Why Cross-Functional Incidents Need a Structured Diagnosis
A material risk incident can involve several functions without any one of them having a complete view. A business unit may operate the process, actuarial may assess its financial consequences, compliance may interpret obligations, and internal audit may review controls independently. The involvement of all four does not, by itself, mean accountability was clear or effective.
The diagnostic task is to reconstruct what each function was expected to do, what it actually did, what information it had, and what happened next. This tutorial is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus. It uses the Three Lines Model as a role framework: business management owns and manages risks; specialist functions such as actuarial and compliance provide expertise, monitoring, or challenge within their mandates; and internal audit provides independent assurance. An organization's exact responsibilities still depend on its documented governance arrangements.
A Practical Method for Tracing Accountability
Start with the incident, not with a presumed culprit. Establish a factual timeline, then examine the related responsibilities and handoffs. A function being copied on a report does not establish that it owned the underlying control, accepted a decision, or completed an independent review.
State what happened, when it was detected, and the relevant risk or control failure. Separate confirmed facts from hypotheses about causes.
Record when each function learned, or reasonably should have learned, material information; what it communicated; and to whom. Note decision dates, reporting channels, and documented acknowledgements.
For each key activity, identify the accountable business owner, relevant specialist input or monitoring, escalation recipient, and any independent assurance expected. Compare these with written responsibilities and actual conduct.
Decide whether the primary gap concerns ownership, escalation, overlapping mandates, assurance, or a combination. Test the diagnosis against records, and avoid inferring responsibility merely from a function's title.
Make the remedy address the identified break: for example, assign a control owner, define an escalation trigger and recipient, resolve a mandate conflict, or schedule independent testing. Name who will complete and verify the action.
A useful way to organize the evidence is to ask four questions for each significant activity: Who acts? Who advises or challenges? Who must be informed or decide? Who independently tests the arrangement? These questions are related but not interchangeable. An adviser may identify a concern without owning the business control; an executive may receive an escalation without performing the control; and internal audit may report a weakness without taking responsibility for fixing it.
Why the Diagnostic Sequence Works
The sequence is more than a checklist. If an incident occurred, the explanation must be consistent with both the event and the governance evidence. For example, a control failure might reflect an owner who did not perform an assigned task, a task that no role was assigned to perform, or a concern that was detected but never escalated. Those explanations imply different remedies. Beginning with a preferred explanation can cause the reviewer to treat evidence of one kind of gap as proof of another.
The logic can be stated as a short test. A responsibility can be evaluated only by comparing an expected action with an observed action. An escalation failure can be established only if relevant information, a reporting obligation or trigger, and a failure to transmit or act can be identified. An assurance gap requires a defined need for independent assessment and evidence that such assessment was not performed or was inadequate. If one of these elements is unknown, the diagnosis should remain qualified rather than presented as a proven fact.
Worked Incident Traces
Worked Example: A Claims Trend Reaches Actuarial Too Late
Hypothetical scenario. A business unit introduces a new repair network for a specialty vehicle product. Over six weeks, claims staff record an increase in supplements to repair estimates. The claims manager sees a weekly dashboard but does not send it to the product risk committee because the dashboard is labelled “operational.” Actuarial receives the data during its quarterly review, identifies a possible increase in expected claim severity, and asks compliance whether the change creates a customer-disclosure concern. Compliance responds that it has not assessed the operational trend. The incident review asks whether actuarial, compliance, or the claims unit failed.
Method: reconstruct the information path before assigning fault. The confirmed sequence is: claims staff record the supplements; the claims manager sees the dashboard; the manager does not escalate it; actuarial later detects a potential severity effect; compliance is asked a question about disclosure but does not assess claims operations. The underlying business process and claims data remain within the business unit's operating responsibility.
Ownership diagnosis. The facts do not show that actuarial owned claims monitoring. Its later analysis is consistent with an actuarial assessment role, but it does not substitute for routine business monitoring. The first gap to investigate is whether the claims manager had a documented duty to assess and escalate a sustained trend. If that duty existed, the evidence points to a missed escalation. If no role or trigger was defined, the stronger diagnosis is unclear ownership or an incomplete escalation design. The scenario alone does not establish which is true.
Cross-functional boundaries. Compliance was asked about a possible disclosure issue, not assigned to operate the claims control. Its response does not establish that compliance should have independently detected the trend. Actuarial's identification of a financial implication also does not automatically make actuarial accountable for the business response.
Action and check. Document who monitors repair supplements, what change or persistence triggers escalation, and which business decision-maker receives it. Require actuarial to communicate material financial implications through the agreed route, and involve compliance when the issue raises a compliance question. Verify the revised process by tracing a later trend from dashboard to decision. The common mistake avoided is blaming the function that first quantified the consequence rather than identifying where the original information flow failed.
Worked Example: Two Functions Believe They Approve a Data Change
Hypothetical scenario. A commercial insurer updates a field used in both a pricing model and customer notices. The data team obtains actuarial sign-off because the field affects model inputs. A compliance analyst separately tells the product team that notice language should be checked when the field changes. The team receives both messages, assumes actuarial's sign-off covers the whole change, and releases it. The revised field is used correctly in the model, but several customer notices omit a required explanation under the insurer's internal procedure. Internal audit has not reviewed the change process.
Method: separate decision scopes. First identify the distinct activities: validating the field's effect on the model, checking notice content, and authorizing operational release. The evidence shows actuarial reviewed the model-input effect and compliance raised a notice concern. It does not show that either function was assigned to approve the other's subject matter or the full release.
Overlapping-mandate diagnosis. The messages created an ambiguity because the product team treated one specialist's approval as covering another specialist's concern. But receiving separate advice is not necessarily an actual conflict between formal mandates. Review the written process and approval records. If both functions were formally designated as final approvers of the entire change, the mandates overlap and need a decision rule. If actuarial had a limited model-validation role and compliance had a notice-review role, the principal gap is that the business release process did not require both applicable checks to be completed.
Assurance diagnosis and remedy. Internal audit's absence from this particular release does not prove an assurance failure: audit does not ordinarily approve each operating change. The relevant question is whether the process required independent testing and whether such testing was scheduled or performed. A focused remedy would identify the business owner of release, specify separate actuarial and compliance review scopes, and require evidence that each applicable review is complete before release. If independent testing is warranted under the audit plan, audit may later assess whether the control works, without becoming its operator. The common mistake avoided is labeling every instance of multiple reviews “overlapping ownership” without checking what each review was meant to cover.
Worked Example: A Report Exists but No Independent Assurance Occurs
Hypothetical scenario. A business unit uses an internal rule-based tool to flag commercial accounts for manual underwriting review. The unit's manager signs a monthly checklist stating that the tool is operating. An actuary reviews a sample of flagged accounts to assess whether the tool's output is suitable for a portfolio analysis. Compliance reviews the written underwriting procedure for consistency with internal requirements. A committee receives both reports. After a missed account is found, management claims that the committee's receipt of the reports proves the process was independently assured.
Method: distinguish review purpose from assurance. The manager's checklist is evidence of a business-level monitoring activity, not necessarily independent testing. The actuary's sample is described as supporting portfolio analysis, so it does not establish that actuarial tested the operating control. Compliance's review concerns the procedure's requirements, and committee receipt shows information was presented; neither fact alone establishes an independent assessment of whether the tool consistently flags accounts.
Diagnosis. On the stated facts, no independent operating-effectiveness test is identified. That supports a potential absent-assurance gap, subject to checking the audit plan and workpapers. The missed account is evidence of a control outcome, but one miss alone does not prove the full control design was defective or that every monthly checklist was inaccurate. Internal audit should determine whether its planned work covered the control and, if so, whether the work was completed with sufficient scope and evidence. If the control was outside the plan, the appropriate governance response is to assess and assign assurance coverage rather than ask audit to run the daily flagging process.
Action and check. Define the control objective, test a suitable sample of tool inputs and outputs, record exceptions, and assign business management to correct operating weaknesses. Have internal audit independently assess the control according to its mandate and report conclusions to the appropriate oversight body. The common mistake avoided is treating committee visibility or a specialist review with a different purpose as equivalent to independent assurance.
Common Diagnostic Traps
- Blaming the function closest to the consequence. Actuarial may quantify a loss or identify a trend after the fact, but that does not by itself establish ownership of the operating control.
- Confusing advice with accountability. Specialist advice can inform management decisions without transferring the business unit's responsibility to manage its process.
- Calling every delayed report a missed escalation. Confirm that a material trigger, reporting duty, or reasonable expectation existed, and establish when the relevant function knew the facts.
- Calling multiple reviews a mandate conflict. Compare the scope and decision rights of each review. Separate, complementary reviews are not automatically overlapping mandates.
- Treating internal audit as a control owner. Audit may identify weaknesses and recommend improvements, but management owns and operates controls. Audit's independent assurance role must remain distinct.
- Inferring assurance from a report's existence. A checklist, specialist analysis, or committee presentation is not necessarily independent testing of control design and operating effectiveness.
Check Your Understanding
For each hypothetical situation, identify the most supportable accountability diagnosis and the key fact you would verify.
- A business unit's daily reconciliation identifies a material mismatch. The analyst records it, but no one is assigned to decide whether it requires escalation. A month later, actuarial finds the resulting estimate was misstated. Identify the likely gap and one verification step. (Answer: Likely unclear ownership of escalation or decision-making; verify the documented reconciliation and escalation responsibilities.)
- Compliance sends a written warning about a process change to the business owner. The owner acknowledges it but continues the process without seeking a decision or documenting a rationale. Identify the likely gap, assuming the warning met the documented escalation trigger. (Answer: Missed escalation or failure to act on an escalated concern by the business owner; verify the trigger, acknowledgement, and decision record.)
- Actuarial and compliance both review a new customer classification field. Actuarial's mandate covers model suitability; compliance's mandate covers required customer communications. The release checklist asks for “function approval” but does not specify which review is needed. Is this necessarily a true mandate conflict? (Answer: No; it may be an unclear or incomplete release process rather than conflicting mandates; verify each function's documented scope and the release approval rule.)
- A committee receives a quarterly dashboard prepared by the business owner. The dashboard says the control passed, but no independent testing is documented. What does receipt establish, and what remains unproven? (Answer: Receipt establishes that the committee was given the dashboard; it does not establish independent assurance that the control was effective. Verify audit scope, workpapers, and any other independent testing.)
- Internal audit tests a sample of underwriting decisions and reports a control weakness. Management asks audit to revise the operating checklist and approve each future decision. Identify the governance risk and an appropriate boundary. (Answer: This would risk transferring management's control responsibilities to internal audit and impairing independence; management should own and revise the checklist, while audit independently assesses the remediation as appropriate.)