Six Monitors, Twelve Hundred Licenses, One Board Promise
You lead compliance monitoring for a licensed financial-services group: 1,200 active licenses and registrations across nine jurisdictions, 3,000 employees. Your team is six people - four monitors, one data analyst, you. Next year's capacity is 5,000 hours, of which 1,800 are already committed to a regulator-mandated remediation review. Last year 92% of testing consisted of desk review of business-unit attestations. Two facts are on the record: a branch self-reported a late filing it found during an internal cleanup; and an audit missed a repeated issue at the same branch that had been "closed" the year before. The board has asked for assurance that "all high-risk obligations are covered annually."
1. Build a risk-scoring approach and an allocation of the remaining 3,200 hours. How do you answer the board's request?
Read the worked answer
Answer the board honestly: the request as phrased is unachievable and accepting it would be the real failure. With 3,200 discretionary hours against 1,200 licenses, promising universal annual coverage guarantees either superficial testing or a false assurance. Offer a defined standard instead: full coverage of Tier 1 obligations every year, rotating coverage of Tier 2, and continuous data testing across 100% of filings.
Scoring (0–5 each, multiplied): regulatory severity (can this suspend a license?); volume and velocity of transactions; history of findings and reliability of the attestation; change (new market, M&A, system migration); detectability (how long before a failure surfaces).
Allocation of 3,200 hours:
- 1,250 - Tier 1 substantive testing (roughly 15–20 obligations), including control design, not just attestation review.
- 800 - continuous analytics: reconcile system-generated filing timestamps against deadlines for the whole population, so volume-heavy risks are covered by data rather than sample.
- 600 - remediation validation and the repeat-finding backlog.
- 350 - emerging risk and post-integration reviews.
- 200 - methodology, training, and reporting.
Say what is not covered. Publish the Tier 2/3 rotation schedule and the residual risk the board is accepting. Then ask them to approve it - that is a governance decision, not yours.
2. Distinguish monitoring from audit in this team's work, and address the independence problem created by helping business units design controls.
Read the worked answer
Definitions that matter in practice:
- Monitoring is ongoing, management-owned, often automated, and exists to detect and correct in real time. It sits in the first or second line.
- Audit is periodic, independent, evaluates both design and operating effectiveness, and concludes with an opinion the audit committee can rely on. It sits in the third line.
Your team is a second-line monitoring function. That is fine - but it cannot also be the source of the independent opinion on controls it helped design. Self-review is the classic impairment.
Practical resolution with six people:
- Write down the split: when the team advises on control design, it records advice and does not later issue the effectiveness conclusion on that control; the conclusion comes from internal audit or an external firm.
- Ring-fence the 1,800-hour mandated remediation review - that is a validation exercise and should be led or reviewed by someone outside the design team.
- Disclose the impairment in the report to the audit committee rather than resolving it silently; a short "independence considerations" section is standard and protective.
- Rotate who tests what: the monitor who designed a control does not test it.
Why this matters here: the missed repeat finding suggests the prior "closure" was accepted on attestation without independent verification - the exact failure mode that an impaired or absent third line produces.
3. Design the test approach for the late-filing risk, and decide how to treat the branch's self-reported finding and the repeat finding.
Read the worked answer
Late-filing risk - test the population, not a sample. Filing timestamps and acceptance records exist electronically, so reconcile 100% of filings against the applicable deadline by jurisdiction. Stratify exceptions by branch, product, and day-of-month to find bottlenecks (for example, filings clustering at month-end). Sample only the qualitative steps a system cannot show: whether the branch had the correct deadline in its calendar, whether escalation happened, whether the underlying data was accurate before filing.
The self-reported finding:
- Test it independently anyway - verify completeness. A branch that self-reports one exception during a cleanup may have found a sample, not the population. Compare its timestamps against the full dataset.
- Credit the behavior: self-identification and prompt escalation are exactly what the program wants and should be recognized in the report.
- Do not reduce severity on that basis. Self-reporting mitigates penalty and culture risk; it does not mitigate the control failure.
- Ask what prompted the cleanup and why normal monitoring did not catch it.
The repeat finding and the missed audit:
- Reclassify as a repeat finding and escalate to the audit committee with an accountable executive owner and a dated plan.
- Root-cause the prior closure: if remediation was training-only and the control itself was unchanged, the closure was not evidence-based. Add a validation step to every closure.
- Assess whether the miss was a sampling artifact or a scoping error - the answer changes whether other "closed" items need re-testing. Assume re-testing is needed until shown otherwise.