Alert Triage, Case Intake and Investigation Planning
Alert Triage, Case Intake and Investigation Planning
This domain tests the front end of the process: how a monitoring alert becomes either a documented closure or an investigation with a written plan. Marks are lost on undocumented reasoning far more often than on missing typology knowledge.
Core rules
- Triage sequence: validate data quality, confirm the activity actually occurred, compare it against CDD and expected activity, check prior alerts and adverse media and related parties, then dispose - close with rationale or escalate to a case.
- CDD is the baseline. You cannot judge what is unusual without documented expected behaviour.
- Intake criteria belong in policy: materiality, customer risk rating, typology, regulatory sensitivity, law enforcement interest.
- A plan states objectives and hypotheses, scope (entities, accounts, period), information sources (core banking, KYC file, trade documents, open source, blockchain analytics), milestones, resources, legal constraints and reporting deadlines.
- Plan before collecting. When scope changes, revise the plan in writing so the file shows why.
- Distinguish false positives from false negatives. A closed alert that should have escalated is a control gap worth feeding back to the monitoring team.
Worked example
Alert: three cash deposits of $9,200 within ten days into a personal account. Triage confirms the deposits occurred, confirms no currency transaction reports were filed, and checks the profile - IT contractor, salary only. A prior alert fourteen months earlier showed a similar pattern, closed as "salary". That closure lacks any rationale and is inconsistent with the profile. Escalate to a case: the pattern is recurring and unexplained, and the earlier closure is evidence of a control failure, not of innocence.
Traps that cost marks
- Closing on "no adverse media found" as the sole basis.
- Restating the alert rather than analysing it.
- No written plan, so scope drifts and the case cannot be reconstructed.
- Ignoring prior closed alerts, which are often the strongest context available.