Alert disposition notes that survive scrutiny
What investigators should write so a later auditor can reconstruct why an alert was cleared — without inventing a novel.
Cleared alerts fail audits for a predictable reason: the note restates the rule that fired and then asserts “no suspicion” without linking to the customer’s stated activity or the money’s path.
Three lines that earn their keep
- What moved — amounts, counterparties, and timing in plain language.
- What the customer profile predicted — and whether this movement fits.
- What evidence closed the loop — invoice, contract, or call note, cited specifically.
Avoid the template trap
Identical closing sentences across dozens of alerts tell examiners and auditors that judgment was outsourced to a phrase bank. Variation is not decoration; it is proof that someone looked.
When escalation is the honest answer
If the investigator cannot obtain source-of-funds clarity inside the service level, escalate. A late escalation with a clean trail usually costs less than a cleared alert that cannot be defended months later during a transaction monitoring sample audit.