Perspectives
Perspective 016Management Information

The number that is not in the pack is usually the one the Board needs.

A practitioner's note on the most reliable way to find out what a financial crime MI pack is missing: look at what the Board has been deciding outside of it.

By Everett MorganLate Summer 20268 min read
An open Board pack and a fountain pen on a quiet boardroom table
Executive summary

The most reliable way to find out what an MI pack is missing is not to read the pack. It is to read the decisions the Board has been taking outside it.

This is a companion note to Guide 008, Building Meaningful AML Management Information. The guide sets out the full MI cycle, page by page. This piece sits on the single most useful diagnostic I have for an MI pack that has quietly stopped driving decisions.

Key takeaways
  1. 01

    Every MI rebuild I have led begins the same way. The team brings me the current pack. We sit down with the last four cycles of Board and Audit Committee minutes and mark, against each page, the decisions the Board actually took. Most pages, in most cycles, have no decision marked against them.

  2. 02

    We then look at the decisions the Board took that were not connected to any specific page in the pack. There are always some. They tend to be the most important decisions of the cycle.

  3. 03

    Those orphan decisions are the map. They tell you which numbers the Board actually needed to see and was not being shown. They are almost always residual risk numbers, almost always specific to a segment or a customer type, and almost always missing because the segment did not yet exist when the pack was last designed.

  4. 04

    The most useful hour I spend on an MI rebuild is the first hour, and it is not spent looking at the pack at all. It is spent reading what the Board has been worrying about, in its own words.

  5. 05

    A pack that has not changed shape after an annual rebuild is not a pack that has been rebuilt. It is a pack whose cover has been redesigned.

  6. 06

    The single most reliable test of whether your MI is working is the proportion of pages, across the last four cycles, that have a Board decision attached to them. If the answer is less than half, the pack has stopped earning its place on the agenda.

Most MI rebuilds start in the wrong place. The team produces the existing pack, page by page, and the conversation that follows is about layout, frequency, dashboard design and which charts could be cleaner. None of that, in my experience, is what is wrong with the pack.

What is wrong with the pack is structural. The Board is being shown a story that the firm is not living, and the way you find out is not to read the pack more carefully. It is to read what the Board has been deciding while the pack was sitting in front of them.

The exercise that does the work

Take the last four cycles of Board and Audit Committee minutes. Sit them on the table next to the MI pack from each cycle. Mark, against each page of the pack, every Board decision that came from that page. Not a "noted". A decision: an approved action, a recorded acceptance, a request for a future paper, a challenge that produced an answer.

On most packs I have run this exercise against, most pages carry no marks. The pages have been read. They have been noted. They have not driven a single decision in four cycles. That is a meaningful piece of data on its own, and it usually removes a third of the pack in the rebuild.

The decisions that came from nowhere in the pack

The more useful column, though, is the one for decisions the Board took that were not connected to any specific page in the pack. There are always some. They are usually the most important decisions of the cycle.

A Non-Executive Director who asked, halfway through the meeting, what the firm's exposure was to a particular customer segment that nobody on the executive could immediately quantify. A Chair who paused on the regulatory correspondence summary and asked whether two recent letters were really about two different control areas or one. An Audit Committee member who challenged the ageing of a single finding and triggered a wider conversation about ageing as a whole.

The decisions that came from outside the pack are the map. They tell you what the Board needed to see and was not being shown.

What the orphan decisions almost always have in common

They are almost always about residual risk rather than about activity. They are almost always specific to a segment, a jurisdiction or a customer type rather than firm-wide. They are almost always asked by the same one or two Non-Executive Directors, who are usually the ones with the most uncomfortable questions and the longest tenure.

And they are almost always missing from the pack because, at the time the pack was last designed, the segment or the jurisdiction or the customer type did not yet exist in the shape it has now. The pack has been added to, but its bones have not been reset to the shape of the current firm. The additions sit on top of the bones. The rebuild puts the bones back into alignment.

What I would do this week, if I were the MLRO

Read the minutes of the last four Board and Audit Committee meetings, in date order, in a single sitting. Mark, in the margin, every decision that came from outside the standing pack. Group them by theme. The two or three themes that recur are the two or three pages your next rebuild needs to add. The pages they would replace are the pages with no marks against them in the four-cycle pass.

None of this is sophisticated. None of it depends on a new data feed, a new system or a new dashboard. It depends on the discipline of reading what the Board has actually been worrying about and rebuilding the pack to put those worries on the page earlier next time. That is the difference between a pack that supports decisions and a pack that describes activity. The first is rare. The second is almost universal.

Guide 008 sets out the full MI cycle, including the five-question rebuild, the KRI register, the commentary discipline and the annual rebuild as a standing Board paper. Download the full guide and use the KRI register in the appendix as the starting point for your own.

About the author
Everett Morgan
Founder & Principal Adviser, Claritas Risk Advisory

Everett has more than twenty years' experience in financial crime, AML governance, regulatory compliance and operational risk gained within Deutsche Bank, Morgan Stanley and BNP Paribas. He established Claritas Risk Advisory to provide smaller regulated financial institutions with experienced independent judgement, practical insight and proportionate recommendations.

Need an independent perspective?

Preparing for regulatory change starts with understanding where your organisation stands today.

If you would like to discuss your financial crime framework or explore how Claritas Risk Advisory can help, I would be pleased to arrange a confidential conversation.

Let's start with a conversation