Alert triage is the first-pass review of alerts produced by a firm's financial crime systems, such as transaction monitoring and sanctions screening. An analyst, or increasingly an automated model, looks at each alert, decides how urgent it is and either closes it as a false positive or passes it on for fuller review. The aim is to spend investigator time on the alerts most likely to matter, since the large majority of alerts in most programmes turn out to be harmless.
Triage normally follows written criteria: the customer's risk rating, the amounts involved, the scenario that fired and any earlier alerts on the same customer. Each decision and its reason is recorded as an alert disposition. Alerts that cannot be explained move to suspicious activity escalation. Slow or under-resourced triage creates an alert backlog, which regulators treat as a control weakness.