When Controls Watch the Wrong Part of the Business

A dashboard can look reassuring while the most important activity happens outside its field of view. The question is not simply whether a business has controls. It is whether those controls follow the business it actually operates.

The event behind the question

Documented facts. On October 8, 2026, the OCC announced a $350 million penalty and a cease-and-desist order against American Express National Bank for weaknesses in its anti-money-laundering program. The regulator described a risk assessment that emphasized the bank’s smaller deposit business while paying insufficient attention to its dominant credit and charge card activities. It also identified shortcomings in staffing expertise, internal controls, testing and training. [1]

The Federal Reserve separately announced an action against American Express Company addressing implementation weaknesses and failures to sufficiently detect and report certain suspicious activity. These are related actions at different organizational levels. [2]

Scope. Those announcements establish the regulators’ stated findings and actions. They do not establish that every transaction was improper, describe every internal decision, or prove that subsequent remediation is complete.

Follow the work before evaluating the report

Interpretation. The broader systems lesson is about alignment. An organization can measure something accurately and still miss the question that matters. A report about one activity cannot stand in for evidence about another merely because both belong to the same institution.

Infrastructure Literacy starts by tracing the relationships beneath an outcome. Where does the work enter? Who handles it? What information follows it? Which exceptions become visible? Who can intervene? These questions turn a reassuring label such as “monitored” into a process that can be examined.

The same discipline applies beyond banking. A retailer may track completed deliveries without tracking damaged goods. A service business may count closed support tickets without checking whether customers can use the service again. In each case, the reported result can be real while the reader’s interpretation exceeds what was measured.

A familiar problem in a smaller business

Hypothetical example. A distributor once accepted nearly every order by telephone. Its review process checked handwritten orders before staff entered them into the billing system. Later, most sales moved online, but the monthly quality report continued to emphasize the telephone checks.

The report could show excellent results even as incorrect online orders accumulated. Nothing in that example requires dishonest reporting. The business changed, and the review process failed to move with it.

Adding another signature to the old report would not answer the new question. The responsible manager would first need to map the online order path, identify where errors arise, and test whether someone detects and resolves them before shipment. The review must reach the activity creating the exposure.

Four questions that make a control useful

Practical application. First, ask what the control covers. Name the activity, population and period. A sample is useful only when its limits are understood; a successful check of yesterday’s process does not automatically cover today’s channel.

Second, ask who owns the response. Detecting an exception is only the beginning. Someone needs the authority, time and information to decide what happens next. A queue without an accountable owner can become a record of problems rather than a means of resolving them.

Third, ask how effectiveness was tested. A written procedure establishes an intended method. Evidence from actual cases helps show whether that method operates. Independent challenge can expose assumptions that the people running the process have stopped noticing.

Fourth, ask what changed since the last review. New products, growth, staff turnover, outsourced work and new technology can alter the path between an instruction and its outcome. A review date matters because the system being reviewed does not stand still.

Put the evidence next to the claim

Recommendation. In your next consequential review, choose one reassuring statement and ask for its supporting evidence. Replace “the process is covered” with a description of what was checked, what was excluded, who handled exceptions and what remains unresolved.

This is practical application and education, not a substitute for a bank’s legal or supervisory obligations. Its value is the habit of connecting authority, operating capability and evidence. The control becomes useful when it helps someone see the real work clearly enough to act.