Why Detection Timing Matters
A preventive control is intended to stop an error or unauthorized action before it occurs. A detective control identifies an event or condition after it has occurred. That distinction matters because detection can limit the duration or consequences of an exposure, but it cannot make the original event not have happened. A reconciliation may reveal that recorded cash does not agree with bank records; an exception report may flag a transaction outside an approved rule; an independent review may identify an error in a completed underwriting or claims decision.
The value of a detective control depends on more than whether it can identify an exception. The process must identify the relevant events, produce a usable signal, and bring that signal to an appropriate reviewer in time for a response to matter. A control that detects every exception but reports them only after months of delay may provide little protection against a continuing exposure. Conversely, a prompt report with too many alerts for the available reviewers can leave important items unexamined.
The relevant time interval depends on the risk. A daily reconciliation might be appropriate for a high-volume cash process, while a quarterly review could be adequate for a low-frequency exposure that changes slowly. The assessment should begin with the exposure and the time available to respond, rather than assuming that a daily, weekly, or monthly control is inherently adequate.
How Detective Controls Surface Exceptions
A reconciliation compares two records or sources that should agree, such as a transaction ledger and a bank statement. Differences may arise from timing, data quality, processing errors, or misconduct. The reconciliation is useful only if it is complete, differences are investigated rather than merely carried forward, and significant unresolved items are visible to someone with authority to act.
An exception report identifies records that meet defined criteria, such as a transaction above an approval threshold, a payment to a changed account, or a policy endorsement outside permitted parameters. The report’s rules determine what it can detect. An exception not represented in the data, not covered by a rule, or incorrectly filtered out will not appear just because the report runs on schedule.
An independent review provides a separate examination of a transaction, decision, or control evidence by a reviewer who is sufficiently independent of the original activity. The reviewer may examine every item or a sample. A review of a sample can provide information about the process, but it does not guarantee that any particular error will be found.
For each of these controls, distinguish three questions: Was the relevant population included? Was the exception recognized under the control’s criteria? Was the result delivered and reviewed soon enough? A “yes” to only the first two questions does not establish timely identification.
Assessing Timeliness and Capacity
A practical assessment follows the signal from the event through the review process. Record when the event occurred, when source data became available, when the control ran, when the exception was assigned, and when a reviewer could act on it. These timestamps reveal whether delay comes from data availability, control frequency, report production, or a queue of alerts awaiting review.
Specify which error, transaction, or misconduct the control is intended to identify and what can continue while it remains undetected.
Establish when the event enters the relevant data, when the control runs, and when an exception becomes visible to a reviewer.
Ask whether detection occurs before further material exposure accumulates or before a relevant decision or deadline becomes difficult to change.
Compare expected alert volume with practical review capacity, allowing for peaks, absences, and the time needed to investigate complex cases.
Confirm that identified exceptions are assigned and escalated under the applicable process; report generation alone is not evidence of effective identification.
If an alert queue receives more items than reviewers can handle, the queue can make actual detection later than the report’s scheduled production time. A useful first check is whether the workload due within a stated review target exceeds available capacity. Expected volume is not a guarantee: a sudden spike or uneven arrival pattern can create a longer delay even when weekly averages appear manageable.
When events occur at a roughly stable rate, a simple model can help quantify the exposure accumulated during detection lag. Let events occur according to a Poisson process at rate \(\lambda\) events per time unit, let each event have independent severity \(S\) with finite mean \(E[S]\), and let the detection delay be a fixed \(T\) time units. Assume the rate and severity distribution remain constant during the delay, every event creates a loss, and no effective response changes losses before detection. The expected gross loss arising during the delay is:
To see why, the number of events during \(T\) has expected value \(\lambda T\). Conditional on \(N\) events, total loss is the sum of \(N\) severities, with conditional expected value \(N E[S]\). Taking expectations gives \(E[L_T]=E[N]E[S]=\lambda T E[S]\), using the stated independence and constant-mean assumptions. This is an expectation, not a prediction of the exact loss in a particular period. It does not apply unchanged if event rates vary materially over time, severities depend on event count, or detection and response alter losses before the stated delay ends.
Worked Assessments
Worked Example: A Cash Reconciliation With a Growing Difference
A hypothetical insurer’s cash ledger shows $382,440 of receipts for a period, while the corresponding bank record shows $379,920. The reconciliation is completed six business days after the first affected posting. Its escalation threshold is an unexplained difference above $500. For this assessment, assume a suspected diversion would add $420 to the difference on each business day, including the first affected posting, and that the difference has not otherwise been resolved. Determine whether the control identifies a reportable exception and quantify the difference at detection.
Method. First calculate the ledger-to-bank difference, then compare it with the threshold. Under the stated scenario, use the daily increase and six-business-day period to calculate the amount accumulated by detection.
The initial recorded difference is \(382{,}440-379{,}920=\$2{,}520\). Since \(\$2{,}520>\$500\), the difference exceeds the escalation threshold and is reportable. The additional amount over six business days is \(6\times \$420=\$2{,}520\). The difference at detection is therefore \(\$2{,}520+\$2{,}520=\$5{,}040\).
Check. The detection-time amount exceeds the threshold by \(\$5{,}040-\$500=\$4{,}540\). The reconciliation identifies a significant exception, but the six-business-day lag also allowed the hypothetical difference to grow by $2,520 after its initial amount. This calculation measures the stated difference; it does not establish its cause.
Common mistake avoided: Treating a reconciliation that eventually finds a difference as automatically timely. The control surfaces the exception, but its lag must still be compared with how quickly the exposure can grow.
Worked Example: Can Reviewers Clear the Weekly Alert Batch?
A hypothetical exception report produces 84 alerts in a week. Reviewers can investigate 12 alerts per working day, and the target is to review every alert within five working days. Can the expected weekly batch be completed within the target, and what is the shortfall?
Method. Calculate the number of alerts that can be investigated during the five-day target, then compare that capacity with the 84 alerts due for review.
Capacity is \(12\times5=60\) alerts. Because \(60<84\), the expected batch cannot be completed within the target at that capacity. The shortfall is \(84-60=24\) alerts.
Check. Reviewers can clear 60 of the 84 alerts within five working days, leaving \(84-60=24\) beyond that capacity. The report may be generated promptly, but at least 24 alerts cannot be reviewed within the target under the stated workload and capacity assumptions. This does not say which alerts will be delayed; prioritization could change that, but it would not make the capacity sufficient to review all 84.
Common mistake avoided: Saying “yes” because the report arrives weekly or because 12 alerts sounds like substantial daily capacity. The relevant comparison is \(12\times5=60\) against 84; since 60 is less than 84, the answer is no.
Worked Example: Expected Loss During a Detection Delay
Suppose a hypothetical processing weakness produces events at an average rate of 3 per month. Event severities are independent, each with mean $4,000. A detective review identifies the condition after a fixed two-month delay. Assume the event rate and mean severity remain constant, and no response reduces losses before identification. Estimate expected gross loss during the delay and the probability that at least one event occurs.
Method. Apply the Poisson-process assumptions stated above. The expected event count over two months is the monthly rate multiplied by the delay; expected gross loss is that count multiplied by mean severity.
Expected event count is \(3\times2=6\). Expected gross loss is \(6\times\$4{,}000=\$24{,}000\). For a Poisson count with mean 6, the probability of no events is \(e^{-6}\). Therefore, the probability of at least one event is \(1-e^{-6}=0.997521\ldots\), or 0.9975 to four decimal places.
Check. The expected count is 6, and the probability of at least one event is just under 1, as expected for a Poisson mean of 6. The $24,000 is an expected amount, not a guaranteed loss or a maximum loss.
Common mistake avoided: Treating the expected loss as certain, or multiplying the rate by severity without accounting for the two-month delay. The calculation depends on a constant event rate, a finite mean severity, and the stated assumption that response does not change losses before detection.
Worked Example: What Does an Independent Review’s Detection Rate Mean?
A hypothetical independent review examines all 40 completed endorsements from a period. A separate, reliable assessment establishes that 8 endorsements contain an error. Assume the reviewer has an 80% probability of identifying each erroneous endorsement, independently across the 8 errors. The review is completed four business days after the endorsements are issued. Calculate the expected number of errors identified and the expected number not identified. If the risk owner needs identification within three business days, does the review meet that timing requirement?
Method. Multiply the number of known errors by the per-error detection probability to obtain expected detections. Subtract from the known error count to find the expected number not identified. Compare the review’s completion time with the stated requirement.
Expected errors identified are \(8\times0.80=6.4\). Expected errors not identified are \(8-6.4=1.6\), equivalently \(8\times0.20=1.6\). The review takes four business days, which is longer than the three-business-day requirement, so it does not meet the timing requirement.
Check. Identified plus unidentified expected errors sum to \(6.4+1.6=8\), the known total. The expected values need not be whole numbers; the actual count in a particular review will be an integer. The review is independent, but it is neither certain to find every error nor timely against the stated deadline.
Common mistake avoided: Calling the review effective simply because it is independent or examines every endorsement. Its assumed detection sensitivity is less than 100%, and its four-day completion time misses the three-day requirement.
Common Interpretation Traps
- Confusing detection with prevention. A detective control reveals an event after it occurs. It may shorten exposure duration, but it does not erase the original error or loss.
- Equating a generated report with identification. If alerts remain unassigned in a queue, the control has not necessarily brought them to a reviewer in time.
- Ignoring the data and rule boundary. A reconciliation or report cannot identify an item absent from its source data or outside its comparison and exception criteria.
- Using averages as a guarantee. Average weekly alert volume below average capacity does not ensure that every alert will meet a deadline; arrivals, reviewer availability, and case complexity can vary.
- Overstating what a sample review establishes. A sample can miss errors. Even a full review may have imperfect detection sensitivity or be completed too late.
- Confusing identification with resolution. An exception is a signal for attention, not proof that its cause has been established or that the exposure has ended.
The central assessment is whether the control’s coverage, sensitivity, data availability, and review capacity together produce identification within the risk’s available response window. This distinction is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus: control value depends not only on design intent, but also on what the process can identify and when that information becomes actionable.
Check Your Understanding
For each problem, state the comparison or assumption used as well as the result.
- A hypothetical account reconciliation finds a $1,860 difference against an escalation threshold of $750. The difference is first observed at day 1 and grows by $190 per business day for four business days, including day 1. What is the amount at detection, and does it exceed the threshold? (Answer: $2,620 at detection; yes, it exceeds the threshold by $1,870.)
- An exception report produces 96 alerts in a week. Reviewers can complete 18 investigations per working day, and the target is five working days. Can all alerts be reviewed within the target? State the shortfall or spare capacity. (Answer: No; capacity is \(18\times5=90\) alerts, so the shortfall is 6 alerts.)
- Events follow a Poisson process at 2 events per month. Independent event severity has mean $7,500, and detection takes 1.5 months. Assume a constant rate and no response before detection. What are the expected event count, expected gross loss, and probability of at least one event? (Answer: 3 events; $22,500; \(1-e^{-3}=0.9502\) to four decimal places.)
- An independent review examines all records and is expected to detect 80% of 12 known errors. It finishes four business days after processing; the required identification time is three business days. What is the expected number detected, and is the timing requirement met? (Answer: 9.6 errors expected to be detected; no, four business days exceeds the three-day requirement.)
- A report generates 55 alerts during a five-day review window. Reviewers can investigate 11 alerts per day. Is stated capacity adequate for the batch? What additional operational fact should be checked before concluding that actual identification is timely? (Answer: Capacity is \(11\times5=55\), so it is adequate exactly at the stated volume; check arrival timing, reviewer availability, and whether investigation complexity permits 11 completed reviews each day.)