Impact-based incident declaration

Figure 01 / 12

The population that monitoring actually sees

21,560 of 22,000 source items enter this monitoring calculation. The missing 440 items are a coverage gap, not evidence of low risk. Reconcile stable identifiers and amounts where appropriate before interpreting the alert rate.

Figure data and text version

Population state	Items
Included in monitoring	21,560
Absent from this run	440

A low technical error rate can conceal concentrated customer harm or unreconciled money. Declaration should use the affected service and consequence, not only infrastructure alerts.

The reference case starts with the stated population and a functioning evidence path. The owner is risk operations.

All amounts, rates, capacity limits, and outcomes in this case are synthetic. The three conditions are separate assumptions for comparison. A better result in the response condition is not measured proof that the proposed control causes that improvement. The figures expose the calculation and its limits; a real deployment needs its own evidence.

Read the result

The daily source population is 22,000 items, but 440 are outside the completed monitoring run. The included population creates 453 hits and 371 unique cases. With 82 cases already open and capacity for 430, the queue closes at 23. Coverage, duplicate work, and staffing are separate causes; reducing one number does not prove that the overall control improved.

Figure 02 / 12

From scenario hits to unique cases

453 raw hits become 371 cases after removing 82 repeated references to the same case under the stated merge rule. Deduplication should reduce duplicate work while retaining the underlying events and reasons. It must not merge unrelated activity merely because values look similar.

Figure data and text version

Stage	Count
Raw scenario hits	453
Duplicate references	82
Unique cases	371

Figure 03 / 12

The queue balance is an accounting identity

Opening backlog 82 + arrivals 371 − completed cases 430 = closing backlog 23. Completion is capped by both available work and the stated capacity. This identity is useful even when average handling times are uncertain.

Figure data and text version

Movement	Cases	Definition
Opening backlog	82	Unresolved at window start
New cases	371	Unique arrivals in this window
Completed	430	Reached a defined completion state
Closing backlog	23	Unresolved at window end

Figure 04 / 12

Backlog accumulates across uneven days

This deterministic six-day example applies a stated daily arrival multiplier and a constant completion capacity. Unused capacity does not carry forward as completed work. The series is a workload illustration; it omits variable case durations and specialist routing. Horizontal positions are the labeled observations or scenarios; equal spacing does not imply equal numerical increments.

Figure data and text version

Day	Closing backlog
D1	23
D2	0
D3	15
D4	141
D5	119
D6	0

Figure 05 / 12

Arrivals and completions need separate plots

The service line cannot exceed the work available that day. A team can complete more cases than arrive while clearing an opening backlog. Conversely, stable staffing can coexist with a growing queue when arrivals remain higher than capacity. Horizontal positions are the labeled observations or scenarios; equal spacing does not imply equal numerical increments.

Figure data and text version

Day	Arrivals	Completions
D1	371	430
D2	315	338
D3	445	430
D4	556	430
D5	408	430
D6	260	379

Figure 06 / 12

An illustrative age profile of open work

The closing backlog is 23 cases. The 50/30/remainder split is an explicit illustrative age allocation, not a distribution inferred from the arrival model. Production age buckets must come from each case’s actual receipt and status history.

Figure data and text version

Age bucket	Open cases
Under one day	12
One to three days	7
Over three days	4

Figure 07 / 12

Completion outcomes are not criminal labels

Of 430 completed review tasks, 73 are referred for further assessment, 52 need another evidence action, and 305 close under the stated procedure. These are operational outcomes. None is a probability of money laundering or a substitute for a reporting decision.

Figure data and text version

Review disposition	Tasks
Referred for assessment	73
Further evidence action	52
Closed under procedure	305

Figure 08 / 12

Known-event tests assess specific coverage

The injected test set contains 100 known test events designed to exercise declare the incident from impact. The system surfaces 92. That 92% detection result measures this constructed test set only; it does not establish population-wide detection of illicit activity.

Figure data and text version

Measure	Count	Interpretation
Injected known events	100	Defined test population
Detected by the scenario	92	Expected evidence reached the control
Not detected	8	Investigate data, logic, and delivery
Real-world illicit prevalence	Unknown	Not inferred from this test

Figure 09 / 12

Data quality has several independent dimensions

Each row is a different field requirement over the same source population. Completeness alone does not establish that values are accurate or current. The case uses explicit illustrative missing counts to show how data quality can affect scenario coverage.

Figure data and text version

Field requirement	Present	Absent
Party reference	21,890	110
Event time	21,780	220
Counterparty context	21,340	660

Figure 10 / 12

Type the relationship before drawing an inference

This evidence map distinguishes a customer relationship, a transfer, and a case reference. The links support declare the incident from impact; they do not imply common ownership or intent. A shared data point is a lead whose meaning depends on source, time, and context.

Figure data and text version

From	To	Relationship
Impact-based incident declaration	Counterparty A	Observed transfer
Impact-based incident declaration	Profile record	Declared business
Counterparty A	Case record	Evidence reference
Profile record	Case record	Context for review

Figure 11 / 12

Case clocks start from defined events

A legal deadline, an internal response target, and an evidence-expiry date can start from different events. The hours here are internal teaching targets only. They are not BSA, sanctions, consumer-protection, or other statutory deadlines.

Figure data and text version

Event	Relative time	Operational meaning
Source event	T0	Activity occurred
Data arrival	T0 + 2 hours	The monitoring system learned it
Case created	T0 + 3 hours	Work entered an owned queue
Internal review target	T0 + 27 hours	Illustrative 24-hour target from case creation
Disposition	Recorded separately	Use actual decision and reporting records

Figure 12 / 12

The end-to-end delivery contract

The scenario is incomplete until the intended evidence reaches an owned case. For declare the incident from impact, verify source coverage, hit creation, queue acceptance, reviewer access, and final disposition separately. A green job status proves only that a job reported completion.

Figure data and text version

Boundary	Acceptance evidence
Source to scenario	21560 included source items; 440 missing
Scenario to case	453 hits linked to 371 unique cases
Case to reviewer	Required evidence visible under the reviewer role
Reviewer to outcome	Disposition, rationale, and any separate reporting decision retained

Connect the result to the system

Identify affected customers, actions, amounts, and required controls and appoint an incident owner.

Check the population, evidence, permitted action, and actual effect together. A balanced calculation can still use the wrong population; a successful response can still leave an unknown financial outcome. The case’s numerical result applies only to its stated assumptions.