Reading an exception queue without rewriting the procedure

Written procedures describe the happy path. Exception queues reveal Friday nights, staff shortages, and the shortcuts people invent when volumes spike. During audits for fintech operators, we insist on sitting with the queue — headphones off, tickets open.

Watch handoffs

Who picks an item, who releases it, and whether the same person can do both. Dual-control failures often appear as polite workarounds when a colleague is on leave. The finding is not that people are careless; it is that the control design assumes perfect staffing.

Time stamps tell stories

Disposition times clustered at shift end can mean thoughtful batching — or rubber-stamping. We compare time stamps to training rosters and ask handlers to narrate a few tickets aloud. Their language usually matches the register better than the SOP abstract.

Leave the rewrite for later

Our job in the review is to observe and test. Redesigning the queue is remediation. Mixing the two in one invoice muddies independence. If you want redesign help after findings, we scope it separately — see our AML & KYC control review for the audit boundary.