A $1.2 billion FinCEN penalty against Bank of America, announced October 13, 2026, highlighted more than just missed detection. Regulators found that the bank failed to report over $5 billion in suspicious transactions promptly. Identified weaknesses and escalated concerns didn't consistently lead to corrective action. The bank also relied on external inquiries, including those from law enforcement and other financial institutions, to identify activities its own monitoring should have caught.
You don't have to be a bank to face this issue. This checklist helps determine if a finding in your Compliance Program can be traced from identification to an accountable decision, corrective action, and evidence that the fix works. Each item has a done/not-done state and a description of what effective practice looks like.
Prerequisites
Before you start, ensure you have:
- A current Risk Universe, so you know which controls protect which objectives.
- A defined issue or finding log, even if it's in a spreadsheet.
- Role definitions mapped to the Three Lines Model: who owns and executes controls (first line), who monitors and challenges (second line), and who provides independent assurance (third line).
- Access to your last two cycles of control test results and open findings.
If you can't produce these, start there. The rest of the checklist depends on them.
The Checklist
1. Every control has a named owner, not a team.
☐ Done ☐ Not done
Check each material control for a single accountable individual. A distribution list isn't an owner.
Effective practice: Any control can be traced to a person who can authorize action, with a named backup.
2. Monitoring outputs are tied to a defined responder.
☐ Done ☐ Not done
Every alert, exception report, or test failure should route to someone obligated to act. A report that gets generated and filed is activity, not response.
Effective practice: For each monitoring activity, you can name who receives the output, what they must decide, and by when.
3. Escalation triggers are written down.
☐ Done ☐ Not done
Define what makes an issue escalate: severity, age, recurrence, or exposure to a priority risk. Critical issues shouldn't depend on someone independently deciding whether to raise their hand.
Effective practice: Triggers include thresholds and timelines, and the receiving decision-maker is named by role.
4. Escalated items produce a recorded decision.
☐ Done ☐ Not done
Escalation without a decision is just redistribution of the problem. Require a logged outcome: remediate, accept the risk, or defer with a date and rationale.
Effective practice: Every escalated item shows who decided, when, and on what basis. Risk acceptances carry an expiry.
5. Corrective actions have an owner and a due date.
☐ Done ☐ Not done
Separate the person who decides from the person who completes the work. Both should be visible on the record.
Effective practice: No open action lacks an owner, a due date, and a link back to the originating finding.
6. Closure requires independent verification.
☐ Done ☐ Not done
Completing a task doesn't prove the weakness is fixed. Before closing a material finding, someone independent of the work confirms the safeguard now operates as intended. Scale the depth of verification to the risk.
Effective practice: Closure criteria are defined when the action is opened, and the verifier isn't the person who did the remediation.
7. Second-line challenge is documented.
☐ Done ☐ Not done
Risk and compliance functions should be able to show where they challenged first-line conclusions, not just where they received reports.
Effective practice: Challenge records exist for significant findings, including disagreements and how they were resolved.
8. Internal audit provides assurance over the remediation process itself.
☐ Done ☐ Not done
Third-line work shouldn't only test controls. It should test whether the issue-management process reliably moves findings to verified closure. For public companies, this connects to Remediation of Deficiencies under the Sarbanes-Oxley Act, where deficiency evaluation and remediation feed management's internal control assessment. AS 2201
Effective practice: An audit or independent review covers the issue lifecycle at a defined frequency, with results reported to the audit committee.
9. Leadership reporting separates status categories.
☐ Done ☐ Not done
A single "compliant" percentage hides the real picture. Report these separately: untested controls, failed tests, overdue remediation, and fixes awaiting verification.
Effective practice: Executives and the board can see where a decision or intervention is needed, not just a summary score.
10. You've tested the trace end to end.
☐ Done ☐ Not done
Pick a recent material finding and follow it: identification, owner, escalation, decision, action, verification, closure. Time each handoff.
Effective practice: You can complete the trace using records alone, without asking anyone to reconstruct it from memory.
Common Mistakes
- Treating completed monitoring as evidence of control effectiveness. A generated report says the activity ran. It doesn't say the underlying risk was addressed.
- Letting the same team verify its own fix. Independence doesn't require a separate department, but it does require a reviewer who can challenge the work without being responsible for performing it.
- Closing findings on task completion. Marking an item done when the remediation ticket closes, rather than when the safeguard is shown to work, creates false assurance.
- Blurring the lines. When second-line teams start executing controls, or internal audit starts owning remediation, the challenge function degrades. Coordinate, but keep execution and assurance separate.
- Relying on outside signals. If regulators, law enforcement, or counterparties find problems before your monitoring does, your detection and escalation design needs rework, not just the individual issue.
- Letting small gaps accumulate. A control tested less often than intended, an exception left open, an issue closed without verification. Each looks manageable alone. Together they erode the safeguards you depend on.
Next Steps
Start with item 10. Run the end-to-end trace on one recent material finding this week. Wherever the trail goes cold, you've found the gap that items 1 through 9 are meant to close.
Then prioritize. Fix ownership and closure criteria first, since they're cheapest and unlock everything else. Add independent verification for your highest-risk findings next, and sequence the rest by exposure. If you're managing this in spreadsheets, consider whether a GRC Platform would give you the linkage between findings, owners, actions, and verification evidence that manual tracking struggles to sustain.
Finally, put the question to your own leadership team: if one of your most critical safeguards stopped working today, how quickly would you know, and who would be accountable for fixing it? If the answer takes more than a moment, the checklist has work to do.
