Illustrative template
Illustrative: rebuilding alert triage and filing evidence in one programme
This entry exists to show the shape of a case study on this site: what is described, what is measured, how the measurement is defined, and what the institution still owns. Every outcome below is deliberately unmeasured.
Illustrative composite. No institution is described here, and nothing on this page reports something that happened. Every result below is deliberately unmeasured, and the page is excluded from search indexing so it cannot be mistaken for a customer reference by someone arriving from a search engine.
Placeholder — this is a template showing the structure of a case study; no institution is described and no outcome is reported. Replace with sourced, approved content before this page is made public.
- Institution
- Illustrative composite. No institution is described here, and nothing on this page reports something that happened.
- Sector
- Placeholder — for example, a commercial bank or a licensed payment service provider
- Regulatory context
- Placeholder — the supervisory regime and reporting obligations that applied would be stated here.
- Approval reference
- None. A study is not published as a customer reference without one.
Challenge
The situation as the institution described it
The challenge section states the situation as the institution described it, in its own operational terms, with the constraints that were real at the time. It is written before any solution is mentioned, and it is specific enough that a reader in a similar position recognises their own problem in it.
- What the compliance function was accountable for, and what it was resourced with.
- Which controls existed, which were manual, and where the evidence for a decision actually lived.
- What triggered the change: an internal review finding, a supervisory observation, a growth in volume, a system replacement.
- What had already been tried, and why it did not resolve the issue.
Approach
What was actually done, and by whom
The approach section records what was actually done, in sequence, including the parts the institution did rather than the vendor. It names the decisions that had to be made by the compliance function itself, because those are the decisions a reader in the same position will have to make too.
Discovery and baseline
What was measured before anything changed, and how. Without a baseline captured at the start, every later figure is an assertion. The measures chosen at this stage are the ones the outcomes section can honestly report on later.
Configuration decisions the institution owned
Which segments, which detection scenarios, which risk factors and weights, which approval thresholds. These are policy decisions with a named owner, and a case study that presents them as vendor defaults has misdescribed how the work is done.
Migration and parallel running
What was moved, what was left behind, how long both ran together, and what was compared between them.
Evidence and governance
How decisions became reviewable: retained rule versions, maker-checker on sensitive actions, an audit record for reconstructing a decision after the fact.
Handover
Who operates it now, what training was involved, and what the institution has to keep doing for the result to hold.
Result
Measured outcomes
Each row states the measure and the method whether or not a result exists, because the method is what makes a number worth anything.
| Measure | Result | Method |
|---|---|---|
| Median analyst time from alert raised to disposition recorded | Not measured. No verified result exists for this entry. | Median over all alerts closed in a complete quarter after go-live, compared against the same measure for a complete quarter before the change. Stated as a median rather than a mean because a small number of complex investigations distort the mean badly. |
| Share of alerts escalated to investigation, by detection scenario | Not measured. No verified result exists for this entry. | Escalations divided by alerts raised, per scenario, over the same two periods. Reported per scenario rather than in aggregate: an aggregate figure moves whenever the mix of scenarios moves, independently of whether anything improved. |
| Time to assemble the evidence pack for a filed report | Not measured. No verified result exists for this entry. | Elapsed time from the decision to report to a complete pack being ready for review, measured on a sample agreed with the institution and reviewed by someone outside the team that produced it. |
| Proportion of closed alerts reconstructable end to end | Not measured. No verified result exists for this entry. | A sample of closed alerts is re-opened and checked for the rule version, the parameters in force, the input values, the reason code and the approval. Reported as the share where all five are present. |
What the software does not do for you
- Detection quality depends on the institution's own segmentation, thresholds and reference data. Software does not supply those, and a study that implies otherwise is describing something that did not happen.
- Filing to a regulator depends on the authority's current schema, code lists and channel, which are obtained from the authority and accepted by the institution.
- Figures from one institution's book do not transfer to another's. The method beside each measure is the transferable part, not the number.
Capabilities this touches
Evaluating us
Ask for references rather than reading ours
We would rather introduce you to someone operating the platform than write a page about them. Ask, and we will arrange it.