Scope the mandate and authority

A head of compliance writes to an adviser: 'Prove that our transfer monitoring system has failed and recommend shutting it down this month.' The request sounds precise, but it embeds its conclusion. A higher alert count could reflect more transactions, changed detection rules, or poor data quality. Shutting off the system could remove a control before an alternative exists. The first advisory skill is to turn that instruction into a testable decision question: how has the institution's ability to detect unusual activity changed, and which response preserves coverage while the problem is examined? An adviser does not decide that a person committed a crime or that a statutory report must be filed. The adviser can identify missing evidence, test rival explanations, compare options and explain consequences to the authorised decision maker.

Write a short engagement charter answering five questions. Who owns the decision? Which decision needs support? Which products, period and entities are in scope? Which evidence may the team legitimately access? What will count as a completed assignment? If the sponsor says 'all financial crime' but only transfer alert records are available, describe the actual scope as a review of transfer monitoring design and operation over a stated period, not an assurance opinion on the whole financial crime programme. Distinguish the sponsor who supplies resources and accepts deliverables from the control decision owner and from the staff authorised to investigate or file reports. One person may hold multiple roles in a small institution; the functions still need separate decision rights. Map the approval path: the adviser submits findings, authorised management decides control changes, and the designated team applies law and policy to individual cases.

For each statement in the request, record its source and how it could be tested. 'The system failed' is a conclusion. 'Alerts increased from 800 to 1,280 per month' is an observation if the record is sound. 'We are missing more suspicious flows' is a hypothesis that needs a different test. The 60% rise alone says little about detection quality because the number of eligible transactions may also have changed. Ask for eligible transaction volumes, rule changes, missing data rates, time to resolve alerts, samples of closed cases and cases passed to investigation. Check the definition and observation period of each field before comparing rates. Missing information is neither proof that a control works nor proof that it fails. State confidence, identify evidence that could change the conclusion and set a deadline for obtaining it rather than burying uncertainty in a report footnote.

Compare three possible engagements. Independent assurance on operating effectiveness needs suitable independence, predefined criteria and a reproducible sample. A rapid advisory diagnosis can propose likely causes and an initial test plan, but should not be presented as comprehensive assurance. A redesign engagement requires design, approval, implementation and later validation to be kept distinct. Here a bounded diagnosis followed by a decision gate is useful: review three months of feeds and rule changes, inspect a defensible sample of alert closures, then decide whether a broader effectiveness test or a controlled rule adjustment is justified. The charter says what the review cannot answer, who may approve any shutdown, and how detection coverage continues during transition. This acknowledges the sponsor's concern without adopting the proposed remedy in advance.