Field Notes
Ranking residual exposure without inflating every finding
How we rank findings from audits of risk control monitoring applications so committees can act in order.
An application audit that treats every observation as critical teaches committees to ignore the register. When we examine risk control monitoring applications, we rank residual exposure using volume of activity behind the control, strength of evidence that monitoring fails, and whether alternate detective controls exist outside the application.
Three questions per finding
- How much activity sits behind this control family in the sample window?
- How clearly did testing show the monitoring path fails or stays silent?
- Is there a credible alternate path that would still catch the failure?
High volume, clear failure, and no alternate path rises. Low volume with a strong alternate path still gets written — but not as the lead item.
Why clients push back
Some sponsors want every item elevated ahead of a regulatory visit. We will correct facts; we will not recolour ratings to match a desired narrative. That stance is part of why the practice stays independent of software vendors and implementation houses.