A loss database that serves a purpose

The collection threshold

Too high and you capture only serious events — losing the precursor signals. Too low and you collect thousands of rows nobody analyses.

The practical rule: a threshold producing between 50 and 300 events a year for the entity. Below that, the sample is too small to reveal trends; above it, root cause analysis becomes impracticable.

The threshold is set in amount, but must be accompanied by three exceptions collected whatever the amount:

• Any event involving fraud, even €50;
• Any event that triggered a client complaint;
• Any event requiring a regulatory notification.

Near misses

A near miss — an event that could have caused a loss but did not — carries exactly the same causal information as a realised loss, without the cost.

They are nonetheless rarely collected, for a cultural reason: declaring one exposes a weakness that no damage has made public. An organisation collecting few near misses does not have fewer weaknesses: it has less trust.

The six indispensable fields

The gap between occurrence and detection is the most neglected field and one of the most instructive. A fraud detected after eleven months and one detected in two days do not pose the same problem, even at the same amount.

Root cause

An actionable root cause answers "what must we change?". Compare:

• "Human error" — no action possible, humans will keep making errors.
• "The second-level control is performed only on transactions above €100k, and the error concerned an €80k transaction" — the threshold is the problem, and it can be changed.

The five whys method suffices in the great majority of cases. It takes ten minutes and turns a loss database into an improvement mechanism.