Perspectivas
Perspective 016Management Information

The number that is not in the pack is usually the one the Board needs.

A practitioner's note on the most reliable way to find out what a financial crime MI pack is missing: look at what the Board has been deciding outside of it.

El texto completo de este análisis se publica en inglés. La estructura, las cifras y las referencias son las mismas en ambas versiones del sitio.

Por Everett MorganLate Summer 20268 min read
An open Board pack and a fountain pen on a quiet boardroom table
Executive summary

The most reliable way to find out what an MI pack is missing is not to read the pack. It is to read the decisions the Board has been taking outside it.

This is a companion note to Guide 008, Building Meaningful AML Management Information. The guide sets out the full MI cycle, page by page. This piece sits on the single most useful diagnostic I have for an MI pack that has quietly stopped driving decisions.

Key takeaways
  1. 01

    Every MI rebuild I have led begins the same way. The team brings me the current pack. We sit down with the last four cycles of Board and Audit Committee minutes and mark, against each page, the decisions the Board actually took. Most pages, in most cycles, have no decision marked against them.

  2. 02

    We then look at the decisions the Board took that were not connected to any specific page in the pack. There are usually some. And they are often among the most useful decisions to examine.

  3. 03

    Those orphan decisions are the map. In my experience, they often point to residual risk that the standing pack is not showing clearly enough, particularly at segment, jurisdiction, product or customer-type level. Sometimes the business has changed since the pack was designed. Sometimes the number exists elsewhere but has never made it onto the page.

  4. 04

    The most useful hour I spend on an MI rebuild is the first hour, and it is not spent looking at the pack at all. It is spent reading what the Board has been worrying about, in its own words.

  5. 05

    A pack that has not changed shape after an annual rebuild is not a pack that has been rebuilt. It is a pack whose cover has been redesigned.

  6. 06

    One of the most useful tests I use is to look at how much of the standing pack has actually informed a Board decision, challenge or follow-up over the last few cycles. There is no magic percentage. But if large parts of the pack repeatedly produce nothing beyond “noted”, I want to know why they are still there.

Most MI rebuilds start in the wrong place. The team produces the existing pack, page by page, and the conversation that follows is about layout, frequency, dashboard design and which charts could be cleaner. Those things may need fixing. But in my experience they are rarely the reason the pack has stopped being useful.

What is wrong with the pack is structural. The Board is being shown a story that the firm is not living, and the way you find out is not to read the pack more carefully. It is to read what the Board has been deciding while the pack was sitting in front of them.

The exercise that does the work

Take the last four cycles of Board and Audit Committee minutes. Sit them on the table next to the MI pack from each cycle. Mark against each page every decision, challenge or follow-up it produced. Not simply “noted”. I mean an approved action, a recorded risk acceptance, a request for further analysis, a challenge that changed the discussion or a decision that followed.

That does not mean every page needs to produce a decision every time it appears. Some MI earns its place by showing that a risk remains stable, a control remains effective or an agreed tolerance has not been breached. But if a page repeatedly produces no decision, no challenge and no useful assurance, I would ask what job it is doing.

On most packs I have run this exercise against, most pages carry no marks. The pages have been read. They have been noted. They have not moved anything in four cycles. That is a meaningful piece of data on its own, and it often gives me a surprisingly clear view of what can be challenged or removed in the rebuild.

The decisions that came from nowhere in the pack

The more useful column, though, is the one for decisions the Board took that were not connected to any specific page in the pack. There are usually some. And they are often among the most useful decisions to examine.

A Non-Executive Director who asked, halfway through the meeting, what the firm's exposure was to a particular customer segment that nobody on the executive could immediately quantify. A Chair who paused on the regulatory correspondence summary and asked whether two recent letters were really about two different control areas or one. An Audit Committee member who challenged the ageing of a single finding and triggered a wider conversation about ageing as a whole.

The decisions that came from outside the pack are the map. They tell you what the Board needed to see and was not being shown.

What the orphan decisions often have in common

There is a pattern I have seen more than once. The questions tend to move away from activity and towards residual risk. They get more specific: a segment, a jurisdiction, a product or a customer type. And quite often they expose something the standing pack was never designed to show.

Sometimes that is because the business has changed. The segment was smaller, the product did not exist or the exposure looked different when the pack was built. The pack has been added to over time, but its bones have never been reset to the shape of the current firm. The additions sit on top of the bones. The rebuild puts the bones back into alignment.

What I would do this week, if I were the MLRO

Read the minutes of the last four Board and Audit Committee meetings, in date order, in a single sitting. Mark, in the margin, every decision, challenge or follow-up that came from outside the standing pack. Group them by theme. The themes that recur tell you where the next rebuild needs to focus. Sometimes that means a new page. Sometimes it means changing the segmentation, commentary or thresholds on one you already have. And the pages that have produced nothing beyond “noted” for four cycles are the ones I would challenge hardest.

None of this is sophisticated. None of it depends on a new data feed, a new system or a new dashboard. It depends on the discipline of reading what the Board has actually been worrying about and rebuilding the pack to put those worries on the page earlier next time. That is the difference between a pack that supports decisions and a pack that describes activity.

Guide 008 sets out the full MI cycle, including the five-question rebuild, the KRI register, the commentary discipline and the annual rebuild as a standing Board paper. Download the full guide and use the KRI register in the appendix as the starting point for your own.

Sobre el autor
Everett Morgan
Founder & Principal Adviser, Claritas Risk Advisory

Everett has more than twenty years' experience in financial crime, AML governance, regulatory compliance and operational risk gained within Deutsche Bank, Morgan Stanley and BNP Paribas. He established Claritas Risk Advisory to provide smaller regulated financial institutions with experienced independent judgement, practical insight and proportionate recommendations.

¿Necesita una opinión independiente?

Preparing for regulatory change starts with understanding where your organisation stands today.

If you would like to discuss your financial crime framework or explore how Claritas Risk Advisory can help, I would be pleased to arrange a confidential conversation.

Empecemos con una conversación