Nobody Is Reading the Dashboard: Why Compliance Programs Fail After the Finding, Not Before It

A compliance officer said something to us recently that has not stopped being true since.

The dashboards are picking everything up. Nobody is paying attention to them.

That is the state of a great many governance programmes in 2026, and it is not a detection problem. Detection is close to solved. A firm can buy a platform this week that will enumerate every misconfiguration, every unreviewed access right, every vendor whose SOC 2 lapsed in March. The findings will be accurate, well-presented, and correctly prioritised.

And then a notification count will grow in the corner of a screen, and the person who could act on it will be closing a deal instead.

What regulators actually punish

The clearest statement of this in recent enforcement is the SEC's January 2025 action against Two Sigma.

The firm's own employees identified vulnerabilities in certain investment models in or before March 2019. The vulnerabilities were addressed in August 2023. In the intervening four years the firm did not adopt written policies to address what it knew, and failed to supervise an employee who made unauthorised changes to more than a dozen models.

Two Sigma voluntarily repaid $165 million to affected funds and accounts during the investigation and agreed to pay $90 million in civil penalties, split evenly between two entities.

The rules are written about implementation

This is not a novel reading. It is what the obligations say.

SEC Rule 206(4)-7 requires an adviser to review, no less frequently than annually, the adequacy of its policies and procedures and the effectiveness of their implementation. Those are two separate tests, and the second one is the one firms fail. A well-drafted policy that nobody followed does not satisfy the rule; it documents the gap.

FINRA Rule 3110 requires a supervisory system reasonably designed to achieve compliance. Rule 3120 goes further and requires a member to test and verify that its supervisory procedures are reasonably designed, amend them where they are not, and report to senior management annually. Rule 3130 puts the chief executive's name on an annual certification that the firm has processes to establish, maintain, review, test and modify those procedures.

NYDFS 23 NYCRR Part 500 is the most explicit of the three. Since the 2023 amendments, the annual certification under 500.17(b) is signed by both the highest-ranking executive and the CISO — and the rule contemplates two possible filings. Either material compliance, or a written acknowledgement that the firm was not compliant, identifying the areas requiring material improvement and setting out a remediation plan with a timeline.

That second option deserves more attention than it gets. The regulator has built a formal path for *we know, and here is when it will be fixed.* It is only available to a firm that is actually tracking the gap. A firm that cannot say what is outstanding cannot use it.

Why findings sit

Having watched this across a lot of environments, the failure is almost never ignorance or bad faith. It is four ordinary things.

Notice that none of these is fixed by a better dashboard. Three of the four are fixed by naming a person and attaching a consequence.

What "assigned" has to mean

An assignment that holds has four parts, and most finding workflows have one of them.

And the step most often skipped: a claimed fix is a claim until a re-test confirms it. Somebody saying a control is remediated and a check proving it operated are different facts. A finding should move to awaiting verification, not to closed, on somebody's word — and then be watched, because a configuration corrected in March is the one that quietly reverts in September.

Accepted risk is not the same as ignored risk

This is the distinction that most changes how a programme reads from outside, and it costs almost nothing to adopt.

A risk the firm decided to accept — with a named accepting owner, a written rationale, the residual rating, and an expiry date — reads as governance. The firm looked, understood, decided, and wrote it down.

The identical technical gap, with no decision record attached, reads as neglect.

Same facts. Opposite conclusion in an examination. And an acceptance that reaches its expiry without renewal should reopen, because an acceptance is a decision with a clock on it, not a permanent waiver.

The role nobody has named

Here is the uncomfortable part, and it is the reason this gap persists.

Somebody has to chase. Not design the programme, not interpret the rule, not test the control — chase. Confirm the finding reached a human, confirm the human accepted it, confirm the date is real, escalate when it is not, and keep the record of each of those.

It is unglamorous, it is nobody's idea of a career, and it is about half of what compliance work actually consists of. Firms are reluctant to resource it because it looks like administration, and compliance teams have been getting leaner for a decade.

The firms that solve it do one of three things. They name an internal owner with genuine authority and accept that it is a real portion of someone's week. They give the accountability to an outsourced compliance partner who already holds the client relationship and can make the call that lands. Or they engage the provider operating the controls to own the remediation loop as well as the detection.

What does not work is assuming the dashboard will do it. The dashboard is doing its job already. It found the thing.

The question worth answering before somebody else asks it

Pick the oldest open finding in your environment. Not the worst — the oldest.

Who owns it by name, what date did they commit to, and what happened when that date passed?

If the answer takes more than a minute to assemble, the gap in the programme is not in detection. And the four years between March 2019 and August 2023 started exactly the same way: with a finding that was correctly identified, accurately recorded, and assigned to nobody in particular.

The Centience Governance Score is a free, five-minute self-assessment that scores your firm 0–100 across cybersecurity, data and records, supervision, infrastructure, and AI governance — including whether your findings carry an owner and a verification record.

Get Your Free Governance Score

For what an assessor tests when your controls are the ones under review, see vendor due diligence in 2026, or how Centience supports financial services firms specifically.