What makes a finding material
A finding is an observation that bears on the question you are answering and that you can point at a source for. Most of what an investigation turns up is neither.
A finding is a statement about the case that bears on the question you are trying to answer, and that you can point at a source for. Nine transfers of between 9,400 and 9,800 USDC inside eleven hours is a finding. The customer holds an account is not, because nothing turns on it.
The distinction matters because an investigation produces far more observations than findings, and a record that does not separate the two is a record a reviewer has to sort through themselves.
Three tests
- Does it bear on the question?
You wrote one sentence at the start saying what would make this suspicious and what would make it fine. An observation that moves neither way is context, not a finding.
- Can you point at where it came from?
A transfer hash, a vendor and a date, a line in the customer record, a sentence the customer said. An observation with no source behind it cannot be checked and will not survive a review.
- Would it change a decision?
If the outcome is the same whether or not this is true, it is not material. This is the test that removes the most, and the one people apply last.
What is not a finding
| Not a finding | Why | What to record instead |
|---|---|---|
| The address scored 82 | A score is a vendor’s opinion with a number attached. Recording it as a reason records somebody else’s judgement as your own. | What the score was made of: the exposure, the hop depth, the vendor and the date. |
| The screen came back clean | Nothing found is not the same as nothing there, and both differ from a lookup that failed. | Which lists answered, which did not, and when. |
| The pattern looks like structuring | That is the conclusion, not the evidence for it. | The amounts, the window and the threshold they sit under. Let the pattern carry the weight. |
| The customer has been with us six years | True, and it bears on nothing unless the question was about their history. | Nothing, unless it answers the question you wrote down. |
Materiality is relative to the question
The same observation can be material in one case and irrelevant in the next. A transfer to a gambling service matters when the question is whether the customer’s declared purpose matches their activity. It matters much less when the question is whether a counterparty is sanctioned.
This is why the written question comes first. Without it, materiality has nothing to be measured against and every observation looks equally worth recording.
What this changes
Sort as you go rather than at the end. When you establish something, decide then whether it is a finding, and if it is, write its source down with it. Deciding later means deciding from memory, and memory supplies the conclusion rather than the evidence.
Related
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Reading findings
What a finding is, and what the two badges on it mean. Only one of them affects what you can decide.
What a risk score is and is not
A score is a vendor’s opinion expressed as a number. Two vendors can score the same address 30 and 70 without either being wrong, which is why a score opens an investigation rather than settling one.
Last checked against the product on .