What is Alert Triage?
Alert triage is the first review of an alert to decide how urgent it is, who should handle it, and whether it needs a full investigation.
Alert triage sorts incoming alerts before analysts commit time to them. Each alert is assessed for risk and routed to the right queue, so that the most serious cases get attention quickly and lower-risk alerts are handled within set timeframes.
Alert triage keeps compliance operations manageable. Monitoring and screening systems can generate large numbers of alerts, and most turn out to be false positives. A clear triage process stops urgent cases from getting lost in the backlog and helps teams meet regulatory expectations for timely review.
How does alert triage work?
Alert triage usually starts by assigning each alert an initial risk score. The score draws on factors such as the customer's risk tier, the transaction amount, the geography involved, the product, and how many alerts the same customer has generated recently.
Alerts are then grouped into tiers with response deadlines. A typical setup might send high-risk alerts immediately to senior analysts or the enhanced due diligence team, require medium-risk alerts to be investigated within 48 hours, and allow up to five business days for low-risk alerts. Some alerts trigger automatic escalation, such as a confirmed sanctions match, which goes straight to the MLRO.
What is the difference between alert triage and alert investigation?
Alert triage decides how an alert should be handled, while alert investigation determines whether the activity is actually suspicious. Triage is fast and focused on routing and urgency. Investigation is deeper and involves gathering account data, reviewing counterparties, checking external sources like adverse media, and sometimes contacting the customer for context.
How do firms make alert triage more efficient?
Firms make alert triage more efficient through clear queues, deadlines, and better scoring. Separate queues for high-risk and lower-risk alerts stop urgent cases from waiting behind routine ones. Service level targets, such as resolving 90 percent of medium-risk alerts within three business days, help teams track whether they are keeping pace.
Machine learning can also support alert triage by ranking alerts based on how closely they resemble past confirmed cases. Plain-language reason codes for each score help analysts understand why an alert was ranked highly and where to start their review.
