The risk pack was a thing of beauty. Forty pages, colour-coded heat maps, every exposure ranked and trended. The committee worked through it line by line. Halfway down page nine sat the position that would, three weeks later, cost the bank more than the rest of the book combined.
It had been flagged. That is the uncomfortable part. The signal was in the report, correctly measured and accurately ranked. But the report was monthly, the committee met monthly, and the window to act on that position had opened and closed somewhere between two meetings. The bank did not have a detection problem. It had a latency problem.
Detection is the easy half
Risk functions are very good at the first half of the job and quietly weak at the second. They invest in measurement — better models, more data feeds, finer-grained exposure reporting — and treat the report as the deliverable. But a report is a record of what was true when it was written. By the time it is read, discussed, and acted on, the world has moved. A risk report that changes no decision in time is the most expensive kind of trivia in a different costume.
The strategist John Boyd gave us the sharpest way to see this. His OODA loop — Observe, Orient, Decide, Act — describes any contest as a cycle, and argues that the side with the faster loop wins, even against a better-resourced opponent. The point is not that observation matters. It is that observation is only the first quarter of the loop, and the advantage lives in how fast you come all the way round to Act.
Most risk functions have polished Observe to a fine art and left Orient, Decide, and Act running on a monthly committee calendar. The loop breaks not at detection, but at the speed from signal to decision.
The reason this persists is that latency is invisible. A model's accuracy can be back-tested and audited; the loop around it usually cannot, because no one timestamps it. So the delay never lands on a scorecard, the committee cadence goes unquestioned, and the function keeps pouring investment into the half of the job it can see.
A signal you cannot act on inside the window is not risk management. It is a record of the loss.
Instrument the loop, not just the signal
The lever is to measure and shorten signal-to-action latency, the way you already measure model accuracy. For your most material risk, put four timestamps on the loop:
- When did the signal first exist in the data — not when it reached a report?
- When did a human see it — and how long did it sit in a queue first?
- When was a decision made — and how many approvals stood between seeing and deciding?
- When did exposure actually change — the only timestamp that closes the loop?
The gap between the first timestamp and the last is your true risk-response time. Detection lives in the opening stretch; almost all of the recoverable delay lives in the rest. Halving the time a signal waits in a queue does more for your loss profile than a marginally better model — and costs far less.
This reframes what a risk function is for. It is not a desk that publishes the state of the book. It is a loop whose job is to turn a signal into a changed decision before the window closes. Measured by latency, most risk teams are slower than the risks they watch.
The cost of the lag is measurable
That latency carries a price, and it is not abstract. Occupational fraud is the cleanest illustration, because the data tracks exactly how long each scheme ran before it was caught.
Frauds caught within the first six months carried a median loss of about $30,000; those that ran two to three years before detection, about $250,000. Every month a signal goes unactioned compounds the loss — latency, not detection, is what scales the damage. The decision: invest in shortening the loop, not in a finer report.
Source: ACFE, Occupational Fraud 2024: Report to the Nations
The same shape holds across risk types, even where a single number is harder to pin down. A market position, a liquidity squeeze, a credit deterioration, a fraud ring — each has a window in which action is cheap and after which it is not. The report tells you the position; the loop decides whether you reach it in time.
For a regulator or a bank operating across several markets and currencies — where data arrives unevenly and a signal in one market can take days to surface centrally — the latency problem is sharper, not softer. The institutions that manage risk well under those conditions are not the ones with the prettiest reports. They are the ones whose loop is shortest.
Tensō builds decision products that close the loop — turning financial signals into a decision while the window is still open, not a report after it has shut. If your risk function produces sharp analysis but acts on it too slowly, that is the gap we close.