An organisation can identify a warning sign and still fail to deal with the problem.
Looking across our recent RiskBusiness Newsflashes, one of the recurring concerns was that information pointing to potential problems had already been available. In some cases, warnings had been raised or unusual activity identified, yet the subsequent response proved inadequate.
This raises a question about how organisations assess control effectiveness.
An alert demonstrates that something has been detected. It does not establish whether the concern was properly investigated, the explanation was justified or if appropriate action followed.
There can be a considerable gap between identifying a potential problem and doing something meaningful about it.
When the warning is already there
A September 2026 report from the Federal Reserve’s Office of Inspector General provides a particularly revealing example.
The audit examined weaknesses in the Federal Reserve Board’s arrangements for managing departing employees and preventing the unauthorised removal of sensitive information.
In the 90 days before retiring in July 2024, one employee triggered 279 data loss prevention alerts. Some were flagged as potentially involving sensitive Federal Open Market Committee information. The employee also had a previous confirmed information-security violation from 2021, involving the transfer of sensitive information to an unencrypted USB device.
Despite this history, the Inspector General found serious deficiencies in how the subsequent warnings were handled.
Explanations were accepted without adequate verification, established escalation procedures were not consistently followed, and responsibilities across the functions involved were unclear.
When the employee eventually submitted files for examination, none matched the information originally identified by the alerts. The discrepancy went unnoticed during the initial review, and efforts to obtain other outstanding material were not pursued to completion.
The Inspector General found that the potential incident had remained unresolved for over a year.
Importantly, the Inspector General’s Office of Investigations concluded that there was insufficient basis to pursue a misconduct investigation into the 2024 incident. The available records did not clearly establish what information had been removed, and many of the alerts were confirmed as false positives.
Nevertheless, the findings exposed significant weaknesses in the organisation’s ability to assess and resolve a potential information-security incident.
The system had generated warnings. The organisation’s response did not provide sufficient assurance that those warnings had been properly dealt with.
When familiar warnings receive less attention
False positives are an unavoidable feature of many monitoring environments.
Sanctions screening, transaction monitoring and information-security systems can generate large numbers of alerts that ultimately require no intervention. Operational teams must make judgements about which warrant further investigation, and which can reasonably be dismissed.
Over time, those judgements can become influenced by familiarity.
A warning that has been explained several times may attract less scrutiny when it appears again. Staff recognise the activity, remember previous assessments and become comfortable with the explanations already given.
This is particularly understandable where teams face high alert volumes and pressure to clear outstanding cases.
The Federal Reserve findings illustrate the potential consequences. Explanations that alerts were false positives were accepted without adequate verification, although the Inspector General later confirmed that many of the alerts genuinely were false positives.
The problem was not that every warning should have been treated as evidence of wrongdoing. It was that previous explanations were relied upon without sufficient examination of the activity being reported.
There is a legitimate case for improving monitoring rules to reduce unnecessary alerts. But where similar warnings continue to appear, organisations also need to consider whether the circumstances have changed or whether an underlying problem remains unresolved.
An explanation that was satisfactory previously should not automatically settle the next investigation.
Who takes responsibility after escalation?
Most organisations have documented procedures setting out when and how concerns should be escalated.
Those procedures are necessary, but the movement of information between functions can create its own weaknesses.
The Federal Reserve audit found that different teams held conflicting understandings of who was responsible for investigating and resolving the potential incident. Some believed other functions had responsibility for escalation, while others expected the employee’s division to determine what happened next.
The result was a prolonged failure to resolve the matter.
This is a risk that extends well beyond information security.
An operational team may identify an issue and refer it to compliance or risk for review. The receiving function may assume that the business has already completed the necessary investigation, while the original team believes responsibility has passed elsewhere.
Each function may understand its individual responsibilities without anyone maintaining clear accountability for the overall outcome.
Escalation should establish who has authority to decide what happens next and who remains responsible for seeing that decision through.
Where further investigation is required, that responsibility needs to be explicit. The same applies when additional evidence becomes available, or an initial assessment is challenged.
Without clear ownership, an organisation can maintain a detailed record of notifications and handovers while leaving the original concern unresolved.
Is challenge influencing the decision?
The effectiveness of an alert-handling process also depends on how willing people are to question the explanations they receive.
Operational teams often have the knowledge needed to explain unusual activity. Their assessments are essential, particularly where monitoring systems generate alerts that turn out to be harmless.
But familiarity with a process can sometimes make it easier to accept an explanation without examining it closely enough.
Second-line functions have an important role in providing independent challenge, especially where concerns recur or the consequences of an incorrect assessment could be significant.
That challenge needs to influence the investigation rather than simply become another step in the approval process.
Where evidence contradicts an initial explanation, the original assessment should be reconsidered. Recurring exceptions may also justify examining whether the underlying control is operating as intended.
Organisational behaviour has a role here too.
People must feel able to question an assessment made by a more experienced colleague or senior manager, particularly where established assumptions are being relied upon.
The existence of a challenge process offers limited assurance if the organisation is reluctant to reconsider decisions that have already been made.
What does it mean to close an alert?
An alert can be closed for perfectly legitimate reasons. Investigation may establish that the activity was harmless, or that the original concern has been satisfactorily addressed.
But closure should reflect a considered decision, supported by the available evidence.
The distinction becomes particularly significant when information remains incomplete, or follow-up actions have not been finished.
A case may no longer appear on an outstanding alerts report, even though the organisation cannot fully explain what happened or why no further action was considered necessary.
For risk, compliance and internal audit functions, there is value in examining how significant alerts reach their conclusion.
Following a sample of cases from initial detection through to closure can establish whether explanations were tested, whether decisions were appropriately authorised, and whether required actions were completed.
It can also reveal where concerns have resurfaced after earlier investigations.
Repeated exceptions deserve particular attention. Where an issue continues despite previous reviews, management should be able to explain why the earlier response was considered sufficient and what has changed since.
For boards and risk committees, this provides a different perspective on the effectiveness of the control environment.
Alert volumes and closure rates can help demonstrate how a monitoring process is operating. But they say relatively little about the quality of the decisions being made.
Management should be able to provide assurance that significant warnings are properly assessed and that unresolved concerns remain visible until an appropriate decision has been reached.
The response is part of the control
The Federal Reserve findings show how weaknesses can persist even when systems are identifying potentially concerning activity.
The issue was not simply the availability of information. It was how that information was handled once it reached the people responsible for reviewing it.
Looking across external incidents and regulatory findings can help organisations recognise weaknesses that may also exist within their own control environments. The value lies in understanding not only what went wrong elsewhere, but what was known beforehand and whether there were opportunities to intervene.
There will always be warnings that turn out to be harmless. Effective control does not require every alert to trigger an extensive investigation or intervention.
It does require a defensible basis for deciding when further action is necessary, and sufficient oversight to ensure that significant concerns do not disappear within the process.
An alert allows the organisation to act. Control effectiveness depends on what it does with that opportunity.
Stay up to date with the latest news and views from the world of governance, risk, audit and compliance >>>
