Measure How Alerts and Investigations Are Actually Worked
Pyze measures the steps analysts take across case management, screening, transaction monitoring and reference systems, so alert handling capacity and investigation consistency can be evidenced.
Structural facts about the method and its timing. What a given operation yields depends on its alert mix and on how much of the investigation work sits inside the case management system.
Financial crime leaders are accountable for alert disposition, investigation quality and filing timeliness, and are asked to show regulators and executives that the operation is staffed and controlled appropriately. Case management systems record the outcome of an alert, the disposition and the timestamps. They do not record the research an analyst performed across other systems to reach it, which is where most of the time is spent and where investigation practice diverges between analysts and sites.
Questions Asked of This Role
Alert volumes and false-positive handling that consume analyst capacity before any investigation begins
Analyst capacity that is difficult to size when the effort per alert varies by alert type, team and site
Inconsistent investigation steps between analysts working the same alert type, which complicates quality assurance
Regulator expectations on evidence of how decisions were reached and on governance of the models and rules that generate alerts
SAR and STR filing timeliness that depends on research steps spread across several applications
Key Questions and Outcomes
Each question shows the answer available today, why that answer is insufficient, and what changes with Pyze.
How much analyst time does each alert type consume, and does the staffing model reflect it?
Alert counts by queue and average handling time reported from the case management system.
Handling time in the case system covers the period a case was open. It does not show how much of that period was spent in screening tools, external data sources, document stores or email, so the effort per alert type is an average and cannot be tied to specific steps.
Measured time and step sequence per alert type across every application the analyst touches, so staffing and tuning discussions use observed effort for each queue.
Do analysts follow the documented investigation procedure for each alert type?
Sample-based quality assurance reviews of closed cases against the procedure.
Sampling covers a small share of cases and reviews the recorded output of a case. It does not show which research steps were performed or skipped on the cases that were not sampled.
The documented procedure compared with the observed sequence of steps across all cases in scope, reported at the process level, so variation from the procedure is quantified and located by alert type.
What is the evidence that the investigation process is consistent and under control?
Policy documents, procedure manuals and quality assurance sample results.
Documents describe the intended process. Sample results describe the cases that were reviewed. Neither describes how the work is performed across the full population of alerts.
A repeatable measurement of how investigations are performed across the full population, with the method documented, so the evidence can be reproduced for an examiner and re-run after a change.
Engagement Sequence
Instrument the alert handling and investigation applications in scope, with no change to procedures or tooling. Baseline the effort and step sequence for each alert type while the work runs normally.
Opportunities documented and sized across the five levers, including steps that can be standardized, steps that can be simplified, and research that can be prepared before an analyst opens the alert.
First changes implemented under your change and model governance processes. Measurement continues so the effect on analyst effort and procedure adherence is measured with the same method as the baseline.
Frequently Asked Questions
Does Pyze capture customer or transaction data? +
No. Pyze captures application interaction metadata: which application, which screen, the sequence and the timing. It does not capture keystrokes, field values, free text or screen contents, so customer names, account numbers and transaction details are not collected. Collection is limited to an explicit whitelist of business applications, identifiers are pseudonymous, and the unit of analysis is the process.
Does this change how alerts are generated or dispositioned? +
No. Pyze does not alter alert generation, scoring, thresholds or disposition decisions, and it does not interact with your monitoring models. It measures how analysts work the alerts those models produce. Any change to rules or models remains under your existing model governance.
Can the results support a regulatory examination? +
The measurement can be provided as supporting evidence of how investigation work is performed and how consistently procedures are followed. Pyze does not make compliance determinations, and the interpretation of the results against regulatory requirements remains with your compliance function.