Sixty of roughly 3,900 alerts supports a tolerable exception rate near 5 percent only if you find few errors, so treat this as a preliminary sample and extend on any exception. Stratify by scenario and analyst, because 40 percent turnover suggests quality varies with tenure.
Separately test timeliness: a 19-day average against a 5-day standard is an exception even if each closure is substantively sound.
2. Can the audit rely on the tuning memo to conclude that the threshold change was appropriately governed? What would adequate validation have looked like?
Read the worked answer
No. A memo authored by the owner of the scenario library and approved in three days by the BSA officer fails independence and lacks the analysis needed to support a 48 percent reduction in alerts.
Adequate validation would include the pre-implementation alert volume; a sample of alerts that would have fired under the old parameters and how they were dispositioned; a review of activity falling between $9,000 and $9,499 during a defined period; an assessment of whether a 14-day aggregation window is consistent with the typology, since structuring frequently spans several weeks and a shorter window can break the pattern; peer or industry benchmarks for similar institutions; sign-off by an independent validation or risk function; and a plan for monitoring false negatives after go-live.
Removing a scenario entirely is more consequential than moving a threshold and should have escalated to the BSA officer or committee with written rationale and compensating coverage.
Audit does not re-tune the model. It concludes on whether change was governed. Without this evidence, change control fails, and audit should perform an independent lookback over three months of below-threshold activity to determine whether SARs were missed.
3. Nine of 60 sampled alerts lack a documented disposition. What conclusion do you draw, and how do you report it?
Read the worked answer
Nine of 60 is a 15 percent error rate, not a documentation nuisance. An undocumented disposition means the file cannot evidence that the alert was investigated, so the control cannot be shown to operate even if the underlying review was fine.
First extend and stratify: draw additional alerts from the analysts and scenarios with the most errors, and pull the two files where accounts were closed before review. Closing an account before disposition suggests the activity was never assessed and prevents follow-up.
Second, test for harm. For the nine undocumented closures and the four filings at 41 to 57 days against a 30-day standard, inspect the underlying activity. Late or missing SARs move the finding from a documentation deficiency to a potential reporting failure and change its severity.
Report a control deficiency in alert disposition and timeliness, quantify the exceptions and project them to the population, and tie root cause to turnover and training. Recommend documented rationale standards, quality review of closures before they are accepted, and a lookback over the period after tuning. Escalate to significant if transaction testing shows reportable activity was missed.